2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink
Size 112.0MB
Sample260604-qlrayagt6m
SHA256 4070f9763aa98114fbbfd6643ac79648ce170e01a12373730ffb546bd3806927
MD5 b859cc3710b6e7aa908e3657c053c168
SHA1 c1cda8dde9d1b536a37ccbbddd79031077f81aaf
SHA512 9bd2d5d778a291675093cc682b7d221ce4f35ba7b98f4da4a0dc45865b2dc56c6b6039d5d9d6916e5b27850fce59fb0034b880a7482ce9fbd161d52b54b1a2de
SSDEEP 1572864:BAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:s3iXtqwb
TLSH
T117486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink

File Explorer

2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink

.exe 112.0MB

2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink

IMPHASH 1fafdf46362adae2cd5d1faca1f4ab05
SHA256 4070f9763aa98114fbbfd6643ac79648ce170e01a12373730ffb546bd3806927
MD5 b859cc3710b6e7aa908e3657c053c168
SHA1 c1cda8dde9d1b536a37ccbbddd79031077f81aaf
SHA512 9bd2d5d778a291675093cc682b7d221ce4f35ba7b98f4da4a0dc45865b2dc56c6b6039d5d9d6916e5b27850fce59fb0034b880a7482ce9fbd161d52b54b1a2de
SSDEEP 1572864:BAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:s3iXtqwb
TLSH
T117486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60941996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildkite-agent\build\build\release\bun-profile.pdb

ntdll

NtAllocateVirtualMemory NtClose NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtFreeVirtualMemory NtLockFile NtQueryAttributesFile NtQueryDirectoryFile NtQueryInformationFile NtQueryInformationProcess NtQueryObject NtQueryVolumeInformationFile NtReadFile NtSetInformationFile NtWriteFile RtlAddFunctionTable RtlCaptureContext RtlCaptureStackBackTrace RtlDeleteFunctionTable RtlDllShutdownInProgress RtlEqualUnicodeString RtlExitUserProcess RtlGetFullPathName_U RtlGetSystemTimePrecise RtlGetVersion RtlLookupFunctionEntry RtlNtStatusToDosError RtlPcToFileHeader RtlQueryPerformanceCounter RtlQueryPerformanceFrequency RtlSetCurrentDirectory_U RtlUnwind RtlUnwindEx RtlUpcaseUnicodeChar RtlVirtualUnwind RtlWaitOnAddress RtlWakeAddressAll RtlWakeAddressSingle VerSetConditionMask

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDeriveKeyPBKDF2 BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

userenv

GetUserProfileDirectoryW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI AssignProcessToJobObject BeginUpdateResourceW CancelIo CancelIoEx CancelSynchronousIo CloseHandle CompareStringEx CompareStringOrdinal CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventA CreateFile2 CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectA CreateJobObjectW CreateMutexA CreateMutexW CreateNamedPipeA CreateNamedPipeW CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateSymbolicLinkW CreateThread DebugBreak DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DiscardVirtualMemory DuplicateHandle EncodePointer EndUpdateResourceW EnterCriticalSection EnumResourceLanguagesW EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsA FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetConsoleTitleW GetCurrencyFormatEx GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetCurrentThreadStackLimits GetDateFormatEx GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetLocaleInfoEx GetLocaleInfoW GetLongPathNameW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeHandleStateA GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberFormatEx GetNumberOfConsoleInputEvents GetOEMCP GetOverlappedResult GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadDescription GetThreadTimes GetTickCount GetTickCount64 GetTimeFormatEx GetTimeFormatW GetTimeZoneInformation GetTimeZoneInformationForYear GetUserDefaultLCID GetUserDefaultUILanguage GetUserGeoID GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessInJob IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModules K32GetModuleBaseNameW K32GetModuleFileNameExA K32GetProcessMemoryInfo LCIDToLocaleName LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LocaleNameToLCID LockFile LockFileEx LockResource MapViewOfFile MoveFileExW MultiByteToWideChar NeedCurrentDirectoryForExePathW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryMemoryResourceNotification QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReOpenFile ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResolveLocaleName ResumeThread SearchPathA SetConsoleCP SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetStdHandle SetThreadAffinityMask SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute UpdateResourceW VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleInputW WriteConsoleW WriteFile lstrlenW

