2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 196KB
Sample261029-3tsj7afx21
SHA256 0030eb685d66a1624681cb307320c91644390f6f7b2701c79e46762b78508c2a
MD5 8ed4e957036385aa29b65598a8d9c158
SHA1 edf3d8c71181a92824f401b6f0f3a4efcdcf78e1
SHA512 0cf444120095d3eb3bc571589cc2d2550f689be73a0651952cc1d6db83e96575a6766e10165856becf6285b1164d5a298bf4e47df5afd5a97e148e20fccbd66a
SSDEEP 3072:ZqE+xJEzQF48JLTEi0OJ3Edr1EbZXGNMyaN8dmhCdMBvTrp:Zq6cFvLTE86r1JNbGn
TLSH
T13E147C1277A540F8E567C038C6514A52AB7774960B21AEFF03644334AF27AE6BF3CB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 196KB

2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 46640c1aafaa7053ba354a214c58106e
SHA256 0030eb685d66a1624681cb307320c91644390f6f7b2701c79e46762b78508c2a
MD5 8ed4e957036385aa29b65598a8d9c158
SHA1 edf3d8c71181a92824f401b6f0f3a4efcdcf78e1
SHA512 0cf444120095d3eb3bc571589cc2d2550f689be73a0651952cc1d6db83e96575a6766e10165856becf6285b1164d5a298bf4e47df5afd5a97e148e20fccbd66a
SSDEEP 3072:ZqE+xJEzQF48JLTEi0OJ3Edr1EbZXGNMyaN8dmhCdMBvTrp:Zq6cFvLTE86r1JNbGn
TLSH
T13E147C1277A540F8E567C038C6514A52AB7774960B21AEFF03644334AF27AE6BF3CB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stage2_host.pdb

kernel32

Sleep OpenMutexA SetEnvironmentVariableA CreateProcessA GetLastError GetModuleFileNameA GetEnvironmentVariableA SetCurrentDirectoryA LoadLibraryA GetProcAddress CreateMutexA CreateThread WaitForSingleObject ReadFile TerminateProcess WriteFile GetTempPathA AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree GetCurrentProcess GetCurrentThreadId SetLastError GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer CreateFileW CloseHandle HeapReAlloc CreateFileA SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW LoadLibraryExW VirtualProtect QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader GetModuleFileNameW ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

advapi32

OpenProcessToken GetTokenInformation

user32

GetWindowThreadProcessId IsWindowVisible ShowWindow SetWindowPos EnumWindows

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_8ed4e957036385aa29b65598a8d9c158_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

advapi32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic