2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer

General

Target
2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer
Size 531KB
Sample260822-nws66stepb
SHA256 675f8a10da12c4e73f4e493eb47e915e897d550dbd6dbd0fc2da6835fdd5398f
MD5 8124759811049e68b8b3b7d52c8c7318
SHA1 7562b20b3f307a18157e0e9ff70a06fd9d4e77de
SHA512 d4df92b81d829fed29674e104de03f1166016cb4b7cd6c77b635f226b7e2341badf3698c09bd26522fee4508de1b490f36c311802eb46308aeeffa2086ca2f7c
SSDEEP 12288:RMRnsObY3tfnaIfdgaTPy4Np2GMH0GRRxpP:R8LctPaEu064fg0GRRxpP
TLSH
T126C4F19AB7A912FCC53AC07889654A21E7F3B8812B509ADF43D4594B3F277C15F3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer

File Explorer

2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer

.exe 531KB

2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH 0efdd9e086304316d3b9ad990a72f5b9
SHA256 675f8a10da12c4e73f4e493eb47e915e897d550dbd6dbd0fc2da6835fdd5398f
MD5 8124759811049e68b8b3b7d52c8c7318
SHA1 7562b20b3f307a18157e0e9ff70a06fd9d4e77de
SHA512 d4df92b81d829fed29674e104de03f1166016cb4b7cd6c77b635f226b7e2341badf3698c09bd26522fee4508de1b490f36c311802eb46308aeeffa2086ca2f7c
SSDEEP 12288:RMRnsObY3tfnaIfdgaTPy4Np2GMH0GRRxpP:R8LctPaEu064fg0GRRxpP
TLSH
T126C4F19AB7A912FCC53AC07889654A21E7F3B8812B509ADF43D4594B3F277C15F3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

49920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

feitchoosk.pdb

user32

GetForegroundWindow GetMessageExtraInfo GetFocus GetShellWindow

kernel32

CloseHandle WaitForSingleObject GetProcessHeap HeapReAlloc TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive WriteConsoleW SetFilePointerEx GetTempPathW HeapSize MultiByteToWideChar SetFileInformationByHandle GetLastError SetLastError CreateFileW GetProcAddress GetFullPathNameW HeapAlloc GetProcessHeaps GetDriveTypeW GetFileAttributesW GetMaximumProcessorCount GetActiveProcessorGroupCount GetCurrentThread IsProcessorFeaturePresent CompareStringW GetCurrentProcessorNumber LCMapStringW LoadLibraryA HeapFree GetFileInformationByHandle GetFileInformationByHandleEx GetConsoleOutputCP FlushFileBuffers GetModuleHandleA GetSystemWindowsDirectoryW GetCurrentDirectoryW SetFileTime SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect WriteFile

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile RtlGetVersion

winmm

joyGetNumDevs waveInGetNumDevs midiOutGetNumDevs midiInGetNumDevs

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_8124759811049e68b8b3b7d52c8c7318_akira_cobalt-strike_icedid_rusty-stealer

user32

kernel32

ntdll

winmm

generic