user32

DispatchMessageA GetMessageA GetSystemMetrics MapVirtualKeyW TranslateMessage

shell32

CommandLineToArgvW SHGetKnownFolderPath

??0Environment@bmalloc@@QEAA@AEBV?$scoped_lock@VMutex@bmalloc@@@std@@@Z ??0EscapableHandleScope@v8@@QEAA@PEAVIsolate@1@@Z ??0EscapableHandleScopeBase@v8@@QEAA@PEAVIsolate@1@@Z ??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z ??1EscapableHandleScope@v8@@QEAA@XZ ??1HandleScope@v8@@QEAA@XZ ?AddEnvironmentCleanupHook@node@@YAXPEAVIsolate@v8@@P6AXPEAX@Z1@Z ?CheckCast@Array@v8@@CAXPEAVValue@2@@Z ?ContainsOnlyOneByte@String@v8@@QEBA_NXZ ?CreateHandle@HandleScope@v8@@KAPEA_KPEAVIsolate@internal@2@_K@Z ?DisposeGlobal@api_internal@v8@@YAXPEA_K@Z ?EscapeSlot@EscapableHandleScopeBase@v8@@IEAAPEA_KPEA_K@Z ?FromJustIsNothing@api_internal@v8@@YAXXZ ?FullIsFalse@Value@v8@@AEBA_NXZ ?FullIsTrue@Value@v8@@AEBA_NXZ ?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z ?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?GetCurrent@Isolate@v8@@SAPEAV12@XZ ?GetCurrentContext@Isolate@v8@@QEAA?AV?$Local@VContext@v8@@@2@XZ ?GetFunction@FunctionTemplate@v8@@QEAA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?GetFunctionTemplateData@api_internal@v8@@YA?AV?$Local@VValue@v8@@@2@PEAVIsolate@2@V?$Local@VData@v8@@@2@@Z ?GetInternalField@Object@v8@@QEAA?AV?$Local@VData@v8@@@2@H@Z ?GetIsolate@Context@v8@@QEAAPEAVIsolate@2@XZ ?GetName@Function@v8@@QEBA?AV?$Local@VValue@v8@@@2@XZ ?GlobalizeReference@api_internal@v8@@YAPEA_KPEAVIsolate@internal@2@_K@Z ?InternalFieldCount@ObjectTemplate@v8@@QEBAHXZ ?IsArray@Value@v8@@QEBA_NXZ ?IsBigInt@Value@v8@@QEBA_NXZ ?IsBoolean@Value@v8@@QEBA_NXZ ?IsExternal@String@v8@@QEBA_NXZ ?IsExternalOneByte@String@v8@@QEBA_NXZ ?IsExternalTwoByte@String@v8@@QEBA_NXZ ?IsFalse@Value@v8@@QEBA_NXZ ?IsFunction@Value@v8@@QEBA_NXZ ?IsInt32@Value@v8@@QEBA_NXZ ?IsMap@Value@v8@@QEBA_NXZ ?IsNull@Value@v8@@QEBA_NXZ ?IsNullOrUndefined@Value@v8@@QEBA_NXZ ?IsNumber@Value@v8@@QEBA_NXZ ?IsObject@Value@v8@@QEBA_NXZ ?IsOneByte@String@v8@@QEBA_NXZ ?IsString@Value@v8@@QEBA_NXZ ?IsTrue@Value@v8@@QEBA_NXZ ?IsUint32@Value@v8@@QEBA_NXZ ?IsUndefined@Value@v8@@QEBA_NXZ ?IsolateFromNeverReadOnlySpaceObject@internal@v8@@YAPEAVIsolate@12@_K@Z ?Iterate@Array@v8@@QEAA?AV?$Maybe@X@2@V?$Local@VContext@v8@@@2@P6A?AW4CallbackResult@12@IV?$Local@VValue@v8@@@2@PEAX@Z2@Z ?Length@Array@v8@@QEBAIXZ ?Length@String@v8@@QEBAHXZ ?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@H@Z ?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@PEAV?$Local@VValue@v8@@@2@_K@Z ?New@Array@v8@@SA?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@_KV?$function@$$A6A?AV?$MaybeLocal@VValue@v8@@@v8@@XZ@std@@@Z ?New@Boolean@v8@@SA?AV?$Local@VBoolean@v8@@@2@PEAVIsolate@2@_N@Z ?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PEAVIsolate@2@PEAX@Z ?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PEAVIsolate@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@PEBVCFunction@2@GGG@Z ?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PEAVIsolate@2@N@Z ?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PEAVIsolate@2@@Z ?