9e0f684961a9eaf1d0b2bdde0775e6e8e8b29945d415c8ecf0e3057adce90db9

General

Target
2026-08-19_d4429b38f11d60c421c5f3873943a1b2_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 3.0MB
Sample260819-1vw8navaje
SHA256 9e0f684961a9eaf1d0b2bdde0775e6e8e8b29945d415c8ecf0e3057adce90db9
MD5 d4429b38f11d60c421c5f3873943a1b2
SHA1 10829fc4cc043331415a8cdf218aaf81dfdde65b
SHA512 3e55ddfbd2dc989255007e50f3aab967b026b1e6f2eb8fdaa16a1c998cb16808588295c19f21a32cccc0eee78d1c072bb2555c18c3095d19df0e55aa1bc85924
SSDEEP 24576:8MG+afOPlG5GSbQLUHs2f5lo/rHfXmzVfJz587k5Igdj+RROEHukFierldyss+s+:8MG+7PlG5bbQoXxUaHLB5YV2SnS6
TLSH
T161E5C003E3291D9BD17288782159575366397C8B9EA0A2D7DB8C7B225DE70CC2E783D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_d4429b38f11d60c421c5f3873943a1b2_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 3.0MB
- SHA256 9e0f684961a9eaf1d0b2bdde0775e6e8e8b29945d415c8ecf0e3057adce90db9
- MD5 d4429b38f11d60c421c5f3873943a1b2
- SHA1 10829fc4cc043331415a8cdf218aaf81dfdde65b
- SHA512 3e55ddfbd2dc989255007e50f3aab967b026b1e6f2eb8fdaa16a1c998cb16808588295c19f21a32cccc0eee78d1c072bb2555c18c3095d19df0e55aa1bc85924
- SSDEEP 24576:8MG+afOPlG5GSbQLUHs2f5lo/rHfXmzVfJz587k5Igdj+RROEHukFierldyss+s+:8MG+7PlG5bbQoXxUaHLB5YV2SnS6
- TLSH
  T161E5C003E3291D9BD17288782159575366397C8B9EA0A2D7DB8C7B225DE70CC2E783D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2