2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom
Size 17.6MB
Sample261020-qqnqlset9p
SHA256 0bcf4cc8e7c2181f3db3d0cd8c093748579aad409926d9d9e2060a9a1a8725bd
MD5 8cfbbdeeb8023f8c1833c312d0431fd4
SHA1 e47d87fdce66abfd76d64a657c35daed49419af6
SHA512 e54d0eb10d777bc802a0fed485ebb98b67cebac0f528202c5fa6c154c5209de3cd16a0c0e1ae939215203978840c54a22ee84b1556f054770d45cdadd0fc3136
SSDEEP 393216:NIpX6kj5r+TKMVM5WirP+VIq5lzMnyeN5MzXE:CpXZj5r+TlSVGVuNq
TLSH
T169179E32B6458075D4AB22F0293DA2569D9FFCF40B7142C72190B79D6D74AC22F3A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom

File Explorer

2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom

.exe 17.6MB

2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom

IMPHASH c38f1460b15366728199ea5e809291aa
SHA256 0bcf4cc8e7c2181f3db3d0cd8c093748579aad409926d9d9e2060a9a1a8725bd
MD5 8cfbbdeeb8023f8c1833c312d0431fd4
SHA1 e47d87fdce66abfd76d64a657c35daed49419af6
SHA512 e54d0eb10d777bc802a0fed485ebb98b67cebac0f528202c5fa6c154c5209de3cd16a0c0e1ae939215203978840c54a22ee84b1556f054770d45cdadd0fc3136
SSDEEP 393216:NIpX6kj5r+TKMVM5WirP+VIq5lzMnyeN5MzXE:CpXZj5r+TlSVGVuNq
TLSH
T169179E32B6458075D4AB22F0293DA2569D9FFCF40B7142C72190B79D6D74AC22F3A39E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WinNetHealth.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

LoadLibraryW GetProcAddress GetProcessHeap HeapFree Sleep FlushFileBuffers GetCurrentProcessId GetCurrentThreadId VirtualAlloc GetSystemTimePreciseAsFileTime HeapSize LCMapStringW CompareStringW SetLastError GetFullPathNameW GetLastError CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx SetFilePointerEx WaitForSingleObject GetModuleHandleW VirtualProtect CloseHandle HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP LoadLibraryExW MultiByteToWideChar WriteConsoleW HeapAlloc FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA ExitProcess CreateWaitableTimerExW SetWaitableTimer GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

wininet

InternetCloseHandle InternetReadFile InternetOpenUrlA InternetOpenA

user32

DispatchMessageW EnumWindows GetMessageW TranslateMessage

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_8cfbbdeeb8023f8c1833c312d0431fd4_akira_amadey_cobalt-strike_darkgate_icedid_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

wininet

user32

ntdll

generic