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PEAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?NewFromOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBEW4NewStringType@2@H@Z ?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z ?NewInstance@ObjectTemplate@v8@@QEAA?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?RemoveEnvironmentCleanupHook@node@@YAXPEAVIsolate@v8@@P6AXPEAX@Z1@Z ?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z ?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z ?SetInternalField@Object@v8@@QEAAXHV?$Local@VData@v8@@@2@@Z ?SetInternalFieldCount@ObjectTemplate@v8@@QEAAXH@Z ?SetName@Function@v8@@QEAAXV?$Local@VString@v8@@@2@@Z ?SlowGetInternalField@Object@v8@@AEAA?AV?$Local@VData@v8@@@2@H@Z ?StrictEquals@Value@v8@@QEBA_NV?$Local@VValue@v8@@@2@@Z ?ToLocalEmpty@api_internal@v8@@YAXXZ ?TryGetCurrent@Isolate@v8@@SAPEAV12@XZ ?Uint32Value@Value@v8@@QEBA?AV?$Maybe@I@2@V?$Local@VContext@v8@@@2@@Z ?Utf8Length@String@v8@@QEBAHPEAVIsolate@2@@Z ?Value@Boolean@v8@@QEBA_NXZ ?Value@External@v8@@QEBAPEAXXZ ?Value@Number@v8@@QEBANXZ ?WriteUtf8@String@v8@@QEBAHPEAVIsolate@2@PEADHPEAHH@Z ?commitAlignedPhysical@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z ?decommitAlignedPhysical@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z ?disableScavenger@api@bmalloc@@YAXXZ ?enableMiniMode@api@bmalloc@@YAX_N@Z ?forceEnablePGM@api@bmalloc@@YAXG@Z ?freeLargeVirtual@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z ?freeOutOfLine@api@bmalloc@@YAXPEAXW4HeapKind@2@@Z ?isEnabled@api@bmalloc@@YA_NW4HeapKind@2@@Z ?isMTEEnabled@api@bmalloc@@YA_NW4HeapKind@2@@Z ?lockSlowCase@Mutex@bmalloc@@AEAAXXZ ?mallocOutOfLine@api@bmalloc@@YAPEAX_KW4CompactAllocationMode@2@W4HeapKind@2@@Z ?s_memory@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2UMemory@23@A ?s_memory@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2UMemory@23@A ?s_mutex@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2VMutex@3@A ?s_mutex@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2VMutex@3@A ?s_object@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2U?$atomic@PEAVEnvironment@bmalloc@@@std@@A ?s_object@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2U?$atomic@PEAVSystemHeap@bmalloc@@@std@@A ?scavenge@api@bmalloc@@YAXXZ ?scavengeThisThread@api@bmalloc@@YAXXZ ?systemHeapCache@bmalloc@@3PEAVSystemHeap@1@EA ?tryLargeZeroedMemalignVirtual@api@bmalloc@@YAPEAX_K0W4CompactAllocationMode@2@W4HeapKind@2@@Z dumpBtjsTrace g_config icudt73_dat llhttp_errno_name llhttp_execute llhttp_finish llhttp_get_errno llhttp_get_error_pos llhttp_get_error_reason llhttp_get_http_major llhttp_get_http_minor llhttp_get_method llhttp_get_status_code llhttp_get_type llhttp_get_upgrade llhttp_init llhttp_message_needs_eof llhttp_method_name llhttp_pause llhttp_reset llhttp_resume llhttp_resume_after_upgrade llhttp_set_error_reason llhttp_set_lenient_chunked_length llhttp_set_lenient_data_after_close llhttp_set_lenient_headers llhttp_set_lenient_keep_alive llhttp_set_lenient_optional_cr_before_lf llhttp_set_lenient_optional_crlf_after_chunk llhttp_set_lenient_optional_lf_after_cr llhttp_set_lenient_spaces_after_chunk_size llhttp_set_lenient_transfer_encoding llhttp_set_lenient_version