2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer
Size 1.1MB
Sample261026-vy84qsft81
SHA256 f629eeead8b1e65c376025a2f8179e8915258e1b1e6d37fb5660fc54995a8a4c
MD5 a482ab01ffb8f999d100aff61bcb03fd
SHA1 9256693252cc35a5ae8a49f426b232eec7ce4d12
SHA512 08aacdb51e85ae06e9904e97e85e8ec6a799e69d97f0ffb8fc903cce71bf1b27c6169056cc76e2ede8554c677c64fb59a5652347d8d39b7502f9c9a085a37093
SSDEEP 12288:Y2KcnLclnKbiP9dA36eVhH4tqVRW2wmOZcBDcs3FlUSJ1DmHMZ:WOwlnKuP9dA3TLe4RWVmO0gsVMMZ
TLSH
T17E355B03F9D585F8C05DC075874A9233B775BC8A0E35BABB269477292F7AEA05F28704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

File Explorer

2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

.exe 1.1MB

2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

IMPHASH ce00411496a644c44352a9ef7520f8ec
SHA256 f629eeead8b1e65c376025a2f8179e8915258e1b1e6d37fb5660fc54995a8a4c
MD5 a482ab01ffb8f999d100aff61bcb03fd
SHA1 9256693252cc35a5ae8a49f426b232eec7ce4d12
SHA512 08aacdb51e85ae06e9904e97e85e8ec6a799e69d97f0ffb8fc903cce71bf1b27c6169056cc76e2ede8554c677c64fb59a5652347d8d39b7502f9c9a085a37093
SSDEEP 12288:Y2KcnLclnKbiP9dA36eVhH4tqVRW2wmOZcBDcs3FlUSJ1DmHMZ:WOwlnKuP9dA3TLe4RWVmO0gsVMMZ
TLSH
T17E355B03F9D585F8C05DC075874A9233B775BC8A0E35BABB269477292F7AEA05F28704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

da:c9:1c:73:f7:82:8b:fa:3d:8d:94:9c:69:c3:15:ef:d7:3d:be:b1:ed:1f:b3:62:d0:90:43:29:d9:d1:e1:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

Chains

Oct 22, 2026

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

Serial Number

33:00:08:d6:f3:0f:c0:43:00:53:60:56:f9:00:00:00:08:d6:f3

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 21, 2026

Timespan

Oct 21, 2026 - Oct 24, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5f:2a:e4:f8:23:45:bc:1a:49:00:00:00:00:00:5f

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

661392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

glance_sensors.pdb

ntdll

NtReadFile NtOpenFile NtQuerySystemInformationEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile NtCreateNamedPipeFile NtQueryInformationProcess RtlUnwindEx RtlPcToFileHeader RtlNtStatusToDosError NtQuerySystemInformation

ole32

CoSetProxyBlanket CoCreateInstance PropVariantClear CoInitializeEx

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc ReleaseMutex VirtualProtect SleepEx CreateWaitableTimerExW GetStringTypeW GetFileType GetCPInfo GetOEMCP GetSystemTimeAsFileTime GetSystemDirectoryW CompareStringOrdinal GetExitCodeProcess TerminateProcess GetSystemFirmwareTable Sleep CompareStringW LCMapStringW GetACP GetDriveTypeW GetDiskFreeSpaceExW IsValidCodePage GetModuleHandleExW WriteFile TlsFree TlsSetValue HeapSize GetLocalTime FlushFileBuffers SetLastError GetFullPathNameW CreateDirectoryW GetFileInformationByHandle CreateMutexW GetLogicalProcessorInformationEx FindClose TlsGetValue IsProcessorFeaturePresent GetStartupInfoW SetFilePointerEx GetProcAddress GetSystemCpuSetInformation RemoveDirectoryW GetCurrentProcess FreeLibrary Process32NextW Process32FirstW CreateToolhelp32Snapshot ProcessIdToSessionId InitializeProcThreadAttributeList UpdateProcThreadAttribute GetCurrentProcessId CreateProcessW DeleteProcThreadAttributeList GetNamedPipeClientSessionId GetNamedPipeClientProcessId QueryPerformanceFrequency WaitForMultipleObjects GetOverlappedResult QueryUnbiasedInterruptTime CreatePipe SetHandleInformation ReadFile GetFileInformationByHandleEx LocalFree CreateNamedPipeW SwitchToThread CancelSynchronousIo CreateFileW GetSystemPowerStatus GetTickCount64 WriteFileEx SetWaitableTimer WaitForSingleObject SetThreadGroupAffinity CreateThread DeleteFileW ExitProcess CreateEventW CancelIo GetModuleFileNameW GetModuleHandleA SetFileTime FormatMessageW GetFinalPathNameByHandleW ConnectNamedPipe DuplicateHandle GetModuleHandleW TlsAlloc GetLogicalDrives CloseHandle GetSystemTimePreciseAsFileTime QueryPerformanceCounter EncodePointer GetActiveProcessorCount GetTickCount GetActiveProcessorGroupCount SetFileInformationByHandle DisconnectNamedPipe QueryFullProcessImageNameW OpenProcess GetSystemInfo FindFirstFileExW ReadFileEx DeviceIoControl GetLastError HeapReAlloc HeapFree GetProcessHeap GetCurrentThread LoadLibraryExA LoadLibraryExW HeapAlloc FindNextFileW GetFileAttributesW GetWindowsDirectoryW SetThreadStackGuarantee GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte MultiByteToWideChar WriteConsoleW InitializeSListHead IsDebuggerPresent GetEnvironmentVariableW EnterCriticalSection RaiseException InitializeCriticalSectionEx SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter SetEnvironmentVariableW GetConsoleOutputCP GetCommandLineW GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW GetStdHandle GetCommandLineA InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection

