2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 337KB
Sample260910-hkfttazcph
SHA256 5f1ee6986713d9e2f331980c6939fe3fc3c5ad1cd42a5db147660fc0d1a0cdaf
MD5 2a4a21eed8e32c7c28186b8315c3e544
SHA1 525cb5a8fcb856fd79b548f2ecc46a64fe2b0333
SHA512 750100267a56ca43178cb0100041582b00bd18773b2fe361ea9997f0163f0e51fd59c24603a2ef6166a1153bc49594539e851336e2eeb84b4e337d0aef130c16
SSDEEP 6144:dcy6pa4FDXUirZJ8Sqh/xqezFiGAmPe4QIbdjy1q:dWvZJ8SqZvpioekbd0q
TLSH
T1FD747CDEFFD561E8E057803B82054525AA37BC5D07116AEB2E6032252E37EE26F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 337KB

2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 3485bd51911b96eb1e89b8576fbaf586
SHA256 5f1ee6986713d9e2f331980c6939fe3fc3c5ad1cd42a5db147660fc0d1a0cdaf
MD5 2a4a21eed8e32c7c28186b8315c3e544
SHA1 525cb5a8fcb856fd79b548f2ecc46a64fe2b0333
SHA512 750100267a56ca43178cb0100041582b00bd18773b2fe361ea9997f0163f0e51fd59c24603a2ef6166a1153bc49594539e851336e2eeb84b4e337d0aef130c16
SSDEEP 6144:dcy6pa4FDXUirZJ8Sqh/xqezFiGAmPe4QIbdjy1q:dWvZJ8SqZvpioekbd0q
TLSH
T1FD747CDEFFD561E8E057803B82054525AA37BC5D07116AEB2E6032252E37EE26F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jpqqn_daxh.pdb

kernel32

OpenEventW CloseHandle CreateEventW CreateNamedPipeW GetEnvironmentVariableW Sleep LoadLibraryW GetModuleHandleW GetProcAddress CopyFileW DeleteFileW MoveFileExW CreateDirectoryW GetModuleFileNameW SetThreadStackGuarantee GetCurrentThread GetCurrentProcess GetCurrentThreadId GetModuleHandleExW GetLastError SetLastError HeapFree GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject HeapAlloc HeapReAlloc GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer LCMapStringW CompareStringW GetProcessHeap AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetCommandLineA GetCommandLineW IsProcessorFeaturePresent FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileType VirtualProtect LoadLibraryExW HeapSize FlushFileBuffers SetFilePointerEx CreateFileW InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile IsDebuggerPresent UnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle GetStringTypeW

user32

GetSystemMetrics

shell32

SHGetFolderPathW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_2a4a21eed8e32c7c28186b8315c3e544_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

user32

shell32

api-ms-win-core-synch-l1-2-0

ntdll

generic