2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz
Size 77.0MB
Sample260704-chc29aev9q
SHA256 881ec539a05cba7c62178e936e6a31d5d93f138e7799672fb4ede7a2fdadc3f4
MD5 986a5c6ef447a7a0cbd67da7558498f4
SHA1 e392c6939375377250d66328ac1433c9e570ee33
SHA512 d78e85d49258cb31639fecd7612a42af8c5398bb25b068ff59629ab4a58c93a40eb1b1538d585823ee03b945fb557308043fe3626ad2a699f0d42ceedbedd723
SSDEEP 393216:T059RX4Pwq6t3KXMSyepQaAivBv6URs8hCeu2AsLP3LJ+wkpHiXUxY/iJ53IWhlE:giP6Rv7NibRdhvHDNuD5gTYbCV1hqLRM
TLSH
T117087D02BB975499D0AAC47087C78723AA3178CB1B35A9EF25C847353F7AAF05B39714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz

File Explorer

2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz

.exe 77.0MB

2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz

IMPHASH 83d08555ebde558dcfb2c82dbe991670
SHA256 881ec539a05cba7c62178e936e6a31d5d93f138e7799672fb4ede7a2fdadc3f4
MD5 986a5c6ef447a7a0cbd67da7558498f4
SHA1 e392c6939375377250d66328ac1433c9e570ee33
SHA512 d78e85d49258cb31639fecd7612a42af8c5398bb25b068ff59629ab4a58c93a40eb1b1538d585823ee03b945fb557308043fe3626ad2a699f0d42ceedbedd723
SSDEEP 393216:T059RX4Pwq6t3KXMSyepQaAivBv6URs8hCeu2AsLP3LJ+wkpHiXUxY/iJ53IWhlE:giP6Rv7NibRdhvHDNuD5gTYbCV1hqLRM
TLSH
T117087D02BB975499D0AAC47087C78723AA3178CB1B35A9EF25C847353F7AAF05B39714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48042284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

denort.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

CloseHandle SwitchToThread CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle UnmapViewOfFile SetThreadErrorMode GetBinaryTypeW SetErrorMode LoadLibraryW GetProcAddress GetLastError FormatMessageW LoadLibraryExW FreeLibrary GetDiskFreeSpaceW OpenProcess GetPriorityClass SetPriorityClass GetSystemInfo SetCurrentDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute GlobalUnlock Sleep CopyFileExW GetFileInformationByHandle GetFullPathNameW SetLastError DeviceIoControl GetStdHandle CreateFileW SetConsoleCursorPosition CreateIoCompletionPort CreateNamedPipeW ConnectNamedPipe GetFileType GlobalMemoryStatusEx GetProcessTimes FileTimeToSystemTime GetTickCount64 FreeEnvironmentStringsW WriteConsoleInputW PeekConsoleInputW FlushConsoleInputBuffer TerminateProcess RegisterWaitForSingleObject FindClose SleepEx WriteFileEx WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess SetHandleInformation GetCurrentProcessId GetNumberOfConsoleInputEvents ResetEvent CreateSemaphoreW CreateToolhelp32Snapshot Process32First Process32Next CreateJobObjectW SetInformationJobObject AssignProcessToJobObject GetSystemDefaultLangID FormatMessageA LocalFree CompareStringOrdinal UnregisterWaitEx GetProcessId CreateDirectoryW SetFileInformationByHandle GetOverlappedResult CreateEventW CancelIo ReadFile GetShortPathNameW NeedCurrentDirectoryForExePathW CreateProcessW ResumeThread GetFileAttributesW WideCharToMultiByte SetFileTime LockFileEx UnlockFile FindResourceA LoadResource SizeofResource LockResource VirtualProtect GetQueuedCompletionStatusEx PostQueuedCompletionStatus WriteFile CancelIoEx SetFileCompletionNotificationModes WaitForSingleObjectEx ReadDirectoryChangesW ReleaseSemaphore GetModuleHandleA IsWow64Process2 GlobalLock GlobalSize ReadConsoleInputW GetConsoleCursorInfo SetConsoleCursorInfo WriteConsoleW FillConsoleOutputCharacterA FillConsoleOutputAttribute RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA lstrlenW CreateMutexA ReleaseMutex GetConsoleOutputCP MultiByteToWideChar HeapQueryInformation CreateWaitableTimerExW SetWaitableTimer QueryPerformanceFrequency GetModuleHandleW GetEnvironmentStringsW GetTempPathW GetModuleFileNameW GetCommandLineW GetFileInformationByHandleEx FlushFileBuffers GetFinalPathNameByHandleW SetFilePointerEx FindNextFileW FindFirstFileExW ReadConsoleW CreateThread ExitProcess QueryPerformanceCounter GetSystemTimePreciseAsFileTime HeapAlloc DeleteFileW MoveFileExW RemoveDirectoryW CreateSymbolicLinkW CreateHardLinkW SetEnvironmentVariableW SetConsoleCtrlHandler CreateEventA RemoveVectoredExceptionHandler LoadLibraryExA VirtualAlloc VirtualFree VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize HeapDestroy HeapCompact DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection GetCurrentThreadId GetLocaleInfoEx GetTimeZoneInformation RtlUnwind VerSetConditionMask VerifyVersionInfoW MapViewOfFileEx IsDebuggerPresent TlsAlloc TlsFree TlsGetValue TlsSetValue QueryThreadCycleTime GetThreadPriority SetThreadPriority RtlAddFunctionTable RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FlsAlloc FlsGetValue FlsSetValue SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetNativeSystemInfo GetDynamicTimeZoneInformation GetUserGeoID GetGeoInfoW CreateSemaphoreA SuspendThread GetThreadContext GetLogicalProcessorInformation InitializeSRWLock InitializeConditionVariable ResolveLocaleName GetCurrencyFormatEx GetNumberFormatEx SystemTimeToTzSpecificLocalTime GetDateFormatEx GetTimeFormatEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW InitializeCriticalSectionEx FlsFree GetCommandLineA GetCPInfo FreeLibraryAndExitThread GetStringTypeW IsValidCodePage GetACP GetOEMCP GetEnvironmentVariableW GetTempFileNameA ExitThread GetModuleHandleExW SetStdHandle InitializeCriticalSectionAndSpinCount EncodePointer InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter

