2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom
Size 629KB
Sample261024-e79hvssvev
SHA256 0c16a27ab5f96c5881175522a052e9c064e7dd8f31984c6dcbc6501a76bfa8d5
MD5 924634873211c4c85c511b6abaaf9e15
SHA1 e8474f3955941476df63e20af29afbb676a754e4
SHA512 20894b0fd03b0cc81987b679ae93ef5dd9bd410433269adeb072db22ce588003f73e6cbf145644eadc51efb910c3a923ed73bdde4bdc0a95fb2d34f50014154e
SSDEEP 12288:0eCdBnrnaT9/CLlGybREvruFQfgYuuAXTmz6bGfngVq2:S+8lHREvrGQfgFuADmz6bSgV5
TLSH
T1FCD4E023AAE601EDE0D8D537C1A45942C7E2F8038756BEEB93A457707DE26DD893C740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom

File Explorer

2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom

.exe 629KB

2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom

IMPHASH c2548512b6de63d8b6370ff3a93d6b28
SHA256 0c16a27ab5f96c5881175522a052e9c064e7dd8f31984c6dcbc6501a76bfa8d5
MD5 924634873211c4c85c511b6abaaf9e15
SHA1 e8474f3955941476df63e20af29afbb676a754e4
SHA512 20894b0fd03b0cc81987b679ae93ef5dd9bd410433269adeb072db22ce588003f73e6cbf145644eadc51efb910c3a923ed73bdde4bdc0a95fb2d34f50014154e
SSDEEP 12288:0eCdBnrnaT9/CLlGybREvruFQfgYuuAXTmz6bGfngVq2:S+8lHREvrGQfgFuADmz6bSgV5
TLSH
T1FCD4E023AAE601EDE0D8D537C1A45942C7E2F8038756BEEB93A457707DE26DD893C740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aplusio.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessHeaps GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemInfo GetSystemTimeAsFileTime GetThreadLocale GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

winmm

joyGetNumDevs midiInGetNumDevs midiOutGetNumDevs timeGetTime waveInGetNumDevs waveOutGetNumDevs

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

321B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_924634873211c4c85c511b6abaaf9e15_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom

kernel32

ntdll

winmm

generic