2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike
Size 299KB
Sample260729-dd779sshpc
SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
MD5 1b7188bccb194e8ab89da7673ca9e029
SHA1 37b9cc0109457e3931d8638dacd6d07f6fb06ac9
SHA512 d3aeb93b42bd23ccb6d70682ccdb0d8b7be0543aaa2142fd1aedc879bb38904b5800680b63ad618853037281618f7124244a3dd8547378b4263c2bf537226a69
SSDEEP 6144:/aNAN6ij56+haK1aoAVhqRXBy0w8hFhTamraG:/aNAR3a2aoQKXBy0JFhTamr
TLSH
T1D6647B17B79555BCE15AC038934A95B3BA72B8CA06307DBF13E49A303F16D512F2CB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike

File Explorer

2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike

.exe 299KB

2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike

IMPHASH 81211bee023d6dedb9680443faeceffd
SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
MD5 1b7188bccb194e8ab89da7673ca9e029
SHA1 37b9cc0109457e3931d8638dacd6d07f6fb06ac9
SHA512 d3aeb93b42bd23ccb6d70682ccdb0d8b7be0543aaa2142fd1aedc879bb38904b5800680b63ad618853037281618f7124244a3dd8547378b4263c2bf537226a69
SSDEEP 6144:/aNAN6ij56+haK1aoAVhqRXBy0w8hFhTamraG:/aNAR3a2aoQKXBy0JFhTamr
TLSH
T1D6647B17B79555BCE15AC038934A95B3BA72B8CA06307DBF13E49A303F16D512F2CB1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegSetValueExW

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetTempPathW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointer SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFile __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtOpenFile NtRaiseHardError NtWriteFile RtlNtStatusToDosError

shell32

ShellExecuteExW

Name

.text

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

msvcrt

ntdll

shell32

generic