2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer
Size 382KB
Sample260928-lfxtba1aja
SHA256 00d6af429ebe090a8051a9f4599aa8605594561458ff4671c5a7361c33b96241
MD5 0250d3827bfb70299f2845c061afd80f
SHA1 02c117bed1495a05e723e61b3f1b5f14dfe343c0
SHA512 f017106e6087138bc89b70acc74921b00ac277398f6c73babd900f7f4d9c7e9d6f9efa4e22303cce28b6f99e0a45be6116058a3adeedc2b41e053f6970910c9d
SSDEEP 6144:MErJt0Ppa7r0/oYVpydP+FAnH4uj0zKKJ1gqm:PJtggPFdtd
TLSH
T1FC846C25FA5148FDD057C07482568976A97238CE0F32ADEF2299423D2F7AAF65F3C214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer

File Explorer

2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer

.exe 382KB

2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH d20cccb9a3e45f3f507d7727a2f258ba
SHA256 00d6af429ebe090a8051a9f4599aa8605594561458ff4671c5a7361c33b96241
MD5 0250d3827bfb70299f2845c061afd80f
SHA1 02c117bed1495a05e723e61b3f1b5f14dfe343c0
SHA512 f017106e6087138bc89b70acc74921b00ac277398f6c73babd900f7f4d9c7e9d6f9efa4e22303cce28b6f99e0a45be6116058a3adeedc2b41e053f6970910c9d
SSDEEP 6144:MErJt0Ppa7r0/oYVpydP+FAnH4uj0zKKJ1gqm:PJtggPFdtd
TLSH
T1FC846C25FA5148FDD057C07482568976A97238CE0F32ADEF2299423D2F7AAF65F3C214
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

LiaVirus.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

FlsGetValue FlsSetValue FlsFree VirtualProtect CreateEventA CompareStringW LCMapStringW FlsAlloc GetLastError LoadLibraryExA FormatMessageW GetProcessHeap HeapFree GetStringTypeW SetStdHandle HeapSize GetOEMCP GetCurrentThreadId SetThreadPriority GetProcAddress FreeLibrary HeapAlloc GetACP WaitForSingleObject IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SetEvent IsDebuggerPresent FreeEnvironmentStringsW InitializeSListHead GetSystemTimeAsFileTime CloseHandle SetLastError GetFullPathNameW WaitForMultipleObjectsEx InitializeCriticalSectionEx SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FindNextFileW GetModuleHandleA CreateThread GetModuleHandleW GetFileType Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode GetCurrentProcessId WriteConsoleW FlushFileBuffers GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind MultiByteToWideChar GetEnvironmentStringsW TerminateProcess GetModuleFileNameW GetStdHandle SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW SetEnvironmentVariableW lstrlenW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex

user32

DrawIcon BlockInput ClipCursor GetSystemMetrics GetDC ReleaseDC GetCursorPos RedrawWindow SetCursorPos InvalidateRect FillRect LoadIconW

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

gdi32

CreateSolidBrush SelectObject PatBlt Ellipse DeleteObject CreatePen DeleteDC BitBlt SetPixelV CreateCompatibleDC SetStretchBltMode StretchBlt PolyBezier CreateCompatibleBitmap

oleaut32

GetErrorInfo SysFreeString SysStringLen

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoInitializeEx

ntdll

RtlAdjustPrivilege NtWriteFile RtlNtStatusToDosError NtRaiseHardError

Name

.text

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_0250d3827bfb70299f2845c061afd80f_akira_cobalt-strike_icedid_rusty-stealer

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

advapi32

gdi32

oleaut32

ole32

ntdll

generic