2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer

General

Target
2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer
Size 533KB
Sample260905-l4cs2sam21
SHA256 f056c84eee772961aff33eec1ceb393fe8ba9570a40a2ccfec957185ca282cfa
MD5 5957902083bc89f254bba0fca7afbf39
SHA1 f0101431b11cd63322d584cc870803cb5d06c4d0
SHA512 c58ed252ed6d1bba79632ddd833461081741828120af658022bc2ccee7f582f5aac10708fd6a5b2d9f8443317253f208a95b570f89a3245cbef52b90d9fbc754
SSDEEP 12288:64S3Hss5ufPbE5JldKk0k8QWPaoFYMc6AotWNrar:6dtufPopdp0k8NP+DotWNW
TLSH
T113C4F1D6BBA500F8D0AAC17985964A25E7F27801EBA449EF03B0058B1F377D15F3AF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer

File Explorer

2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer

.exe 533KB

2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH a226e13c69b60cc31f560c39a4513052
SHA256 f056c84eee772961aff33eec1ceb393fe8ba9570a40a2ccfec957185ca282cfa
MD5 5957902083bc89f254bba0fca7afbf39
SHA1 f0101431b11cd63322d584cc870803cb5d06c4d0
SHA512 c58ed252ed6d1bba79632ddd833461081741828120af658022bc2ccee7f582f5aac10708fd6a5b2d9f8443317253f208a95b570f89a3245cbef52b90d9fbc754
SSDEEP 12288:64S3Hss5ufPbE5JldKk0k8QWPaoFYMc6AotWNrar:6dtufPopdp0k8NP+DotWNW
TLSH
T113C4F1D6BBA500F8D0AAC17985964A25E7F27801EBA449EF03B0058B1F377D15F3AF25
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

schmaasheems.pdb

kernel32

GetSystemInfo GetCurrentProcessId GetCurrentProcess QueryPerformanceFrequency GetSystemTimeAsFileTime GetCurrentThread GetCurrentProcessorNumber GetLastError QueryPerformanceCounter GetMaximumProcessorCount GetModuleHandleA LoadLibraryA SetFileInformationByHandle GetProcessHeap HeapAlloc WaitForSingleObject GetACP GetCPInfo IsValidCodePage GetCommandLineA GetEnvironmentStringsW GetCommandLineW GetTickCount64 CloseHandle GetModuleHandleW TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive GetOEMCP WriteConsoleW HeapReAlloc CreateFileW SetFileTime SetLastError GetFullPathNameW MultiByteToWideChar HeapFree GetFileInformationByHandle GetFileInformationByHandleEx GetProcAddress SetFilePointerEx GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW WideCharToMultiByte FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW HeapSize FlushFileBuffers GetConsoleOutputCP WriteFile

ntdll

NtReadFile RtlGetVersion RtlNtStatusToDosError NtWriteFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_5957902083bc89f254bba0fca7afbf39_akira_cobalt-strike_icedid_rusty-stealer

kernel32

ntdll

generic