2026-05-23_0a54c5775dc4789c690ced9d2ea57b92_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_0a54c5775dc4789c690ced9d2ea57b92_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 12.3MB
Sample260523-v7ge3sat3v
SHA256 cd5cff4d2fbc8908d86dd2766c8565c67167aa2cbf2b5b53623fe779dd4ad863
MD5 0a54c5775dc4789c690ced9d2ea57b92
SHA1 36f2d7915ae033cab07e26dfc6e1a3fc95ecb66e
SHA512 f57216bf5d28e659185a3a32aebd59c08d506bc7d7c1ac2cf27580c70cc1ee1bd4a672fc9f0a5cbe7d309b2deae3d89dde6f060bb33f96aabfb558eca76dd62b
SSDEEP 98304:4h+gco1pKsPW3sSJZsrgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdeHrIPI:0hr1I2Wcqkjj7UlG8drCeqBvKCzcLoi
TLSH
T110D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_0a54c5775dc4789c690ced9d2ea57b92_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-05-23_0a54c5775dc4789c690ced9d2ea57b92_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 12.3MB

2026-05-23_0a54c5775dc4789c690ced9d2ea57b92_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 23f526e72cd3a35734f0838ba2ae34a7
SHA256 cd5cff4d2fbc8908d86dd2766c8565c67167aa2cbf2b5b53623fe779dd4ad863
MD5 0a54c5775dc4789c690ced9d2ea57b92
SHA1 36f2d7915ae033cab07e26dfc6e1a3fc95ecb66e
SHA512 f57216bf5d28e659185a3a32aebd59c08d506bc7d7c1ac2cf27580c70cc1ee1bd4a672fc9f0a5cbe7d309b2deae3d89dde6f060bb33f96aabfb558eca76dd62b
SSDEEP 98304:4h+gco1pKsPW3sSJZsrgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdeHrIPI:0hr1I2Wcqkjj7UlG8drCeqBvKCzcLoi
TLSH
T110D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5228752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\AdobeCollabSync.pdb

shlwapi

UrlIsW StrCmpNW PathFindFileNameW UrlCanonicalizeA StrCmpNA PathRemoveFileSpecW PathCreateFromUrlW

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore CryptProtectData CertFreeCertificateContext CryptUnprotectData

msi

ord205 ord70

kernel32

GetOverlappedResult WaitForMultipleObjects WaitNamedPipeW OpenProcess GetTempPathW GetCommandLineW GetCurrentThreadId DeleteFileA GetTempPathA DuplicateHandle CreateThread CreateProcessW GetThreadId lstrcatA GetEnvironmentStringsW FreeEnvironmentStringsW CreateDirectoryW ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject VerifyVersionInfoA GetFileType OpenEventA ConnectNamedPipe GetWindowsDirectoryW SetWaitableTimer ResumeThread TerminateProcess GetCurrentProcessId HeapSetInformation FindResourceA SizeofResource CreateNamedPipeW DeviceIoControl GetFileSize GetFileAttributesExW SetFileAttributesW GlobalFree LockResource LoadResource GetModuleHandleExA WideCharToMultiByte FormatMessageW FormatMessageA GetVersionExW CreateEventA GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy VerifyVersionInfoW LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetSystemDirectoryW GetExitCodeProcess GetCurrentProcess QueryDosDeviceW GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW VerSetConditionMask QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetModuleHandleExW GetModuleFileNameW CreateWaitableTimerA GetThreadErrorMode CreateEventW GlobalAlloc WaitForSingleObject ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError DecodePointer OutputDebugStringW OutputDebugStringA SetThreadErrorMode PostQueuedCompletionStatus TerminateThread lstrlenW GetTickCount Sleep OpenMutexW SetNamedPipeHandleState GetLastError CloseHandle GetStringTypeW WriteFile ReadFile GetVolumeInformationW CreateFileW QueueUserWorkItem SleepConditionVariableCS InitializeConditionVariable WaitForThreadpoolWorkCallbacks SetThreadpoolThreadMinimum DisconnectNamedPipe SetThreadpoolThreadMaximum K32GetProcessMemoryInfo GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread CreateFiberEx QueueUserAPC CloseThreadpoolWork GetProcessTimes AreFileApisANSI DeleteFiber SwitchToFiber RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA ReleaseSemaphore SwitchToThread DeleteFileW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointer MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetSystemTimeAsFileTime GetLocalTime FileTimeToSystemTime RemoveDirectoryW MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetSystemDirectoryA LoadLibraryA lstrlenA GetModuleHandleA FindCloseChangeNotification FindResourceExW FindResourceW GetTimeZoneInformation GetUserDefaultUILanguage CreateFileA ReadDirectoryChangesW FindFirstChangeNotificationW FindNextChangeNotification GetDriveTypeA WaitForSingleObjectEx PeekNamedPipe CancelIoEx WaitForMultipleObjectsEx CreateNamedPipeA LoadLibraryExW GetUserDefaultLCID GetStdHandle GetFileAttributesA GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetExitCodeThread GetNativeSystemInfo CloseThreadpool QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread WriteConsoleW ExitProcess GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadConsoleW SetConsoleCtrlHandler MoveFileExW SetStdHandle FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW VirtualFree GetEnvironmentVariableW AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock SystemTimeToTzSpecificLocalTime RtlUnwind InitOnceComplete InitOnceBeginInitialize CreateIoCompletionPort SleepEx GetQueuedCompletionStatus CreateWaitableTimerW SystemTimeToFileTime CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CreateThreadpool

