2026-04-22_53d37b0fcf4de2a9aab38f2a69108597_akira_bazarbackdoor_coinminer_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-22_53d37b0fcf4de2a9aab38f2a69108597_akira_bazarbackdoor_coinminer_glassworm
Size 10.5MB
Sample260422-tmalcsfs41
SHA256 8313728807180dd5043aa73f0dd98fe7f1305fb107fbea8a431d5a6f5394bc67
MD5 53d37b0fcf4de2a9aab38f2a69108597
SHA1 807e3156eda003006295ea531b603334a8a73309
SHA512 6091b79e035c334db145216f5f84938f624066bccc1d6314bbc499874b007fc7db9520e2bdc1d227887dd0af6d90a9146e3e23111001461dff51ea52c9fd1e27
SSDEEP 98304:G+DWzwgfjGmMdivlucHq81K0U4DzRtNCC6rYOALRiNKpRyE3RbZ1zdScR0r1w19E:G9cidud8pUSzpXOALRi4pT9rERBj5
TLSH
T1E9B6AEB3A29123EDC47EC1758683A63BAF75B06A1630BB5B0550EA341E12D74371F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-22_53d37b0fcf4de2a9aab38f2a69108597_akira_bazarbackdoor_coinminer_glassworm

File Explorer

2026-04-22_53d37b0fcf4de2a9aab38f2a69108597_akira_bazarbackdoor_coinminer_glassworm

.exe 10.5MB

2026-04-22_53d37b0fcf4de2a9aab38f2a69108597_akira_bazarbackdoor_coinminer_glassworm

SHA256 8313728807180dd5043aa73f0dd98fe7f1305fb107fbea8a431d5a6f5394bc67
MD5 53d37b0fcf4de2a9aab38f2a69108597
SHA1 807e3156eda003006295ea531b603334a8a73309
SHA512 6091b79e035c334db145216f5f84938f624066bccc1d6314bbc499874b007fc7db9520e2bdc1d227887dd0af6d90a9146e3e23111001461dff51ea52c9fd1e27
SSDEEP 98304:G+DWzwgfjGmMdivlucHq81K0U4DzRtNCC6rYOALRiNKpRyE3RbZ1zdScR0r1w19E:G9cidud8pUSzpXOALRi4pT9rERBj5
TLSH
T1E9B6AEB3A29123EDC47EC1758683A63BAF75B06A1630BB5B0550EA341E12D74371F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10195032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

Size

105KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

115KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

5.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