user32

RegisterClassExA GetClientRect DefWindowProcA CloseClipboard CreateWindowExA GetDC ReleaseDC GetClipboardData OpenClipboard MapVirtualKeyW DestroyWindow

shell32

SHGetKnownFolderPath

gdi32

SetPixelFormat GetPixelFormat ChoosePixelFormat SwapBuffers DescribePixelFormat

crypt32

CertVerifyTimeValidity CertCloseStore CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertOpenStore CertFreeCertificateContext CertDuplicateCertificateContext

ws2_32

closesocket WSAIoctl socket ioctlsocket accept connect getsockopt recv send sendto bind recvfrom GetHostNameW getsockname WSASendMsg WSASocketW WSAStartup WSAGetLastError setsockopt listen getaddrinfo freeaddrinfo WSACleanup WSASend WSADuplicateSocketW shutdown getpeername

advapi32

RegQueryValueExW RegOpenKeyExW GetUserNameW SystemFunction036 OpenProcessToken RegGetValueW AdjustTokenPrivileges LookupPrivilegeValueW EventSetInformation RegCloseKey EventWriteTransfer RegEnumKeyExW RegQueryInfoKeyW EventRegister

userenv

GetUserProfileDirectoryW

ntdll

RtlNtStatusToDosError NtQuerySystemInformation NtWriteFile NtCreateFile NtDeviceIoControlFile NtOpenFile NtQueryInformationFile NtReadFile RtlGetVersion NtCancelIoFileEx

winmm

timeGetTime timeEndPeriod timeBeginPeriod

psapi

GetProcessMemoryInfo GetModuleBaseNameW GetPerformanceInfo

ole32

CoTaskMemFree

dbghelp

SymSetSearchPathW SymGetModuleBase64 SymGetSearchPathW SymInitialize StackWalk64 SymFromAddr SymGetLineFromAddr64 SymSetOptions SymGetOptions MiniDumpWriteDump SymFunctionTableAccess64

