2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom

General

Target
2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 365KB
Sample261002-p469faws2j
SHA256 a78673091d99dc2587981852628afe0506b4e9c531bb8bb63d5daa1d00520eab
MD5 69ce520eb79a883e0fb49396be3aa98f
SHA1 225acc51c8628467a4c80a11c120e3e5a6d1c866
SHA512 8256fb12b529c7adc75211e6983100c75f0529cc8614bb8f6e6e9b5b1f1469c3d054a9ee68b214bc6490e01dae52ac283aaaa90740c097f0dc0a6fc9172e35ac
SSDEEP 6144:jknhdb+K2qvRvbcQ+QChcEa6MDIK6dWQUK2Q+Sf:kK/Q2MD0U7
TLSH
T19C844B21FAA95CFDE156C074825586736A337CCA0B22B9FF129441397E2AAF16F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 365KB

2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH d62a206aa82d0798eda94ad0310fde64
SHA256 a78673091d99dc2587981852628afe0506b4e9c531bb8bb63d5daa1d00520eab
MD5 69ce520eb79a883e0fb49396be3aa98f
SHA1 225acc51c8628467a4c80a11c120e3e5a6d1c866
SHA512 8256fb12b529c7adc75211e6983100c75f0529cc8614bb8f6e6e9b5b1f1469c3d054a9ee68b214bc6490e01dae52ac283aaaa90740c097f0dc0a6fc9172e35ac
SSDEEP 6144:jknhdb+K2qvRvbcQ+QChcEa6MDIK6dWQUK2Q+Sf:kK/Q2MD0U7
TLSH
T19C844B21FAA95CFDE156C074825586736A337CCA0B22B9FF129441397E2AAF16F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

191824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

updater.pdb

user32

MessageBoxW

kernel32

DeleteFileW GetProcessHeap HeapFree CloseHandle SetFileAttributesW GetLastError SetLastError GetFinalPathNameByHandleW QueryPerformanceCounter GetCommandLineW OpenProcess QueryFullProcessImageNameW WaitForSingleObject TerminateProcess GetCurrentProcessId AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceFrequency GetModuleHandleW FormatMessageW GetModuleFileNameW GetFullPathNameW CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread ReadFileEx WriteFileEx SleepEx HeapAlloc MoveFileExW SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_69ce520eb79a883e0fb49396be3aa98f_akira_cobalt-strike_icedid_rusty-stealer_satacom

user32

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

generic