2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike
Size 2.3MB
Sample260730-3blc6ahb63
SHA256 526bc8ba572d95f794e2785fc21ed6b7437bf516fd6a3106c6d4ffd94eb80534
MD5 fdf6094d6387205ce3d30dca4b4a06a2
SHA1 a9263d75988a8169a66382460b3bd1f3b566f440
SHA512 8e35cead6d8d322e313a0bac38d504cd6c42bbe12117d140d9e2639e4edd95e84bc8824c377ef9e055e3c557eb25859c539b6686d732237a276064d3a2db9793
SSDEEP 49152:4+cB3XbGc3P45Q2P+i/si3nyvITsz6rIO17/ZqNIZ7878r+9Mm18hq:1cBnp/yQ2rsRQaEIg7RqNIZi18hq
TLSH
T1B5B5BF5362155A5EC267D539C26A623A7236B3883331EFFB0C8C5E39FE429DA4F09714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike

File Explorer

2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike

.exe 2.3MB

2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike

IMPHASH 21d5fae2923dd7d978d74dfd737573d6
SHA256 526bc8ba572d95f794e2785fc21ed6b7437bf516fd6a3106c6d4ffd94eb80534
MD5 fdf6094d6387205ce3d30dca4b4a06a2
SHA1 a9263d75988a8169a66382460b3bd1f3b566f440
SHA512 8e35cead6d8d322e313a0bac38d504cd6c42bbe12117d140d9e2639e4edd95e84bc8824c377ef9e055e3c557eb25859c539b6686d732237a276064d3a2db9793
SSDEEP 49152:4+cB3XbGc3P45Q2P+i/si3nyvITsz6rIO17/ZqNIZ7878r+9Mm18hq:1cBnp/yQ2rsRQaEIg7RqNIZi18hq
TLSH
T1B5B5BF5362155A5EC267D539C26A623A7236B3883331EFFB0C8C5E39FE429DA4F09714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsDebuggerPresent LoadLibraryExA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

mscoree

CLRCreateInstance

ntdll

NtCreateFile NtOpenFile NtQueryInformationProcess NtReadFile NtSetInformationThread NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoCreateGuid CoInitializeEx PropVariantClear PropVariantCopy

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _exit _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

724KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_fdf6094d6387205ce3d30dca4b4a06a2_akira_cobalt-strike

api-ms-win-core-winrt-error-l1-1-0

kernel32

mscoree

ntdll

ole32

oleaut32

propsys

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic