2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar
Size 6.2MB
Sample260422-vd8bpscs3l
SHA256 251a03df5bb014a99e4dec9ed51d43ef0e6a2fcd8c917a2a65f3cbe363eb97e5
MD5 c89e16e64f17cb08fb8b537caa250e77
SHA1 03093cfd9394e6ef9eb20a6ddc0d2d034d94e5ff
SHA512 fd57b1e3fb4e521fcd7e289c931e5d32d239af1e3e7615bb546e7ee612d14e4a9e9c75cd73b5097e0819714f2e21c794724909255c3e357c4d885ecd6439b3f4
SSDEEP 49152:gPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTABb:eKUgTH2M2m9dMpu1QfLczqssnKSsw
TLSH
T1E366D51125DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B46F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

File Explorer

2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

.exe 6.2MB

2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

IMPHASH f609d0eb5088eedf9a0d9a83a35fe4a6
SHA256 251a03df5bb014a99e4dec9ed51d43ef0e6a2fcd8c917a2a65f3cbe363eb97e5
MD5 c89e16e64f17cb08fb8b537caa250e77
SHA1 03093cfd9394e6ef9eb20a6ddc0d2d034d94e5ff
SHA512 fd57b1e3fb4e521fcd7e289c931e5d32d239af1e3e7615bb546e7ee612d14e4a9e9c75cd73b5097e0819714f2e21c794724909255c3e357c4d885ecd6439b3f4
SSDEEP 49152:gPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTABb:eKUgTH2M2m9dMpu1QfLczqssnKSsw
TLSH
T1E366D51125DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B46F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2655120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\BuildResults\bin\Release_x64\AcrobatExe.pdb

kernel32

CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetModuleFileNameA GetModuleHandleA GetSystemPowerStatus LoadLibraryA CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA SetErrorMode QueryPerformanceCounter HeapSetInformation ReleaseSemaphore WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime QueryPerformanceFrequency IsProcessorFeaturePresent GetVersionExW RtlUnwind UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW SetDllDirectoryW LoadLibraryExW GetExitCodeProcess GetLongPathNameW SetCurrentDirectoryW GetTickCount OpenMutexW GetVolumeInformationW GetModuleHandleW CreateThread CreateEventW CreateMutexW WaitForSingleObject ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType CreateFileW MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW TerminateProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy RaiseException DecodePointer GetStartupInfoW lstrlenW GetCurrentProcess WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW lstrcmpW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwindEx InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetLocaleInfoEx GetCPInfo CompareStringEx GetTempPathW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleExW GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW lstrcmpA LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RtlPcToFileHeader GetStringTypeW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock IsValidLocale QueryDosDeviceW WaitForSingleObjectEx QueryFullProcessImageNameW GlobalHandle CreatePipe MulDiv GlobalUnlock GlobalSize GlobalLock OpenFileMappingW GetComputerNameExW OpenEventW SetEnvironmentVariableW VirtualProtect VirtualQuery ExpandEnvironmentStringsW ProcessIdToSessionId GetProcessId DuplicateHandle GetProcessTimes IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive UnregisterWaitEx RegisterWaitForSingleObject QueryThreadCycleTime GetThreadPriority GetUserDefaultLangID IsDebuggerPresent GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW CopyFileW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetEnvironmentVariableW GetProfileStringW ReadProcessMemory CreateIoCompletionPort GetQueuedCompletionStatus UnregisterWait TerminateJobObject PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread DebugBreak GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation AssignProcessToJobObject SignalObjectAndWait CreateRemoteThread CreateJobObjectW VirtualFree SearchPathW ExitThread FlushInstructionCache VirtualAlloc GetModuleHandleExA GlobalAlloc GlobalFree GetTempFileNameW GetExitCodeThread BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetFullPathNameW GetFileTime CompareFileTime CreateDirectoryExW GetStdHandle

