2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer
Size 5.8MB
Sample261018-sd7ztsfv8w
SHA256 4bac3b4a938653aefa8ee17fe583e6d97d362ae86df7f5517e0c33f1eedecbf5
MD5 49d7eef1500d690707b73322597eb861
SHA1 44a0c8d01901170d78cadfeb9e216aa9d1612a92
SHA512 774aed931bf47aa728db955db4193cb4c0a93c456a9892429b32c25b938a07a3bc65d4e64098909486c85af8d311d223848a8fb42daca4482fa7c431e5aa2b99
SSDEEP 49152:i8mXsw4yCrbwyOYsSbzfaP2JYvmm53GqyLeHTjGn0JWdhJXCv05155Bo6RBu:CyyijJXCvCA6RBu
TLSH
T12C563916B77890DDD17BC07882929B23BA21389D47352BF746D0866A2F35EF4AD3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer

File Explorer

2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer

.exe 5.8MB

2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer

IMPHASH 7a6183a6fc96df5eef68c81970985d91
SHA256 4bac3b4a938653aefa8ee17fe583e6d97d362ae86df7f5517e0c33f1eedecbf5
MD5 49d7eef1500d690707b73322597eb861
SHA1 44a0c8d01901170d78cadfeb9e216aa9d1612a92
SHA512 774aed931bf47aa728db955db4193cb4c0a93c456a9892429b32c25b938a07a3bc65d4e64098909486c85af8d311d223848a8fb42daca4482fa7c431e5aa2b99
SSDEEP 49152:i8mXsw4yCrbwyOYsSbzfaP2JYvmm53GqyLeHTjGn0JWdhJXCv05155Bo6RBu:CyyijJXCvCA6RBu
TLSH
T12C563916B77890DDD17BC07882929B23BA21389D47352BF746D0866A2F35EF4AD3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3168176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

transcribe_test_worker-f482b17a34deb37f.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringOrdinal CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatus GetStdHandle GetSystemDirectoryW GetSystemTimeAsFileTime GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitializeConditionVariable InitializeSListHead InitializeSRWLock LoadLibraryA MultiByteToWideChar OpenThread QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetInformationJobObject SetLastError SetThreadAffinityMask SetThreadInformation SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess Thread32First Thread32Next WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?uncaught_exception@std@@YA_NXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_unlock _Strcoll _Strxfrm _Thrd_hardware_concurrency _Thrd_id _Thrd_join __crtLCMapStringA

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __RTtypeid __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_type_info_compare _purecall memcmp memcpy memmove memset strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fputs fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _callnewh _set_new_mode calloc free malloc realloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_abort_behavior _set_app_type abort exit terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil ceilf cos cosf erff exp expf expm1f floor floorf fmaxf fminf log log10 log2 log2f logf lroundf pow powf round roundf sin sinf sqrtf tan tanhf trunc truncf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strcmp strlen

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

587KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_49d7eef1500d690707b73322597eb861_akira_cobalt-strike_poet-rat_rusty-stealer

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

bcryptprimitives

msvcp140

advapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

generic