user32

GetAsyncKeyState DefWindowProcW GetMonitorInfoW RegisterRawInputDevices EnumDisplayDevicesW CreateWindowExW GetCursorInfo RegisterClassW GetWindowRect SetTimer EnumDisplayMonitors MonitorFromPoint IsZoomed GetForegroundWindow GetWindowThreadProcessId GetShellWindow GetCursorPos GetWindowTextW EnumWindows IsWindowVisible KillTimer GetMessageW DispatchMessageW GetRawInputDeviceInfoW GetRawInputData IsIconic MonitorFromWindow EnumDisplaySettingsW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

SafeArrayGetElement SysFreeString SafeArrayGetLBound SafeArrayGetUBound VariantClear SysStringLen SysAllocStringLen GetErrorInfo

advapi32

RegGetValueW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenTraceW RegSetValueExW RegCreateKeyExW GetSecurityDescriptorDacl MapGenericMask ControlTraceW StartTraceW EnableTraceEx2 RegQueryInfoKeyW GetNamedSecurityInfoW CreateProcessAsUserW SetTokenInformation ImpersonateNamedPipeClient OpenThreadToken RevertToSelf GetTokenInformation ConvertSidToStringSidW GetSidSubAuthorityCount GetSidSubAuthority ProcessTrace GetLengthSid ConvertStringSidToSidW SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel OpenProcessToken RegOpenKeyExW RegEnumValueW RegCloseKey RegDeleteValueW CloseTrace GetAce

propsys

VariantToUInt32 PropVariantToBSTR VariantToPropVariant VariantToInt32 VariantToInt64

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

pdh

PdhGetFormattedCounterArrayW PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryW

dxgi

CreateDXGIFactory1

gdi32

D3DKMTOpenAdapterFromLuid D3DKMTQueryAdapterInfo D3DKMTCloseAdapter

setupapi

SetupDiEnumDeviceInterfaces SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiCallClassInstaller

dwmapi

DwmGetWindowAttribute

iphlpapi

GetAdaptersAddresses GetBestInterface FreeMibTable GetIfTable2

wlanapi

WlanOpenHandle WlanQueryInterface WlanCloseHandle WlanFreeMemory

psapi

GetPerformanceInfo

wevtapi

EvtClose EvtRender EvtCreateRenderContext EvtQuery EvtNext

computecore

HcsCreateOperation HcsCloseOperation HcsEnumerateComputeSystems HcsWaitForOperationResult

shell32

SHGetKnownFolderPath ShellExecuteExW

combase

CoTaskMemFree

ws2_32

getaddrinfo setsockopt closesocket WSAGetLastError connect freeaddrinfo send WSAStartup WSACleanup recv WSASocketW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

crypt32

CertGetEnhancedKeyUsage CertGetCertificateContextProperty CertNameToStrW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryHeaders WinHttpConnect WinHttpSetOption WinHttpReadData WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen

hid

HidP_GetUsages HidP_GetButtonCaps HidP_GetCaps HidP_MaxUsageListLength HidP_GetValueCaps HidP_GetUsageValue

tdh

TdhGetProperty TdhGetPropertySize

bcryptprimitives

ProcessPrng

Name

.text

Size

742KB

Virtual Size

741KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_a482ab01ffb8f999d100aff61bcb03fd_akira_icedid_rusty-stealer

PE Signature issue

ntdll

ole32

kernel32

user32

api-ms-win-shcore-scaling-l1-1-1

oleaut32

advapi32

propsys

api-ms-win-core-synch-l1-2-0

pdh

dxgi

gdi32

setupapi

dwmapi

iphlpapi

wlanapi

psapi

wevtapi

computecore

shell32

combase

ws2_32

wintrust

crypt32

version

winhttp

hid

tdh

bcryptprimitives

generic