2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer
Size 2.7MB
Sample260731-klez1sycmd
SHA256 43849c5a42727034390a9b2e04298b171d1a2ba53a5545c0adb12ae3b629aede
MD5 fcf129c24153bd85321200cd48052940
SHA1 4e340700208711a6e9a44bdd4f72f48774a817fe
SHA512 dbce9fdfbc49c1d31446fb8e256224cfb15eb1a2ecde5b9aced3fface9412c20f409280bba1ce24f85639658458a0b1949d9cf1e3dca5ffaf182476ce5e76864
SSDEEP 49152:lDlKWK4LaUOTys923ruRhzGPSbuLhFHMJIOgVnUh7WLfq4i5zf6yYlBv5FCEDqli:Ne4LrOTG36zzG6CtgId47maziyYPvCE3
TLSH
T151D5236AF19658F9E467C03443494A639A3678458732ABFF079402346F2BBF11F3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer

File Explorer

2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer

.exe 2.7MB

2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer

IMPHASH f744b386a4857011365ff83ce58075b9
SHA256 43849c5a42727034390a9b2e04298b171d1a2ba53a5545c0adb12ae3b629aede
MD5 fcf129c24153bd85321200cd48052940
SHA1 4e340700208711a6e9a44bdd4f72f48774a817fe
SHA512 dbce9fdfbc49c1d31446fb8e256224cfb15eb1a2ecde5b9aced3fface9412c20f409280bba1ce24f85639658458a0b1949d9cf1e3dca5ffaf182476ce5e76864
SSDEEP 49152:lDlKWK4LaUOTys923ruRhzGPSbuLhFHMJIOgVnUh7WLfq4i5zf6yYlBv5FCEDqli:Ne4LrOTG36zzG6CtgId47maziyYPvCE3
TLSH
T151D5236AF19658F9E467C03443494A639A3678458732ABFF079402346F2BBF11F3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

169408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA GetProcAddress GetLastError CloseHandle CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLocalTime GetCommandLineW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry GetCurrentProcessId CreateMutexA WaitForSingleObjectEx GetCurrentProcess lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA GetModuleHandleW FormatMessageW GetTempPathW GetModuleFileNameW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW CreateFileW SetFileInformationByHandle CreateDirectoryW FindFirstFileExW FindClose ExitProcess HeapAlloc DeleteFileW CopyFileExW SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

DestroyWindow PostQuitMessage DefWindowProcW RegisterClassExW GetMessageW TranslateMessage DispatchMessageW CreateWindowExW

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError

Name

.text

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

512B

Virtual Size

15B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.4e0f29c

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1b5152b

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_fcf129c24153bd85321200cd48052940_akira_icedid_rusty-stealer

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

user32

ntdll

generic