1f07b14e65f88256bebe8f28259a7effafcd70389d55ad517d86db6252e82d24

General

Target
2026-08-20_010fa4d059e2e738db699816476ffb35_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 2.9MB
Sample260820-y6cbhsvcmf
SHA256 1f07b14e65f88256bebe8f28259a7effafcd70389d55ad517d86db6252e82d24
MD5 010fa4d059e2e738db699816476ffb35
SHA1 42ad314c93922877e4909d0d9ecdd998c2aa0d5f
SHA512 2146c35e9867bafcbe9b9e3525c740b1c72a94460e5633db3bfeb2dc4f8fe2befedf342ede473d600e62f1acdfee4c848653dfd505d46333e8afb820f684ca0f
SSDEEP 49152:SNcndY+rWXs/+sw8R0YasMUjhDRCn8k5EIBnP:7ZWjsw8m6j7Cn3HJP
TLSH
T1A2E5CFC18B076E91C18D84790689429E6730ED4F4E6487CBF2EDB668CC1A1ED3E799D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_010fa4d059e2e738db699816476ffb35_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 2.9MB
- SHA256 1f07b14e65f88256bebe8f28259a7effafcd70389d55ad517d86db6252e82d24
- MD5 010fa4d059e2e738db699816476ffb35
- SHA1 42ad314c93922877e4909d0d9ecdd998c2aa0d5f
- SHA512 2146c35e9867bafcbe9b9e3525c740b1c72a94460e5633db3bfeb2dc4f8fe2befedf342ede473d600e62f1acdfee4c848653dfd505d46333e8afb820f684ca0f
- SSDEEP 49152:SNcndY+rWXs/+sw8R0YasMUjhDRCn8k5EIBnP:7ZWjsw8m6j7Cn3HJP
- TLSH
  T1A2E5CFC18B076E91C18D84790689429E6730ED4F4E6487CBF2EDB668CC1A1ED3E799D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2