2026-10-26_e63118fd4419a539439dcb27b8f22873_akira_cobalt-strike_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e63118fd4419a539439dcb27b8f22873_akira_cobalt-strike_icedid_rusty-stealer
Size 395KB
Sample261027-ek8caax18k
SHA256 7068394623c46c677f224c16ac4ed595122fa6beba6b67924deb985ade3fec83
MD5 e63118fd4419a539439dcb27b8f22873
SHA1 bd06de60ff3a4b7624d7aba7f53a4ebe5a77b483
SHA512 5e79adade1f24f7dee6ee08d97efc5cb7da3d14257e18e363878752cef7b2c3430d395c722a9ce921127cde008549848c8a2abbf9e3bfb17dc42dc9512468262
SSDEEP 6144:H5O2vOSl/LqFS9AeTI5A04F9KjuW9RqZAYRvETH7njhtjYdC7nkX:ZOZYLSiI4FcusRYZg5tjYsQX
TLSH
T1AA845D11FEA548F9D45AC43482558A93AA367CCB0B31E9FF11E852352F3AAE15F3CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_e63118fd4419a539439dcb27b8f22873_akira_cobalt-strike_icedid_rusty-stealer

.exe 395KB

2026-10-26_e63118fd4419a539439dcb27b8f22873_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH de33e044055a6509b204fcb61cff3704
SHA256 7068394623c46c677f224c16ac4ed595122fa6beba6b67924deb985ade3fec83
MD5 e63118fd4419a539439dcb27b8f22873
SHA1 bd06de60ff3a4b7624d7aba7f53a4ebe5a77b483
SHA512 5e79adade1f24f7dee6ee08d97efc5cb7da3d14257e18e363878752cef7b2c3430d395c722a9ce921127cde008549848c8a2abbf9e3bfb17dc42dc9512468262
SSDEEP 6144:H5O2vOSl/LqFS9AeTI5A04F9KjuW9RqZAYRvETH7njhtjYdC7nkX:ZOZYLSiI4FcusRYZg5tjYsQX
TLSH
T1AA845D11FEA548F9D45AC43482558A93AA367CCB0B31E9FF11E852352F3AAE15F3CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

cb:56:90:ca:8d:c3:52:fe:e4:54:7d:04:80:ee:0e:da:a9:1c:ee:1a:7e:a0:a1:f1:15:7a:6e:39:af:37:06:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=JOYFULAI TECHNOLOGY PTE. LTD.,O=JOYFULAI TECHNOLOGY PTE. LTD.,L=Singapore,C=SG

Chains

Oct 18, 2026

CN=JOYFULAI TECHNOLOGY PTE. LTD.,O=JOYFULAI TECHNOLOGY PTE. LTD.,L=Singapore,C=SG

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=JOYFULAI TECHNOLOGY PTE. LTD.,O=JOYFULAI TECHNOLOGY PTE. LTD.,L=Singapore,C=SG

Serial Number

33:00:08:d6:b7:f9:b5:ec:13:4b:4b:71:7d:00:00:00:08:d6:b7

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2026 - Oct 21, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5d:c6:39:78:4f:40:7d:33:fd:00:00:00:00:00:5d

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

209548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

thorp_agent_entry.pdb

kernel32

GetFileType SetStdHandle FindNextFileW FreeLibrary GetLastError SetLastError GetStdHandle GetConsoleMode FlushFileBuffers GetSystemTimeAsFileTime SetFilePointerEx GetConsoleOutputCP WriteConsoleW GetFinalPathNameByHandleW DuplicateHandle GetFileAttributesW GetWindowsDirectoryW GetSystemDirectoryW ReadConsoleW GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW CloseHandle GetModuleFileNameW HeapSize LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW TerminateProcess GetCommandLineW CreateThread WaitForSingleObject GetExitCodeProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex MultiByteToWideChar HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetModuleHandleA ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW WriteFile RtlPcToFileHeader LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer QueryPerformanceCounter InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

Name

.text

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e63118fd4419a539439dcb27b8f22873_akira_cobalt-strike_icedid_rusty-stealer

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

generic