llhttp_settings_init llhttp_should_keep_alive llhttp_status_name napi_acquire_threadsafe_function napi_add_async_cleanup_hook napi_add_env_cleanup_hook napi_add_finalizer napi_adjust_external_memory napi_async_destroy napi_async_init napi_call_function napi_call_threadsafe_function napi_cancel_async_work napi_check_object_type_tag napi_close_callback_scope napi_close_escapable_handle_scope napi_close_handle_scope napi_coerce_to_bool napi_coerce_to_number napi_coerce_to_object napi_coerce_to_string napi_create_array napi_create_array_with_length napi_create_arraybuffer napi_create_async_work napi_create_bigint_int64 napi_create_bigint_uint64 napi_create_bigint_words napi_create_buffer napi_create_buffer_copy napi_create_dataview napi_create_date napi_create_double napi_create_error napi_create_external napi_create_external_arraybuffer napi_create_external_buffer napi_create_function napi_create_int32 napi_create_int64 napi_create_object napi_create_promise napi_create_range_error napi_create_reference napi_create_string_latin1 napi_create_string_utf16 napi_create_string_utf8 napi_create_symbol napi_create_threadsafe_function napi_create_type_error napi_create_typedarray napi_create_uint32 napi_define_class napi_define_properties napi_delete_async_work napi_delete_element napi_delete_property napi_delete_reference napi_detach_arraybuffer napi_escape_handle napi_fatal_error napi_fatal_exception napi_get_all_property_names napi_get_and_clear_last_exception napi_get_array_length napi_get_arraybuffer_info napi_get_boolean napi_get_buffer_info napi_get_cb_info napi_get_dataview_info napi_get_date_value napi_get_element napi_get_global napi_get_instance_data napi_get_last_error_info napi_get_named_property napi_get_new_target napi_get_node_version napi_get_null napi_get_property napi_get_property_names napi_get_prototype napi_get_reference_value napi_get_threadsafe_function_context napi_get_typedarray_info napi_get_undefined napi_get_uv_event_loop napi_get_value_bigint_int64 napi_get_value_bigint_uint64 napi_get_value_bigint_words napi_get_value_bool napi_get_value_double napi_get_value_external napi_get_value_int32 napi_get_value_int64 napi_get_value_string_latin1 napi_get_value_string_utf16 napi_get_value_string_utf8 napi_get_value_uint32 napi_get_version napi_has_element napi_has_named_property napi_has_own_property napi_has_property napi_instanceof napi_is_array napi_is_arraybuffer napi_is_buffer napi_is_dataview napi_is_date napi_is_detached_arraybuffer napi_is_error napi_is_exception_pending napi_is_promise napi_is_typedarray napi_make_callback napi_module_register napi_new_instance napi_object_freeze napi_object_seal napi_open_callback_scope napi_open_escapable_handle_scope napi_open_handle_scope napi_queue_async_work napi_ref_threadsafe_function napi_reference_ref napi_reference_unref napi_reject_deferred napi_release_threadsafe_function napi_remove_async_cleanup_hook napi_remove_env_cleanup_hook napi_remove_wrap napi_resolve_deferred napi_run_script napi_set_element napi_set_instance_data napi_set_named_property napi_set_property napi_strict_equals napi_throw napi_throw_error napi_throw_range_error