user32

GetMessageW GetUserObjectInformationW GetProcessWindowStation SetProcessWindowStation CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW TranslateMessage GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW GetPropA GetClassNameW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeQueryStringA DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongPtrW SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA GetThreadDesktop PostThreadMessageW IsWindowEnabled MsgWaitForMultipleObjects PeekMessageW CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows FindWindowExW EnableWindow WindowFromPoint GetAncestor GetShellWindow GetRawInputDeviceInfoW SetActiveWindow CreateIconFromResourceEx GetDC GetWindowTextLengthW ReleaseDC RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction LoadIconW SendDlgItemMessageW RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer CloseWindow LoadCursorW GetWindowDC SystemParametersInfoW BeginPaint EndPaint GetClientRect MoveWindow UpdateWindow AdjustWindowRectEx IsChild SetFocus SetRect MonitorFromRect IsRectEmpty GetClassInfoExW GetWindowLongW SetWindowLongW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient SetCapture ReleaseCapture FillRect InvalidateRect InvalidateRgn DestroyAcceleratorTable MapWindowPoints SetCursor IsDialogMessageW LoadBitmapW MapDialogRect SetWindowContextHelpId CreateDialogIndirectParamW PostQuitMessage DefWindowProcA DispatchMessageA GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongPtrW GetWindowTextW IsWindow GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics BringWindowToTop SendMessageTimeoutW EnumDesktopWindows SetWindowTextW GetForegroundWindow CharNextW EndDialog DialogBoxParamW GetGUIThreadInfo GetWindowThreadProcessId FindWindowW AllowSetForegroundWindow SwitchToThisWindow KillTimer SetTimer EmptyClipboard CloseClipboard OpenClipboard SetWindowPos ShowWindow UnregisterClassW PostMessageW

advapi32

CryptGenKey RegGetValueW RegOpenKeyExA RegQueryValueA RegQueryValueExA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW MakeAbsoluteSD InitiateSystemShutdownW LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType GetUserNameW ImpersonateAnonymousToken CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CredReadW CredFree CredWriteW CredDeleteW CryptSetKeyParam CryptContextAddRef

shlwapi

UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathRemoveFileSpecW PathFindExtensionA PathCombineW PathIsRelativeW PathFindExtensionW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathFindFileNameW PathAddBackslashW PathCreateFromUrlW UrlCanonicalizeW UrlUnescapeW PathIsUNCServerShareW ord219 PathIsURLW

winhttp

WinHttpSetCredentials WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders

??4PreamblePatcher@sidestep@@QEAAAEAV01@$$QEAV01@@Z ??4PreamblePatcher@sidestep@@QEAAAEAV01@AEBV01@@Z ?AcrobatIsNearAbsoluteIndirectJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?AllocPageNear@PreamblePatcher@sidestep@@CAPEAXPEAX@Z ?AllocPreambleBlockNear@PreamblePatcher@sidestep@@SAPEAEPEAX@Z ?FreePreambleBlock@PreamblePatcher@sidestep@@SAXPEAE@Z ?Initialize@PreamblePatcher@sidestep@@CAXXZ ?IsMovWithDisplacement@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearAbsoluteCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?PatchMovWithDisplacement@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchNearJumpOrCall@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortConditionalJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?RawPatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX0PEAPEAXPEBD@Z ?RawPatchWithStub@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?RawPatchWithStubAndProtections@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?ResolveTargetImpl@PreamblePatcher@sidestep@@CAPEAXPEAE0_N@Z ?Unpatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX00@Z ?granularity_@PreamblePatcher@sidestep@@0JA ?initialized_@PreamblePatcher@sidestep@@0_NA ?pagesize_@PreamblePatcher@sidestep@@0JA ?preamble_pages_@PreamblePatcher@sidestep@@0PEAUPreamblePage@12@EA AcroRd32IsBrokerProcess GetHandleVerifier GetWinstaDesktopInfo IsSandboxedProcess

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-22_c89e16e64f17cb08fb8b537caa250e77_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

kernel32

user32

advapi32

shlwapi

winhttp

generic