2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike
Size 784KB
Sample261017-e45qhasw3j
SHA256 fed5f5440efb56240875006ddbfe0be2cbd4139bc4376f7e488916b5e031e1b3
MD5 e44bcec56b08fac43662ca56c4c21b17
SHA1 c4d77d9877bfec10f97d784a03b79c8900d2eea8
SHA512 bc5cbf4eb9377cf37d7af0d7bad05d93620779aff2becd01164f3a1eb07dc90fca141fcc01417ec4f8d7b0deeeb3bc42d4eedb7b1687ba2ee2e75f57583c6760
SSDEEP 12288:FUrGmvNVsBiioHpi0gjCYxAYv2L2rn65hYYWiOMC+2oRce:ulVsBiioHpLY+Qn652YOMxCe
TLSH
T1AC057C43FA855AA9C45AD33886579322B731BC480B32FBDB1384A6313D677E16F39358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike

File Explorer

2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike

.exe 784KB

2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike

IMPHASH cfa03fefeb7843aecef3fd6f7c762253
SHA256 fed5f5440efb56240875006ddbfe0be2cbd4139bc4376f7e488916b5e031e1b3
MD5 e44bcec56b08fac43662ca56c4c21b17
SHA1 c4d77d9877bfec10f97d784a03b79c8900d2eea8
SHA512 bc5cbf4eb9377cf37d7af0d7bad05d93620779aff2becd01164f3a1eb07dc90fca141fcc01417ec4f8d7b0deeeb3bc42d4eedb7b1687ba2ee2e75f57583c6760
SSDEEP 12288:FUrGmvNVsBiioHpi0gjCYxAYv2L2rn65hYYWiOMC+2oRce:ulVsBiioHpLY+Qn652YOMxCe
TLSH
T1AC057C43FA855AA9C45AD33886579322B731BC480B32FBDB1384A6313D677E16F39358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyValueW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegSetKeyValueW RegSetValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CryptBinaryToStringW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CompareStringOrdinal CreateEventW CreateMutexA CreateMutexW CreateProcessW DeleteCriticalSection EnterCriticalSection FileTimeToSystemTime FormatMessageW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetUserDefaultLocaleName GetVersionExW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW lstrlenW

netapi32

NetApiBufferFree NetUserGetInfo

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear

rpcrt4

UuidCreate

shell32

SHChangeNotify SHGetKnownFolderPath

shlwapi

AssocQueryStringW PathAppendW PathCombineW PathRemoveFileSpecW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

user32

CharLowerW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetOpenW InternetReadFile

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate _purecall memchr memcmp memcpy memmove memset wcschr

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswprintf _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen fclose fflush fgetc fgetpos fputc fread fseek fsetpos ftell fwrite setvbuf ungetc

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest modf

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsnicmp strcmp strcpy strlen wcscat_s wcscmp wcscpy wcscpy_s wcslen wcspbrk

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

397KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

274KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdatah

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_e44bcec56b08fac43662ca56c4c21b17_akira_cobalt-strike

advapi32

bcrypt

crypt32

kernel32

netapi32

ole32

oleaut32

rpcrt4

shell32

shlwapi

msvcp140

user32

wininet

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic