2026-10-19_37be436cd0514d63249e79e0ad45cbdd_akira_cobalt-strike_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_37be436cd0514d63249e79e0ad45cbdd_akira_cobalt-strike_icedid_rusty-stealer
Size 771KB
Sample261020-3dptcsxtfx
SHA256 edaf2da644db6610bed76876e0bf4ce26a4f9e4a7bfeb24605f1a260c548b849
MD5 37be436cd0514d63249e79e0ad45cbdd
SHA1 82cf6cce6ef0c687ead14890a5ed5dd8e88a5c57
SHA512 c8d72582735d2f69cd0f9c9709ad9132e353f33fe1d2e9d3edb954679e7cdc4054fe2d07c560fe8748e42c6c6024941f441ce519099d186c06f1aacb603ecb10
SSDEEP 12288:Hf7ShyLkBVa6Zq80sfFxfXIAomiyiVs0il4jZfR:/7SyLkfa9semiyKNXj
TLSH
T1BCF439257B6A99BCD45AC87183468A732E6274CB1B32B9EF00C541783E6EAF51F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-19_37be436cd0514d63249e79e0ad45cbdd_akira_cobalt-strike_icedid_rusty-stealer

.exe 771KB

2026-10-19_37be436cd0514d63249e79e0ad45cbdd_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH e4f0fadf26aeef15f4d9e100a950281d
SHA256 edaf2da644db6610bed76876e0bf4ce26a4f9e4a7bfeb24605f1a260c548b849
MD5 37be436cd0514d63249e79e0ad45cbdd
SHA1 82cf6cce6ef0c687ead14890a5ed5dd8e88a5c57
SHA512 c8d72582735d2f69cd0f9c9709ad9132e353f33fe1d2e9d3edb954679e7cdc4054fe2d07c560fe8748e42c6c6024941f441ce519099d186c06f1aacb603ecb10
SSDEEP 12288:Hf7ShyLkBVa6Zq80sfFxfXIAomiyiVs0il4jZfR:/7SyLkfa9semiyKNXj
TLSH
T1BCF439257B6A99BCD45AC87183468A732E6274CB1B32B9EF00C541783E6EAF51F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

8b:c3:11:94:7f:b6:95:11:d0:81:92:04:b9:a5:92:bc:64:a0:3f:7e:4d:37:84:21:90:59:9a:dc:7c:56:6c:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 16, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

491712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

copilot.pdb

bcryptprimitives

ProcessPrng

kernel32

GetCurrentThread CreateWaitableTimerExW SetWaitableTimer Sleep SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW SetFilePointerEx FillConsoleOutputCharacterW RtlLookupFunctionEntry WriteFileEx SleepEx ReadFileEx MoveFileExW SetFileInformationByHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW ExitProcess GetConsoleScreenBufferInfo CreateThread GetFullPathNameW GetModuleHandleA GetTempPathW GetFileInformationByHandleEx CreateDirectoryW SetConsoleCursorPosition FindFirstFileExW FindClose GetFinalPathNameByHandleW GetConsoleMode GetFileType GetFileAttributesW GetCurrentProcess DuplicateHandle GetConsoleOutputCP WriteConsoleW ReadConsoleW SetHandleInformation WaitForSingleObjectEx LoadLibraryA CreateMutexA CreatePipe TerminateProcess ResumeThread AssignProcessToJobObject CreateProcessW SetInformationJobObject SetThreadStackGuarantee CreateJobObjectW CreateFileW QueryInformationJobObject GetExitCodeProcess WaitForSingleObject TerminateJobObject GetFileInformationByHandle DeleteFileW FormatMessageW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryExW ExpandEnvironmentStringsW SwitchToThread GetCurrentProcessId CloseHandle ReleaseMutex SetConsoleCtrlHandler CreateMutexW IsProcessorFeaturePresent GetCurrentThreadId IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree WriteFile GetModuleHandleExW GetCommandLineA FindNextFileW SetEnvironmentVariableW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree FlushFileBuffers GetLastError GetStdHandle FillConsoleOutputAttribute CreateNamedPipeW InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwindEx InitializeCriticalSectionAndSpinCount WideCharToMultiByte HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap LCMapStringW CompareStringW HeapFree HeapReAlloc QueryPerformanceCounter CompareStringOrdinal MultiByteToWideChar AddVectoredExceptionHandler GetWindowsDirectoryW GetSystemDirectoryW HeapAlloc lstrlenW RtlVirtualUnwind RtlCaptureContext VirtualProtect InitializeCriticalSectionEx GetStringTypeW GetCPInfo GetOEMCP GetACP QueryPerformanceFrequency IsValidCodePage

winhttp

WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpSendRequest WinHttpSetOption WinHttpReceiveResponse WinHttpConnect WinHttpCrackUrl WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptHashData BCryptFinishHash BCryptCreateHash

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

RegGetValueW

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

ntdll

NtOpenFile RtlNtStatusToDosError NtReadFile NtWriteFile

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_37be436cd0514d63249e79e0ad45cbdd_akira_cobalt-strike_icedid_rusty-stealer

bcryptprimitives

kernel32

winhttp

bcrypt

api-ms-win-core-synch-l1-2-0

advapi32

wintrust

crypt32

ntdll

generic