2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 15.6MB
Sample260808-htjbasbl4t
SHA256 734c154c70a6dfc8933ff7729313c8c7c1d0bcc3d7ed0e926384071153a80ecf
MD5 ca7e859ef7ef2173dda0e8d4df6239dd
SHA1 611839624b7974fe566bf3f98bd9ac174e56c474
SHA512 2d4ff5571b1b5f3446f02d5b6601e2609e243173a3bf69a0726ec67474f967cc953e78282dc209bea27be45cf4623c9cc83afd88491db370ff886ccb8374fb46
SSDEEP 98304:7xHi+7zRHPRVHR/MB23GjN97BUXEyW3dKUGS+Rm3am0zUUlNHOifhOZ3PsOkk:79i+XBXEfNBOXAIzRfBfW
TLSH
T126F62901BA5B649CD05AC870834A4A379A3174CB1A35BCFF31DC96783FB9BE05F28659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 15.6MB

2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 1fd22f59a6747db3fa96415a4b742a39
SHA256 734c154c70a6dfc8933ff7729313c8c7c1d0bcc3d7ed0e926384071153a80ecf
MD5 ca7e859ef7ef2173dda0e8d4df6239dd
SHA1 611839624b7974fe566bf3f98bd9ac174e56c474
SHA512 2d4ff5571b1b5f3446f02d5b6601e2609e243173a3bf69a0726ec67474f967cc953e78282dc209bea27be45cf4623c9cc83afd88491db370ff886ccb8374fb46
SSDEEP 98304:7xHi+7zRHPRVHR/MB23GjN97BUXEyW3dKUGS+Rm3am0zUUlNHOifhOZ3PsOkk:79i+XBXEfNBOXAIzRfBfW
TLSH
T126F62901BA5B649CD05AC870834A4A379A3174CB1A35BCFF31DC96783FB9BE05F28659
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11293888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

eagle_editor.pdb

opengl32

wglGetProcAddress

kernel32

HeapSize CloseHandle GetProcAddress LoadLibraryA InitializeSListHead LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter GetSystemTimeAsFileTime GlobalUnlock GetFileInformationByHandle GlobalFree GetModuleHandleW GetCurrentThread MultiByteToWideChar GetConsoleMode GlobalAlloc GlobalLock FormatMessageW FindNextFileW GetTempPathW GetModuleHandleA SetLastError WideCharToMultiByte WaitForMultipleObjects GetFileType FreeLibrary GlobalSize GetLastError GetFinalPathNameByHandleW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW Sleep WaitForSingleObject SetWaitableTimer WriteFileEx SleepEx GetFullPathNameW CreateWaitableTimerExW GetConsoleOutputCP GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter WriteConsoleW GetModuleFileNameW HeapAlloc SetEnvironmentVariableW CreateThread DeleteFileW ReleaseMutex CreateMutexA WaitForSingleObjectEx SwitchToThread GetSystemInfo ExitProcess GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindClose GetSystemTimePreciseAsFileTime FindFirstFileExW CancelIo GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetEnvironmentStringsW CopyFileExW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CreateEventW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

user32

ClientToScreen SetRect ClipCursor SetWindowPos GetSystemMetrics SetProcessDPIAware ShowWindow RegisterRawInputDevices SetWindowLongPtrA CloseClipboard PeekMessageW SendMessageW TranslateMessage GetWindowLongA PostQuitMessage GetRawInputData GetMessageW GetCaretPos KillTimer SetTimer DestroyWindow DefWindowProcW GetClipboardData GetClientRect GetKeyState GetWindowLongPtrA ShowCursor CreateWindowExW RegisterClipboardFormatW LoadCursorW DispatchMessageW RegisterClassW SetClipboardData LoadIconW MonitorFromPoint GetWindowRect SetCursor EmptyClipboard IsClipboardFormatAvailable OpenClipboard AdjustWindowRectEx ReleaseDC GetDC CreateIconIndirect PostMessageW

gdi32

DescribePixelFormat SetPixelFormat SwapBuffers CreateBitmap GetStockObject CreateDIBSection DeleteObject ChoosePixelFormat

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

shell32

DragAcceptFiles SHCreateItemFromParsingName DragQueryFileW

advapi32

RevertToSelf ImpersonateAnonymousToken

imm32

ImmCreateContext ImmGetCompositionStringW ImmGetContext ImmAssociateContext ImmSetCandidateWindow ImmReleaseContext ImmSetOpenStatus ImmGetOpenStatus ImmSetCompositionWindow ImmAssociateContextEx

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

ntdll

NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtReadFile NtOpenFile

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ca7e859ef7ef2173dda0e8d4df6239dd_akira_cobalt-strike_icedid_rusty-stealer_satacom

opengl32

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

gdi32

ole32

shell32

advapi32

imm32

api-ms-win-shcore-scaling-l1-1-1

ntdll

generic