user32

LoadStringW SendMessageTimeoutW SetWindowPos SetForegroundWindow GetWindowRect GetDesktopWindow FindWindowW GetClassNameW GetWindowThreadProcessId GetActiveWindow TranslateMessage BringWindowToTop PostMessageW GetClassNameA IsHungAppWindow LoadImageW GetCursorPos GetPropW SetPropW InsertMenuItemW TrackPopupMenu InsertMenuW DestroyMenu CreatePopupMenu DestroyWindow CreateWindowExW RegisterClassW CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA GetSystemMetrics EnumWindows IsWindowVisible ShowWindowAsync IsWindow AttachThreadInput KillTimer SetTimer GetMessageA GetForegroundWindow DispatchMessageA GetUserObjectInformationW EnumDesktopWindows GetProcessWindowStation MessageBoxW PeekMessageA MsgWaitForMultipleObjects SendMessageA FindWindowA

winspool.drv

UploadPrinterDriverPackageW

advapi32

CryptDecrypt CryptImportKey OpenThreadToken ConvertSidToStringSidA CryptHashData CryptGetHashParam RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptEnumProvidersA CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW RegEnumKeyExW RegQueryValueExA OpenProcessToken RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetTokenInformation GetLengthSid DuplicateTokenEx RegDeleteTreeW RegCreateKeyA ConvertStringSecurityDescriptorToSecurityDescriptorA TreeSetNamedSecurityInfoW GetNamedSecurityInfoW RegSetValueExA RegOpenKeyExA RegCreateKeyExA GetSidSubAuthorityCount GetSidSubAuthority GetSecurityDescriptorSacl GetAclInformation GetAce CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW GetTokenInformation

shell32

SHQueryUserNotificationState SHGetSpecialFolderLocation SHGetPathFromIDListW SHFileOperationA ShellExecuteExA ShellExecuteA SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW Shell_NotifyIconW SHCreateDirectoryExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

sensapi

IsNetworkAlive

urlmon

URLDownloadToFileA

psapi

GetModuleFileNameExA GetProcessImageFileNameW

ws2_32

bind connect listen recv select WSAIoctl socket GetAddrInfoW FreeAddrInfoW __WSAFDIsSet WSAEventSelect getservbyname setsockopt ioctlsocket freeaddrinfo htons htonl shutdown WSACreateEvent WSAGetLastError WSACleanup WSAStartup accept WSASocketA getsockopt gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport send WSASend ntohl WSASetLastError WSASocketW getaddrinfo getpeername getsockname ntohs WSAAddressToStringW WSARecv closesocket

wininet

InternetSetCookieExA InternetReadFile InternetWriteFile InternetSetOptionA HttpSendRequestExA HttpEndRequestA HttpAddRequestHeadersA DetectAutoProxyUrl HttpSendRequestA InternetCrackUrlA InternetOpenA InternetConnectA HttpOpenRequestA HttpQueryInfoA InternetCloseHandle

mpr

WNetGetResourceInformationW WNetGetConnectionW WNetAddConnection2W WNetCancelConnection2W

api-ms-win-core-path-l1-1-0

PathCchAppend PathCchAddBackslash

oleaut32

SysAllocString SafeArrayDestroy SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SysFreeString

netapi32

NetShareGetInfo

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpGetProxyForUrl WinHttpCrackUrl

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

648KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=261, version=29920,

count=12, id=259, version=27412,

count=221, id=261, version=27412,

count=1, id=253, version=33030,

count=19, id=260, version=33030,

count=20, id=259, version=33030,

count=198, id=265, version=33133,

count=11, id=260, version=33133,

count=112, id=261, version=33030,

count=31, id=260, version=27412,

count=1, id=262, version=27412,

count=762, id=260, version=29920,

count=32, productName=Unmarked objects (old),

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=257, version=27412,

count=632, id=1, productName=Unmarked objects,

count=257, id=261, version=33133,

count=1, id=256, version=33133,

count=1, id=255, version=33133,

count=2, id=151,

count=1, id=258, version=33133,