2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom

General

Target
2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 12.2MB
Sample260820-lfbabace32
SHA256 ca7b1294eb6bb6e9e9980a6f855fbce1f388bd4bbb923e8fbfffffa4fdce2be1
MD5 e4e9a1b7fb066e6468c666f0b36f46c1
SHA1 7a46f336aa26a45df5df55b7ff300a30e2660083
SHA512 fa6f506f4e3258854bfc85f493ff52b9398f17367c5093ee9ba831d64b7638d192aac2455cbfea7cffb8b1607c25a6fd15b709f6b94c3ba1badd40adf6c277d9
SSDEEP 393216:g/uAe8PA1uVWp+RXc7wSE+LoHJyMn05Hia:gWWA1uWp+mMSpoHJyW05C
TLSH
T195D6330269DE2CF9E416C87482528A1299597C9F1732EDFF03C842365F6ABF52F353A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 12.2MB

2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 2a03bd8f682c34c87c1a33220d064e7f
SHA256 ca7b1294eb6bb6e9e9980a6f855fbce1f388bd4bbb923e8fbfffffa4fdce2be1
MD5 e4e9a1b7fb066e6468c666f0b36f46c1
SHA1 7a46f336aa26a45df5df55b7ff300a30e2660083
SHA512 fa6f506f4e3258854bfc85f493ff52b9398f17367c5093ee9ba831d64b7638d192aac2455cbfea7cffb8b1607c25a6fd15b709f6b94c3ba1badd40adf6c277d9
SSDEEP 393216:g/uAe8PA1uVWp+RXc7wSE+LoHJyMn05Hia:gWWA1uWp+mMSpoHJyW05C
TLSH
T195D6330269DE2CF9E416C87482528A1299597C9F1732EDFF03C842365F6ABF52F353A4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

227872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Overseer.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetSystemDirectoryW SetFilePointerEx FlushFileBuffers HeapSize RemoveDirectoryW GetLastError CloseHandle FindClose GetStdHandle GetConsoleMode WideCharToMultiByte FindFirstFileExW FindNextFileW CopyFileExW GetCommandLineW CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep QueryPerformanceFrequency GetExitCodeProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx ReadConsoleW CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread WaitForMultipleObjects DeleteFileW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile

Name

.text

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.8MB

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

generic