2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 45.2MB
Sample260509-2exd6agy6j
SHA256 4292506df7e70709f58406590cf515be539b21cede536f70629dfe0d76851802
MD5 7796e544f20e355478d9c8ae509e6ac9
SHA1 0d9a3ab78eedbc4148ec6094bf4d3c07a9c5701b
SHA512 b62a24addcea63c5540d33d58eb31a6407ae1d4d0bb47dd65985c89b5ac438be5bb141d16883b16da4fc6cd833fa3e011b6d451a670ddb2a0421f65bf486d9eb
SSDEEP 393216:FO+LA1O1UucDVyfCwdfgjV1pULIt28MTtxOGtaB98QjoMQFBS6CKZOyKHo:Ff71WnjMTt4VB98QjZQFQpKZOyKI
TLSH
T19AA71B115B4D8785D226BD3CD0874501D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 45.2MB

2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH cd4617bde3fb8bdcdbf4352235e5f0d4
SHA256 4292506df7e70709f58406590cf515be539b21cede536f70629dfe0d76851802
MD5 7796e544f20e355478d9c8ae509e6ac9
SHA1 0d9a3ab78eedbc4148ec6094bf4d3c07a9c5701b
SHA512 b62a24addcea63c5540d33d58eb31a6407ae1d4d0bb47dd65985c89b5ac438be5bb141d16883b16da4fc6cd833fa3e011b6d451a670ddb2a0421f65bf486d9eb
SSDEEP 393216:FO+LA1O1UucDVyfCwdfgjV1pULIt28MTtxOGtaB98QjoMQFBS6CKZOyKHo:Ff71WnjMTt4VB98QjZQFQpKZOyKI
TLSH
T19AA71B115B4D8785D226BD3CD0874501D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40951591

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Symbols\__=^.^=_hi_buddy.pdb

ws2_32

freeaddrinfo WSASetLastError listen inet_ntop WSAStartup getaddrinfo WSACleanup WSAGetLastError setsockopt ioctlsocket htons htonl getsockopt ntohl select gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSARecv WSAAddressToStringW connect ntohs getsockname getpeername WSASend closesocket gethostname WSAResetEvent WSAWaitForMultipleEvents inet_pton __WSAFDIsSet accept bind WSAIoctl WSASocketW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses GetNetworkParams

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitialize CoCreateInstance CoUninitialize

kernel32

GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx ResumeThread GetThreadContext GetThreadId SetThreadContext GetCommandLineA ExitProcess ReadFile WaitNamedPipeA SetWaitableTimer SetLastError GetUserDefaultLocaleName InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateMutexA CreateEventW GetTimeZoneInformation GetTickCount64 CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetExitCodeThread GetProcessId Module32Next IsWow64Process GetSystemInfo VirtualAllocEx VirtualFreeEx WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread VirtualQueryEx LoadLibraryW SuspendThread GetThreadTimes OpenThread SetUnhandledExceptionFilter GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo TerminateThread EncodePointer GetStringTypeW RaiseException WakeConditionVariable TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW AreFileApisANSI SetFileInformationByHandle SetEvent FormatMessageW PostQueuedCompletionStatus WaitForSingleObject TerminateProcess Process32First FormatMessageA GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateDirectoryA WriteConsoleW DeleteCriticalSection LocalFree DecodePointer GetFileAttributesA GetLastError GetTempPathA GetCurrentThreadId InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFullPathNameW WaitNamedPipeW GetFileType InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive LeaveCriticalSection WaitForMultipleObjects EnterCriticalSection GetSystemTime GetModuleHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW PeekNamedPipe GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetSystemDirectoryA CloseHandle Process32Next HeapReAlloc HeapSize HeapQueryInformation SetEndOfFile IsValidCodePage QueueUserAPC CreateToolhelp32Snapshot LCMapStringEx Module32First GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ReleaseSemaphore CreateSemaphoreW SetNamedPipeHandleState OpenProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared TransactNamedPipe

user32

DispatchMessageA GetDpiForSystem UpdateWindow PostQuitMessage DefWindowProcA GetMonitorInfoA SetWindowLongA GetUserObjectInformationW GetProcessWindowStation RegisterClassExW UnregisterClassW GetSystemMetrics SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos MoveWindow ReleaseCapture PeekMessageA SetProcessDPIAware GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxW SetCursorPos TranslateMessage EnumDisplayDevicesW GetWindowRect CreateWindowExW SetWindowPos IsWindowUnicode ShowWindow DestroyWindow wsprintfW MessageBoxA PostMessageA

gdi32

CreateRectRgn DeleteObject

advapi32

RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteKeyA RegCloseKey RegDeleteTreeA OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus LookupPrivilegeValueA AdjustTokenPrivileges RegDeleteValueA RegEnumValueA GetUserNameW ConvertSidToStringSidW CreateProcessAsUserA SetThreadToken SetTokenInformation LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW OpenSCManagerW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority ConvertStringSecurityDescriptorToSecurityDescriptorA ControlService FreeSid CheckTokenMembership OpenServiceW RevertToSelf PrivilegeCheck RegOpenKeyExA

oleaut32

VariantClear SysFreeString

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

shlwapi

SHDeleteKeyW

ntdll

RtlInitAnsiString RtlNtStatusToDosError RtlFreeUnicodeString RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlAnsiStringToUnicodeString

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetConnectW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

26.7MB

Virtual Size

26.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text2

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-09_7796e544f20e355478d9c8ae509e6ac9_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

oleaut32

imm32

dwmapi

shlwapi

ntdll

bcrypt

crypt32

wininet

generic