2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom

General

Target
2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 1.3MB
Sample261024-gcc8aaswhz
SHA256 f23abc50a12fe25b7060c90c0a99585a07874ea05f23a8be8249cceb2db7b954
MD5 8a1845ddf19f48d919cfffefd52ac2cf
SHA1 0e05bc2970cf745f42ea33f72ceca7587d627f7c
SHA512 329f62c8cc8fd6381a6fc5efbc51aaf35b972e9f4604b5a004b4e31cc305e8e5f47e52865696ddba380631451da18850e746393ccf8939d5f3177c78e0e17d32
SSDEEP 24576:z9DbkoptBvOEAHMPOafjb+WpOHYQ2fzfSay7Ljd/z:z90opzvOEnOQb+WpO4Q2fzflyvJ
TLSH
T172550A26A67995EDC17BC078C2938F227931708907356BF74598437A2F26EF86E3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 1.3MB

2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 01bd53fc23dd0297bb6ac922e40af306
SHA256 f23abc50a12fe25b7060c90c0a99585a07874ea05f23a8be8249cceb2db7b954
MD5 8a1845ddf19f48d919cfffefd52ac2cf
SHA1 0e05bc2970cf745f42ea33f72ceca7587d627f7c
SHA512 329f62c8cc8fd6381a6fc5efbc51aaf35b972e9f4604b5a004b4e31cc305e8e5f47e52865696ddba380631451da18850e746393ccf8939d5f3177c78e0e17d32
SSDEEP 24576:z9DbkoptBvOEAHMPOafjb+WpOHYQ2fzfSay7Ljd/z:z90opzvOEnOQb+WpO4Q2fzflyvJ
TLSH
T172550A26A67995EDC17BC078C2938F227931708907356BF74598437A2F26EF86E3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

890784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-7149398639e73a77.pdb

kernel32

SetStdHandle FreeLibrary CloseHandle GetSystemTimeAsFileTime GetFileAttributesW HeapSize LCMapStringW CompareStringW LoadLibraryExW VirtualProtect CompareStringOrdinal GetLastError WaitForSingleObject FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileType GetModuleHandleW FormatMessageW GetModuleFileNameW WaitForMultipleObjects GetModuleHandleA FindNextFileW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

Name

.text

Size

930KB

Virtual Size

930KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

283KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_8a1845ddf19f48d919cfffefd52ac2cf_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

generic