2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike
Size 847KB
Sample260813-agylfsv1as
SHA256 8b7dc0672350803134dab6be503fdfd6d36c187081dd75a5d8f388bf50ee0cb2
MD5 c5f56dc957a00438410558e103cda606
SHA1 717ed8312f9be6563e4ef56ece648ac65af8c979
SHA512 ec142287eaed1b8d71e9a76a836bc1b59e3f3bf898b3ea0d837b429b18d191a04c3e154cb211c41f651106a3b68e149f8c8c817cb99b9f89c906fbf868f0ec6f
SSDEEP 24576:J3BwG8F4LWnwzZONHP/n671Op8qRs2GP5Hw:dGG8FpwlOBn671OCqR/GP5Hw
TLSH
T19705D0AAB5999CBDE212C03D8157A1377B3A35C52233BFB319A89A301F13EC16F55316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike

File Explorer

2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike

.exe 847KB

2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike

IMPHASH 2374de564b69fe7da741c2aa20928653
SHA256 8b7dc0672350803134dab6be503fdfd6d36c187081dd75a5d8f388bf50ee0cb2
MD5 c5f56dc957a00438410558e103cda606
SHA1 717ed8312f9be6563e4ef56ece648ac65af8c979
SHA512 ec142287eaed1b8d71e9a76a836bc1b59e3f3bf898b3ea0d837b429b18d191a04c3e154cb211c41f651106a3b68e149f8c8c817cb99b9f89c906fbf868f0ec6f
SSDEEP 24576:J3BwG8F4LWnwzZONHP/n671Op8qRs2GP5Hw:dGG8FpwlOBn671OCqR/GP5Hw
TLSH
T19705D0AAB5999CBDE212C03D8157A1377B3A35C52233BFB319A89A301F13EC16F55316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

GetUserNameW RegCloseKey

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount64 GetVersionExW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtQueryInformationProcess NtWriteFile RtlNtStatusToDosError

user32

GetDesktopWindow GetForegroundWindow GetSystemMetrics GetWindowLongW IsWindowVisible SetForegroundWindow

Name

.text

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c5f56dc957a00438410558e103cda606_akira_cobalt-strike

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

msvcrt

ntdll

user32

generic