bcrypt

BCryptGenRandom

oleaut32

SysStringLen GetErrorInfo SysFreeString

CrashForExceptionInNonABICompliantCodeRange napi_acquire_threadsafe_function napi_add_async_cleanup_hook napi_add_env_cleanup_hook napi_add_finalizer napi_adjust_external_memory napi_async_destroy napi_async_init napi_call_function napi_call_threadsafe_function napi_cancel_async_work napi_check_object_type_tag napi_close_callback_scope napi_close_escapable_handle_scope napi_close_handle_scope napi_coerce_to_bool napi_coerce_to_number napi_coerce_to_object napi_coerce_to_string napi_create_array napi_create_array_with_length napi_create_arraybuffer napi_create_async_work napi_create_bigint_int64 napi_create_bigint_uint64 napi_create_bigint_words napi_create_buffer napi_create_buffer_copy napi_create_dataview napi_create_date napi_create_double napi_create_error napi_create_external napi_create_external_arraybuffer napi_create_external_buffer napi_create_function napi_create_int32 napi_create_int64 napi_create_object napi_create_promise napi_create_range_error napi_create_reference napi_create_string_latin1 napi_create_string_utf16 napi_create_string_utf8 napi_create_symbol napi_create_threadsafe_function napi_create_type_error napi_create_typedarray napi_create_uint32 napi_define_class napi_define_properties napi_delete_async_work napi_delete_element napi_delete_property napi_delete_reference napi_detach_arraybuffer napi_escape_handle napi_fatal_error napi_fatal_exception napi_get_all_property_names napi_get_and_clear_last_exception napi_get_array_length napi_get_arraybuffer_info napi_get_boolean napi_get_buffer_info napi_get_cb_info napi_get_dataview_info napi_get_date_value napi_get_element napi_get_global napi_get_instance_data napi_get_last_error_info napi_get_named_property napi_get_new_target napi_get_node_version napi_get_null napi_get_property napi_get_property_names napi_get_prototype napi_get_reference_value napi_get_threadsafe_function_context napi_get_typedarray_info napi_get_undefined napi_get_uv_event_loop napi_get_value_bigint_int64 napi_get_value_bigint_uint64 napi_get_value_bigint_words napi_get_value_bool napi_get_value_double napi_get_value_external napi_get_value_int32 napi_get_value_int64 napi_get_value_string_latin1 napi_get_value_string_utf16 napi_get_value_string_utf8 napi_get_value_uint32 napi_get_version napi_has_element napi_has_named_property napi_has_own_property napi_has_property napi_instanceof napi_is_array napi_is_arraybuffer napi_is_buffer napi_is_dataview napi_is_date napi_is_detached_arraybuffer napi_is_error napi_is_exception_pending napi_is_promise napi_is_typedarray napi_make_callback napi_module_register napi_new_instance napi_object_freeze napi_object_seal napi_open_callback_scope napi_open_escapable_handle_scope napi_open_handle_scope napi_queue_async_work napi_ref_threadsafe_function napi_reference_ref napi_reference_unref napi_reject_deferred napi_release_threadsafe_function napi_remove_async_cleanup_hook napi_remove_env_cleanup_hook napi_remove_wrap napi_resolve_deferred napi_run_script napi_set_element napi_set_instance_data napi_set_named_property napi_set_property napi_strict_equals napi_throw napi_throw_error napi_throw_range_error napi_throw_type_error napi_type_tag_object napi_typeof napi_unref_threadsafe_function napi_unwrap napi_wrap node_api_create_external_string_latin1 node_api_create_external_string_utf16 node_api_create_property_key_utf16 node_api_create_syntax_error node_api_get_module_file_name node_api_post_finalizer node_api_symbol_for node_api_throw_syntax_error uv_async_init uv_async_send uv_close uv_mutex_destroy uv_mutex_init uv_mutex_lock uv_mutex_unlock

Name

.text

Size

46.4MB

Virtual Size

46.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28.3MB

Virtual Size

28.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

233KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

223KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pedata

Size

25KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_986a5c6ef447a7a0cbd67da7558498f4_akira_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_quasar-rat_remcos_rusty-stealer_satacom_vidar_zxxz

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

shell32

gdi32

crypt32

ws2_32

advapi32

userenv

ntdll

winmm

psapi

ole32

dbghelp

bcrypt

oleaut32

generic