2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom

General

Target
2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 301KB
Sample260816-wtx2cafb23
SHA256 32af7e824996078c4a74aaa096bfd6d7622e56cff135454abebe77c1ed4bd383
MD5 41ecbfe394d643bf237749ef9971aa3e
SHA1 00d8f7d1f2909b25bc171f7fde3d395971f0a7cf
SHA512 3311c6d19239e976939463d60a3e5f24dcdb134c0b06ed4a9c82f4b3d2b0423f4556222ba527ed075381f28344ace2ee85fc40573e02df0115df5364dacbe662
SSDEEP 6144:63j3tQqhlZqZp4CGbtBMTWmACw8jGH5Gu9:SdPkZp4CG/BmAC1jGH
TLSH
T177649D15FA9425F9F55BC03C8A518666AA3BB8450B219AFF23B402357F276F10F3CB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 301KB

2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 93e8d3e9f24df7214859825c21f2a118
SHA256 32af7e824996078c4a74aaa096bfd6d7622e56cff135454abebe77c1ed4bd383
MD5 41ecbfe394d643bf237749ef9971aa3e
SHA1 00d8f7d1f2909b25bc171f7fde3d395971f0a7cf
SHA512 3311c6d19239e976939463d60a3e5f24dcdb134c0b06ed4a9c82f4b3d2b0423f4556222ba527ed075381f28344ace2ee85fc40573e02df0115df5364dacbe662
SSDEEP 6144:63j3tQqhlZqZp4CGbtBMTWmACw8jGH5Gu9:SdPkZp4CG/BmAC1jGH
TLSH
T177649D15FA9425F9F55BC03C8A518666AA3BB8450B219AFF23B402357F276F10F3CB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

92448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

m5ms7_f4e5.pdb

kernel32

CopyFileW CreateDirectoryW EnumSystemGeoID GetLastError GetProcessHeap HeapFree HeapReAlloc SetLastError GetCurrentDirectoryW RtlCaptureContext GetEnvironmentVariableW LoadLibraryA GetProcAddress lstrlenW CloseHandle WideCharToMultiByte RtlVirtualUnwind MultiByteToWideChar HeapAlloc GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW GetModuleHandleExW RemoveVectoredExceptionHandler RtlLookupFunctionEntry AddVectoredExceptionHandler QueryPerformanceFrequency SetThreadStackGuarantee GetCurrentThread GetCurrentProcess GetCurrentThreadId WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject WriteConsoleW QueryPerformanceCounter ExitProcess SetUnhandledExceptionFilter RtlUnwindEx EncodePointer RaiseException RtlPcToFileHeader FreeLibrary GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapSize FlushFileBuffers SetFilePointerEx CreateFileW GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WriteFile TerminateProcess IsProcessorFeaturePresent SetStdHandle

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

Name

.text

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_41ecbfe394d643bf237749ef9971aa3e_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

generic