2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer
Size 6.8MB
Sample261017-nb8fcsee97
SHA256 2aeb20100c967b71df423c7a678861023dafab3de278e8d38a5e74807bb16c41
MD5 9a1e6573ca1ea12d63139a8f08ca8579
SHA1 c2bfd02a182c3c1a4c8386d5cb1ece67937ee44b
SHA512 cf78faf7c0c4f22d2b97d22d14e29867afa6617bfa19b163dfe02c333a03726711cd1448af00e87f1f2e930fce271aead0a08efbb3c84bd766d870be86d3c517
SSDEEP 49152:bNQDI3d0fk2drNfLobBLA/00UbTO7b0lMzFDlk6nDQEl2H7Ez/ONnxvmQ9lW+jH7:xmN12eNK9NB3hCxc4iQ8O2gzlD5f
TLSH
T1D376E71677B460E9C1BBC07992838F21792270D94B356FE34591827A2F24EFC6E7D368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer

File Explorer

2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer

.exe 6.8MB

2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer

IMPHASH 52dc85f6538a7b0f874b2a21cece386d
SHA256 2aeb20100c967b71df423c7a678861023dafab3de278e8d38a5e74807bb16c41
MD5 9a1e6573ca1ea12d63139a8f08ca8579
SHA1 c2bfd02a182c3c1a4c8386d5cb1ece67937ee44b
SHA512 cf78faf7c0c4f22d2b97d22d14e29867afa6617bfa19b163dfe02c333a03726711cd1448af00e87f1f2e930fce271aead0a08efbb3c84bd766d870be86d3c517
SSDEEP 49152:bNQDI3d0fk2drNfLobBLA/00UbTO7b0lMzFDlk6nDQEl2H7Ez/ONnxvmQ9lW+jH7:xmN12eNK9NB3hCxc4iQ8O2gzlD5f
TLSH
T1D376E71677B460E9C1BBC07992838F21792270D94B356FE34591827A2F24EFC6E7D368
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4872112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-b0586cf56910ba55.pdb

bcryptprimitives

ProcessPrng

kernel32

RaiseException RtlPcToFileHeader IsDebuggerPresent FreeLibrary CloseHandle EncodePointer HeapSize LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree GetModuleHandleExW WriteFile LoadLibraryExW TlsFree CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP TlsSetValue GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA GetTempPathW FindNextFileW TlsGetValue FlsSetValue FlsGetValue FlsAlloc TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle GetStringTypeW GetCommandLineA

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtOpenFile

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_9a1e6573ca1ea12d63139a8f08ca8579_akira_icedid_rusty-stealer

bcryptprimitives

kernel32

shell32

combase

api-ms-win-core-synch-l1-2-0

ntdll

generic