napi_throw_type_error napi_type_tag_object napi_typeof napi_unref_threadsafe_function napi_unwrap napi_wrap node_api_create_buffer_from_arraybuffer node_api_create_external_string_latin1 node_api_create_external_string_utf16 node_api_create_property_key_latin1 node_api_create_property_key_utf16 node_api_create_property_key_utf8 node_api_create_syntax_error node_api_get_module_file_name node_api_post_finalizer node_api_symbol_for node_api_throw_syntax_error node_module_register pas_system_heap_free pas_system_heap_is_enabled pas_system_heap_malloc pas_system_heap_malloc_compact pas_system_heap_memalign pas_system_heap_memalign_compact pas_system_heap_realloc pas_system_heap_realloc_compact pas_system_heap_should_supplant_bmalloc uv_accept uv_addr_ip4_any_ uv_addr_ip6_any_ uv_async_init uv_async_send uv_available_parallelism uv_backend_fd uv_backend_timeout uv_barrier_destroy uv_barrier_init uv_barrier_wait uv_buf_init uv_cancel uv_chdir uv_check_init uv_check_start uv_check_stop uv_clock_gettime uv_close uv_cond_broadcast uv_cond_destroy uv_cond_init uv_cond_signal uv_cond_timedwait uv_cond_wait uv_cpu_info uv_cpumask_size uv_cwd uv_default_loop uv_directory_watcher_buffer_size uv_disable_stdio_inheritance uv_dlclose uv_dlerror uv_dlopen uv_dlsym uv_err_name uv_err_name_r uv_exepath uv_fatal_error uv_fileno uv_free_cpu_info uv_free_interface_addresses uv_freeaddrinfo uv_fs_access uv_fs_chmod uv_fs_chown uv_fs_close uv_fs_closedir uv_fs_copyfile uv_fs_event_getpath uv_fs_event_init uv_fs_event_start uv_fs_event_stop uv_fs_fchmod uv_fs_fchown uv_fs_fdatasync uv_fs_fstat uv_fs_fsync uv_fs_ftruncate uv_fs_futime uv_fs_get_path uv_fs_get_ptr uv_fs_get_result uv_fs_get_statbuf uv_fs_get_system_error uv_fs_get_type uv_fs_lchown uv_fs_link uv_fs_lstat uv_fs_lutime uv_fs_mkdir uv_fs_mkdtemp uv_fs_mkstemp uv_fs_open uv_fs_opendir uv_fs_poll_getpath uv_fs_poll_init uv_fs_poll_start uv_fs_poll_stop uv_fs_read uv_fs_readdir uv_fs_readlink uv_fs_realpath uv_fs_rename uv_fs_req_cleanup uv_fs_rmdir uv_fs_scandir uv_fs_scandir_next uv_fs_sendfile uv_fs_stat uv_fs_statfs uv_fs_symlink uv_fs_unlink uv_fs_utime uv_fs_write uv_get_available_memory uv_get_constrained_memory uv_get_free_memory uv_get_osfhandle uv_get_process_title uv_get_total_memory uv_getaddrinfo uv_getnameinfo uv_getrusage uv_gettimeofday uv_guess_handle uv_handle_get_data uv_handle_get_loop uv_handle_get_type uv_handle_set_data uv_handle_size uv_handle_type_name uv_has_ref uv_hrtime uv_idle_init uv_idle_start uv_idle_stop uv_if_indextoiid uv_if_indextoname uv_inet_ntop uv_inet_pton uv_interface_addresses uv_ip4_addr uv_ip4_name uv_ip6_addr uv_ip6_name uv_ip_name uv_is_active uv_is_closing uv_is_readable uv_is_writable uv_key_create uv_key_delete uv_key_get uv_key_set uv_kill uv_library_shutdown uv_listen uv_loadavg uv_loop_alive uv_loop_close uv_loop_configure uv_loop_delete uv_loop_fork uv_loop_get_data uv_loop_init uv_loop_new uv_loop_set_data uv_loop_size uv_metrics_idle_time uv_metrics_info uv_mutex_destroy uv_mutex_init uv_mutex_init_recursive uv_mutex_lock uv_mutex_trylock uv_mutex_unlock uv_now uv_once uv_open_osfhandle uv_os_environ uv_os_free_environ uv_os_free_group uv_os_free_passwd uv_os_get_group uv_os_get_passwd uv_os_get_passwd2 uv_os_getenv uv_os_gethostname uv_os_getpid uv_os_getppid uv_os_getpriority uv_os_homedir uv_os_setenv uv_os_setpriority uv_os_tmpdir uv_os_uname uv_os_unsetenv uv_pipe uv_pipe_bind uv_pipe_bind2 uv_pipe_chmod uv_pipe_connect uv_pipe_connect2 uv_pipe_getpeername uv_pipe_getsockname uv_pipe_init uv_pipe_open uv_pipe_pending_count uv_pipe_pending_instances uv_pipe_pending_type uv_poll_init uv_poll_init_socket uv_poll_start uv_poll_stop uv_prepare_init uv_prepare_start uv_prepare_stop uv_print_active_handles uv_print_all_handles uv_process_get_pid uv_process_kill uv_process_tty_read_line_req uv_process_tty_read_raw_req uv_queue_work uv_random uv_read_start uv_read_stop uv_recv_buffer_size uv_ref uv_replace_allocator uv_req_get_data uv_req_get_type uv_req_set_data uv_req_size uv_req_type_name uv_resident_set_memory uv_run uv_rwlock_destroy uv_rwlock_init uv_rwlock_rdlock uv_rwlock_rdunlock uv_rwlock_tryrdlock uv_rwlock_trywrlock uv_rwlock_wrlock uv_rwlock_wrunlock uv_sem_destroy uv_sem_init uv_sem_post uv_sem_trywait uv_sem_wait uv_send_buffer_size uv_set_process_title uv_setup_args uv_shutdown uv_signal_init uv_signal_start uv_signal_start_oneshot uv_signal_stop uv_simultaneous_server_accepts uv_sleep uv_socketpair uv_spawn uv_stop uv_stream_get_write_queue_size uv_stream_set_blocking uv_strerror uv_strerror_r uv_tcp_bind uv_tcp_close_reset uv_tcp_connect uv_tcp_getpeername uv_tcp_getsockname uv_tcp_init uv_tcp_init_ex uv_tcp_keepalive uv_tcp_nodelay uv_tcp_non_ifs_lsp_ipv4 uv_tcp_non_ifs_lsp_ipv6 uv_tcp_open uv_tcp_simultaneous_accepts uv_thread_create uv_thread_create_ex uv_thread_equal uv_thread_getaffinity uv_thread_getcpu uv_thread_join uv_thread_self uv_thread_setaffinity uv_timer_again uv_timer_get_due_in uv_timer_get_repeat uv_timer_init uv_timer_set_repeat uv_timer_start uv_timer_stop uv_translate_sys_error uv_try_write uv_try_write2 uv_tty_get_vterm_state uv_tty_get_winsize uv_tty_init uv_tty_reset_mode uv_tty_set_mode uv_tty_set_vterm_state uv_udp_bind uv_udp_connect uv_udp_get_send_queue_count uv_udp_get_send_queue_size uv_udp_getpeername uv_udp_getsockname uv_udp_init uv_udp_init_ex uv_udp_open uv_udp_recv_start uv_udp_recv_stop uv_udp_send uv_udp_set_broadcast uv_udp_set_membership uv_udp_set_multicast_interface uv_udp_set_multicast_loop uv_udp_set_multicast_ttl uv_udp_set_source_membership uv_udp_set_ttl uv_udp_try_send uv_udp_using_recvmmsg uv_unref uv_update_time uv_uptime uv_version uv_version_string uv_walk uv_write uv_write2

Name

.text

Size

58.5MB

Virtual Size

58.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46.2MB

Virtual Size

46.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

179KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

__DATA,_

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

__DATA,_

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bun

Size

509KB

Virtual Size

508KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_stealc_utkonos_voidlink

ntdll

bcrypt

userenv

api-ms-win-core-synch-l1-2-0

kernel32

user32

shell32

generic