2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 194KB
Sample261003-v3eexstcme
SHA256 7fa4042d8ec4dce608ada7eee80efd4d5f8e3c1fbfdb0ca4766b354e7d30b041
MD5 0e2cd568bc749d0deaada738b3aa0e9b
SHA1 294658c9ec175da1edb56c56038ec415eaef68d2
SHA512 11f01442d1dc7b8c2849796ee1bd4600751b82cc9eb6cce14aa8879d22f65e2dc49c3beb465b1f5057fa7a523a17a6b351c6b5a9a1d3b97fd121636ae4ecd08b
SSDEEP 3072:eYBaqmuO+NLYsBCQzdYzF3EEPvAdnmQ7mzoLYA6B5jyL:eP7+NLYsp0F3+dml7y
TLSH
T1B1147C22B39540F8E16BC078C6514656A77374960B219EFF03A40379AF276E6BF3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 194KB

2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH ca34b6e0c5f91312a9ad7c56124efa78
SHA256 7fa4042d8ec4dce608ada7eee80efd4d5f8e3c1fbfdb0ca4766b354e7d30b041
MD5 0e2cd568bc749d0deaada738b3aa0e9b
SHA1 294658c9ec175da1edb56c56038ec415eaef68d2
SHA512 11f01442d1dc7b8c2849796ee1bd4600751b82cc9eb6cce14aa8879d22f65e2dc49c3beb465b1f5057fa7a523a17a6b351c6b5a9a1d3b97fd121636ae4ecd08b
SSDEEP 3072:eYBaqmuO+NLYsBCQzdYzF3EEPvAdnmQ7mzoLYA6B5jyL:eP7+NLYsp0F3+dml7y
TLSH
T1B1147C22B39540F8E16BC078C6514656A77374960B219EFF03A40379AF276E6BF3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stage2_host.pdb

kernel32

GetModuleFileNameA GetEnvironmentVariableA SetCurrentDirectoryA SetEnvironmentVariableA ReadFile CreateProcessA CreateThread WaitForSingleObject TerminateProcess LoadLibraryA GetProcAddress GetLastError WriteFile GetTempPathA AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId GetCurrentProcess GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer Sleep CreateFileW CloseHandle SetLastError CreateFileA SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW LoadLibraryExW VirtualProtect QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader GetModuleFileNameW ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

advapi32

OpenProcessToken GetTokenInformation

user32

IsWindowVisible ShowWindow SetWindowPos EnumWindows GetWindowThreadProcessId

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

Name

.text

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_0e2cd568bc749d0deaada738b3aa0e9b_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

advapi32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic