2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 32.6MB
Sample260519-dnaprafv3x
SHA256 d8ea1c97d9d1f7794c76a62d974df00f4d241fdc97be912d0e828528d823cc22
MD5 910079df50503082fb84194e742d6aef
SHA1 d3ca9d787f7eb5a1cae6519d1b11539c7ce7e65c
SHA512 e9495a8439a18e2a81d189f16261f25bbe4efe1149070fc5df9d5c50b642b68fa360cb2f7679073191e24e9538badeeb890d327137bcc9e1b643674d9c42c9be
SSDEEP 786432:Rsv16y1mEy4ZuOStXPe9UmKqgt2O2HK4qrzaURNkYvJw6:RsN6UzZuOaXPe9PK2O2q4yzIYx7
TLSH
T1EA771217A2E60194D9BAC078CA679647FB727C0613306BDF12A4A2156F73AF01E7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 32.6MB

2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH e40a87396a4615af00aca016be898320
SHA256 d8ea1c97d9d1f7794c76a62d974df00f4d241fdc97be912d0e828528d823cc22
MD5 910079df50503082fb84194e742d6aef
SHA1 d3ca9d787f7eb5a1cae6519d1b11539c7ce7e65c
SHA512 e9495a8439a18e2a81d189f16261f25bbe4efe1149070fc5df9d5c50b642b68fa360cb2f7679073191e24e9538badeeb890d327137bcc9e1b643674d9c42c9be
SSDEEP 786432:Rsv16y1mEy4ZuOStXPe9UmKqgt2O2HK4qrzaURNkYvJw6:RsN6UzZuOaXPe9PK2O2q4yzIYx7
TLSH
T1EA771217A2E60194D9BAC078CA679647FB727C0613306BDF12A4A2156F73AF01E7F325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a4:fb:5e:72:3c:14:e0:d3:44:7d:95:7d:7f:e8:2a:58:de:a6:b0:a6:ca:69:32:3e:1f:bf:41:bc:cc:32:b8:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5984112,CN=GoTo Technologies USA\, LLC,O=GoTo Technologies USA\, LLC,L=Boston,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:ad:3a:3f:fa:70:c0:a2:0a:e2:36:81:89:93:51:53

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2025 - Aug 22, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2917408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\a\rescue-native-rescueassist\rescue-native-rescueassist\build\RelWithDebInfo\GoToResolve.pdb

shlwapi

PathAppendW

wtsapi32

WTSSendMessageW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

ntdll

RtlVirtualUnwind VerSetConditionMask RtlUnwindEx RtlPcToFileHeader RtlUnwind RtlCaptureContext RtlLookupFunctionEntry

iphlpapi

ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid GetAdaptersAddresses

oleaut32

SysAllocString VariantInit SysFreeString VariantClear SetErrorInfo SysStringLen GetErrorInfo

secur32

InitSecurityInterfaceW AcquireCredentialsHandleW FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW ApplyControlToken

ncrypt

BCryptSetProperty BCryptDestroyKey BCryptEncrypt NCryptImportKey NCryptOpenStorageProvider BCryptEnumContextFunctions NCryptFreeObject BCryptGenerateSymmetricKey BCryptDecrypt NCryptSetProperty BCryptFreeBuffer NCryptExportKey

crypt32

CertCreateCertificateContext CertCompareCertificate CertGetCertificateContextProperty CryptEncodeObject CertFreeCertificateChain CertGetCertificateChain CryptAcquireCertificatePrivateKey CertVerifyTimeValidity CertAddStoreToCollection CertSetCertificateContextProperty CertDuplicateCertificateContext CertOpenStore CertFindCertificateInStore CertCloseStore CertAddCertificateContextToStore CertFreeCertificateContext PFXImportCertStore

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

userenv

GetUserProfileDirectoryW

advapi32

GetUserNameW RegNotifyChangeKeyValue GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW RegQueryValueExW RegEnumValueW RegOpenKeyExA RegQueryInfoKeyW GetSidSubAuthorityCount GetSidSubAuthority RegFlushKey RegDeleteKeyW LookupAccountSidW SetSecurityDescriptorOwner SetSecurityDescriptorGroup DuplicateToken CopySid AddAccessDeniedAceEx AddAccessAllowedAceEx SystemFunction036 RegEnumKeyExW ConvertStringSidToSidW SetSecurityDescriptorDacl AllocateAndInitializeSid RegCreateKeyExW RegSetValueExW OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW RegDeleteValueW GetLengthSid LookupAccountNameW GetTokenInformation RegQueryValueExA RegCloseKey

authz

AuthzInitializeResourceManager AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext AuthzAccessCheck

kernel32

WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx GetCPInfo FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeConditionVariable GetLocaleInfoEx GetStringTypeW FreeEnvironmentStringsW OpenEventA CreateEventA WaitForMultipleObjectsEx GetComputerNameExW PeekNamedPipe GetOverlappedResult CancelIoEx CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait QueryPerformanceFrequency QueryPerformanceCounter AreFileApisANSI WakeConditionVariable InitializeSRWLock SetFileAttributesW UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle ReadConsoleW GetConsoleOutputCP ExitProcess HeapReAlloc IsValidLocale EnumSystemLocalesW HeapSize SetEnvironmentVariableW IsValidCodePage GetOEMCP GlobalFree DisconnectNamedPipe TryAcquireSRWLockExclusive WriteConsoleW VirtualFree VirtualAlloc CreateMutexW ReleaseMutex AcquireSRWLockExclusive ReleaseSRWLockExclusive SetConsoleTextAttribute CreateDirectoryW SizeofResource WriteFile RemoveDirectoryW SetFilePointer CreateFileW FreeResource FormatMessageW GetLastError LockResource DeleteFileW CloseHandle LoadResource FindResourceW LocalFree GetModuleFileNameW SetCurrentDirectoryW CreateProcessW VerifyVersionInfoW UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile SetLastError lstrlenW FindFirstFileW FindNextFileW FindClose Sleep lstrcatW LoadLibraryW GetProcAddress MoveFileExW FreeLibrary lstrcpyW ReadFile GetFileSizeEx LCMapStringA SetErrorMode GetStringTypeExA GetUserDefaultLCID LoadLibraryA WideCharToMultiByte FormatMessageA HeapFree GetCommandLineW GetCurrentProcess TerminateProcess K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject LocalAlloc GetCurrentThreadId GetSystemDirectoryW OpenProcess SetFileInformationByHandle HeapAlloc GetCurrentDirectoryW DecodePointer DeleteCriticalSection GetProcessHeap GetModuleHandleW LoadLibraryExW GetExitCodeProcess OpenMutexA SetUnhandledExceptionFilter GetLocaleInfoW GetTimeZoneInformation GetCurrentThread RaiseException GetStdHandle ProcessIdToSessionId GetCurrentProcessId FlushFileBuffers GetFileAttributesW GetDynamicTimeZoneInformation MultiByteToWideChar GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo GetEnvironmentStringsW GetFileType SetEvent CreateEventW CreateThread GetExitCodeThread SetEndOfFile DuplicateHandle GetSystemInfo WaitNamedPipeW SetFilePointerEx FindFirstFileExW GetSystemTimeAsFileTime OutputDebugStringW GetLocalTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetConsoleWindow CompareStringEx GetSystemTime WaitForMultipleObjects SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadDescription IsProcessorFeaturePresent GetACP GetGeoInfoW GetUserGeoID GetModuleHandleExW GetDateFormatW GetTimeFormatW LocaleNameToLCID GetCurrencyFormatW GetUserPreferredUILanguages GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives GetLongPathNameW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW DeviceIoControl CopyFileW MoveFileW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx CompareStringW LCMapStringW ResetEvent WaitForSingleObjectEx

netapi32

NetApiBufferFree NetShareEnum

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoCreateFreeThreadedMarshaler

user32

GetWindowLongPtrW KillTimer SetCoalescableTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PostMessageW PeekMessageW DispatchMessageW wsprintfW LoadStringA TranslateMessage SetWindowLongPtrW UnregisterClassW CharPrevExA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeKillEvent timeSetEvent

ws2_32

WSANtohl WSASocketW WSASendTo WSAAccept htons getsockname getpeername WSAIoctl getnameinfo freeaddrinfo getaddrinfo WSASend WSANtohs ntohl htonl WSARecv WSARecvFrom WSAAsyncSelect WSACleanup WSAStartup WSAGetLastError __WSAFDIsSet WSAHtonl setsockopt WSAConnect select getsockopt listen closesocket bind

shell32

CommandLineToArgvW SHGetKnownFolderPath

winhttp

WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpCloseHandle

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

69KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmimed

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27.1MB

Virtual Size

27.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

shlwapi

wtsapi32

bcrypt

ntdll

iphlpapi

oleaut32

secur32

ncrypt

crypt32

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ole32

user32

version

winmm

ws2_32

shell32

winhttp

generic