2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer

General

Target
2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer
Size 523KB
Sample261110-x2kawsac76
SHA256 48a2a98eda3b081c1872de8b6cc6e38bf8466857fa187433ab5811e5407ad944
MD5 55ad184e9ac5627ceb0f9b792fa386a1
SHA1 33fb252920322c082e998ad497fa85d25ae96b07
SHA512 f22d06433144669c3fa208bf3ef64e63b17e273a5bb8fcb28500627d7e06338df065af272ee6feb9a052f3a45cfc7918cab94d3c46f2696ee8925a1a30b8d733
SSDEEP 6144:aspoR4XLWWhBhloJbldB/1vHiFhEg6ZFuBtPNmDW0aNK/aO8+Edm:as6F+s/uBrwb6d
TLSH
T159B47081BE0C58B6FDD1A0304143AD1D6D697FC7BB2C75DF318EB1242937EA49AA5E04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer

File Explorer

2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer

.exe 523KB

2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer

IMPHASH e97f45e6902b567928acfe97635dc521
SHA256 48a2a98eda3b081c1872de8b6cc6e38bf8466857fa187433ab5811e5407ad944
MD5 55ad184e9ac5627ceb0f9b792fa386a1
SHA1 33fb252920322c082e998ad497fa85d25ae96b07
SHA512 f22d06433144669c3fa208bf3ef64e63b17e273a5bb8fcb28500627d7e06338df065af272ee6feb9a052f3a45cfc7918cab94d3c46f2696ee8925a1a30b8d733
SSDEEP 6144:aspoR4XLWWhBhloJbldB/1vHiFhEg6ZFuBtPNmDW0aNK/aO8+Edm:as6F+s/uBrwb6d
TLSH
T159B47081BE0C58B6FDD1A0304143AD1D6D697FC7BB2C75DF318EB1242937EA49AA5E04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

00:ce:fd:e8:42:5f:40:e9:b8:38:a0:fd:7f:42:c8:72:ac:87:d9:ed:f3:7a:27:a0:29:fd:5b:dc:49:92:70:33

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 24, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

6

Entry point

184732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stage0.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

CloseHandle VirtualAlloc TlsSetValue SetStdHandle IsDebuggerPresent GetSystemInfo GlobalMemoryStatusEx GetTickCount64 SetLastError GetLastError GetCurrentProcessId WaitForSingleObject GetExitCodeProcess DeleteFileW SetFileInformationByHandle GetModuleHandleA LoadLibraryA GetProcAddress TlsAlloc VirtualProtect RtlAddFunctionTable CreateThread AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP SetFilePointerEx MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW FlushFileBuffers HeapSize QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW

ntdll

NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

Name

.text

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic