General
- Target 2026-08-01_42aa2a83724335b2389194bce6730b4e_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 6.0MB
- Sample260802-evrghsvaqc
- SHA256 240505117934e6b76d5b495030e532764ccb6916b537bd6da234dd2b498d1313
- MD5 42aa2a83724335b2389194bce6730b4e
- SHA1 33b33a269fca664dafabc786f591b3cb659f55d9
- SHA512 b8ea95efea4c673dd069573878b0cdd2e713b6006db1bacaefb42965f0da8b7b766c2b5f916eac3cb064a17d514c9aad79c61651f7598faf19a03a7ca5d21575
- SSDEEP 12288:07JKS1VVooG1kjTQfPwh71cBES0B+gyzErXGYvPhK/VpJFb:01KS1Tj90f3Yvc
- TLSH T144567D13E554A1EDE06FC035832A96E2EBBB386E471175EF01E466243F65AE81F3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_42aa2a83724335b2389194bce6730b4e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_42aa2a83724335b2389194bce6730b4e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_42aa2a83724335b2389194bce6730b4e_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 6.0MB
- SHA256 240505117934e6b76d5b495030e532764ccb6916b537bd6da234dd2b498d1313
- MD5 42aa2a83724335b2389194bce6730b4e
- SHA1 33b33a269fca664dafabc786f591b3cb659f55d9
- SHA512 b8ea95efea4c673dd069573878b0cdd2e713b6006db1bacaefb42965f0da8b7b766c2b5f916eac3cb064a17d514c9aad79c61651f7598faf19a03a7ca5d21575
- SSDEEP 12288:07JKS1VVooG1kjTQfPwh71cBES0B+gyzErXGYvPhK/VpJFb:01KS1Tj90f3Yvc
- TLSH T144567D13E554A1EDE06FC035832A96E2EBBB386E471175EF01E466243F65AE81F3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Modifies RDP port number used by Windows
-
Registers new Windows logon scripts automatically executed at logon.
-
Checks whether UAC is enabled