2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer
Size 1.5MB
Sample261003-ssramast8r
SHA256 e95ec277857563e2e8e3bef2d097b21932d268f1d02a726876a1da07dd253f9b
MD5 2bbdb255de19b03fea2239495f7e1340
SHA1 5d99d80580a68d9970d0483ad042414ff3fc24c1
SHA512 a5a48e5eef06986e1a3383520b8243753847250baf4527cd09aadad54ff52ad20f5ce38226cc3a5da445226a0efc6ce5ed8842dc0e33a514018a07ee0e0364f4
SSDEEP 24576:lvOHjsZJmxPdUNo83CANns6GnBoqLPJ5XlBT2Ffvv:l2HBxV7cCANDGBdvXlIF
TLSH
T10D752961BE5949ADC0AAC074C34A4A725A3170CA0F35BAFF458496393F79AF52F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer

File Explorer

2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer

.exe 1.5MB

2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer

IMPHASH 0c3ea18d3ed4334e4797204f18a1d6c7
SHA256 e95ec277857563e2e8e3bef2d097b21932d268f1d02a726876a1da07dd253f9b
MD5 2bbdb255de19b03fea2239495f7e1340
SHA1 5d99d80580a68d9970d0483ad042414ff3fc24c1
SHA512 a5a48e5eef06986e1a3383520b8243753847250baf4527cd09aadad54ff52ad20f5ce38226cc3a5da445226a0efc6ce5ed8842dc0e33a514018a07ee0e0364f4
SSDEEP 24576:lvOHjsZJmxPdUNo83CANns6GnBoqLPJ5XlBT2Ffvv:l2HBxV7cCANDGBdvXlIF
TLSH
T10D752961BE5949ADC0AAC074C34A4A725A3170CA0F35BAFF458496393F79AF52F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7f:15:9d:57:2e:68:75:5c:c7:31:b9:84:8b:43:01:38:4f:78:6a:b9:02:d5:e1:c8:07:9f:69:f8:2c:f5:3a:97

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 25, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

7f:15:9d:57:2e:68:75:5c:c7:31:b9:84:8b:43:01:38:4f:78:6a:b9:02:d5:e1:c8:07:9f:69:f8:2c:f5:3a:97

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

Major OS version

Entry point

1591488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

ws2_32

ioctlsocket connect recv getsockname accept WSASocketW getsockopt listen shutdown WSAIoctl bind WSAGetLastError closesocket send freeaddrinfo getaddrinfo WSAStartup WSACleanup

kernel32

Sleep CloseHandle GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort ReleaseMutex OpenProcess GetProcessTimes TerminateProcess CreateMutexW WaitForSingleObject CreateToolhelp32Snapshot Process32FirstW HeapSize LCMapStringW CompareStringW VirtualProtect GetModuleHandleA FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo RegisterWaitForSingleObject DuplicateHandle UnregisterWaitEx GetOEMCP GetACP FormatMessageW LoadLibraryExA IsValidCodePage GetCommandLineA GetModuleHandleExW HeapFree HeapAlloc GetProcessHeap LoadLibraryExW FreeLibrary FlsFree TlsFree TlsSetValue GetFileInformationByHandleEx GetProcAddress CompareStringOrdinal WriteFile GetExitCodeProcess CreateProcessW SetHandleInformation GetCurrentProcess LocalFree GetFinalPathNameByHandleW GetLastError CreateFileW GetSystemDirectoryW Process32NextW TlsGetValue TlsAlloc EncodePointer RaiseException IsProcessorFeaturePresent GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader

advapi32

OpenProcessToken ConvertStringSidToSidW IsValidSid GetTokenInformation GetNamedSecurityInfoW EqualSid SetEntriesInAclW SetNamedSecurityInfoW ConvertSidToStringSidW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcrypt

BCryptGenRandom

oleaut32

SysFreeString SysStringLen

ntdll

NtReadFile NtCreateFile NtWriteFile NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW GetEnvironmentStringsW GetStdHandle FreeEnvironmentStringsW GetCommandLineW

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle CreateDirectoryW SetFilePointerEx FlushFileBuffers GetFileAttributesW WriteFileEx GetFullPathNameW ReadFileEx GetFileType SetFileInformationByHandle FindNextFileW DeleteFileW FindFirstFileExW FindClose

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection EnterCriticalSection WaitForSingleObjectEx InitializeCriticalSectionEx SleepEx InitializeCriticalSectionAndSpinCount LeaveCriticalSection CreateMutexA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentThreadId SetThreadStackGuarantee GetCurrentThread ExitProcess CreateThread

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-heap-l1-1-0

HeapReAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetWindowsDirectoryW

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleOutputCP ReadConsoleW GetConsoleMode

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleFileNameW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

63KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_2bbdb255de19b03fea2239495f7e1340_akira_icedid_rusty-stealer

PE Signature issue

PE Signature issue

bcryptprimitives

ws2_32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

oleaut32

ntdll

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-interlocked-l1-1-0

generic