2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260704-epe7asez7n
SHA256 f71e8a2edd8a10f9c768407404d7b9f571a6f573896eeb62448df607fc7655b8
MD5 a2be68f9970d3c4d294c5ed69dad63dc
SHA1 cff4177af7877f41bef173f0220fc3193f3d7b48
SHA512 8d7850502e6bf19760087adfc31f33575af62b08517e5bb00ad29e933633ce811222f99a1b84c1fd865272a1880e6b248a329ab01a91bb9d2568e7cd7d74ef9c
SSDEEP 24576:XNSB4EWeV/CGhVKvh7kXRIwb7opTO6iSnGpSBZ:XNsjheUi472TOjSnGp
TLSH
T189657C27B2A801E8D07BD278C55A9A07E7B1380613629BCF13E04A552FA77F15FBE351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar

File Explorer

2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar

IMPHASH b52e1008248e749a3a046611c72d4395
SHA256 f71e8a2edd8a10f9c768407404d7b9f571a6f573896eeb62448df607fc7655b8
MD5 a2be68f9970d3c4d294c5ed69dad63dc
SHA1 cff4177af7877f41bef173f0220fc3193f3d7b48
SHA512 8d7850502e6bf19760087adfc31f33575af62b08517e5bb00ad29e933633ce811222f99a1b84c1fd865272a1880e6b248a329ab01a91bb9d2568e7cd7d74ef9c
SSDEEP 24576:XNSB4EWeV/CGhVKvh7kXRIwb7opTO6iSnGpSBZ:XNsjheUi472TOjSnGp
TLSH
T189657C27B2A801E8D07BD278C55A9A07E7B1380613629BCF13E04A552FA77F15FBE351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

690784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Magpie\Magpie\publish\x64\Magpie.Core.pdb

kernel32

GetModuleHandleW DebugBreak IsDebuggerPresent SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetStdHandle GetDynamicTimeZoneInformation GlobalFree GlobalLock GlobalUnlock GlobalAlloc FreeLibrary TlsFree TlsSetValue HeapSetInformation CloseHandle OpenSemaphoreW WaitForSingleObjectEx TlsAlloc InitializeCriticalSectionAndSpinCount GetCurrentProcessId SetThreadpoolTimerEx GetProcessHeap CreateMutexExW HeapAlloc GetProcAddress SetCurrentDirectoryW SetEvent OutputDebugStringW GetLastError FormatMessageW CreateEventW RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GlobalAddAtomW GetModuleHandleA ReleaseMutex GetCurrentThreadId WaitForSingleObject GetModuleHandleExW ReleaseSemaphore SetProcessInformation GetCurrentProcess SetLastError HeapFree CreateSemaphoreExW TlsGetValue GetModuleFileNameA GetCPInfo CompareStringEx GetStringTypeW CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer GetSystemTimeAsFileTime WakeConditionVariable LCMapStringEx GetLocaleInfoEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetThreadId OpenProcess LoadLibraryExW CreateFile2 GetFileSize ReadFile WriteFile GetFileAttributesW CreateDirectoryW CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork LocalFree QueryFullProcessImageNameW K32GetModuleFileNameExW GetModuleFileNameW Sleep MultiByteToWideChar WideCharToMultiByte OpenMutexW CreateEventExW QueryPerformanceFrequency QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimerEx FindClose FindFirstFileExW DeleteFileW FindNextFileW GetFileInformationByHandleEx TryAcquireSRWLockExclusive SwitchToThread GetExitCodeThread WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 EnterCriticalSection LeaveCriticalSection

user32

CloseClipboard SetClipboardData GetClipboardData EmptyClipboard SetWindowDisplayAffinity GetDC GetIconInfo GetDCEx ReleaseDC ClipCursor MonitorFromRect SendMessageTimeoutW IsChild EnumWindows GetWindowRgn ChildWindowFromPointEx SystemParametersInfoW GetCursorInfo OpenClipboard SetCursorPos GetCursorPos GetMessageW DefWindowProcW PostMessageW SetProcessDpiAwarenessContext SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW RegisterClassExW DispatchMessageW TranslateMessage PostQuitMessage RegisterWindowMessageW SetForegroundWindow GetClipCursor SetWindowLongW PostThreadMessageW PeekMessageW MsgWaitForMultipleObjectsEx IsWindow GetForegroundWindow GetGUIThreadInfo GetWindowThreadProcessId WaitMessage DestroyWindow GetClassNameW GetWindowPlacement GetClientRect ClientToScreen MonitorFromWindow GetMonitorInfoW IntersectRect GetWindowRgnBox GetWindowRect OffsetRect AttachThreadInput BringWindowToTop ShowWindow LoadCursorW FindWindowW MonitorFromPoint AdjustWindowRectExForDpi SetWindowPos SetPropW ChangeWindowMessageFilterEx GetDpiForWindow SetLayeredWindowAttributes SendInput GetSystemMetricsForDpi GetPropW GetWindow RemovePropW ScreenToClient PtInRect GetWindowLongW UnionRect EnumDisplayMonitors GetSystemMetrics EnumChildWindows IsWindowVisible CallNextHookEx SetWindowsHookExW EnumDisplaySettingsW UnhookWindowsHookEx

advapi32

CheckTokenMembership SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid

shell32

CommandLineToArgvW ShellExecuteA SHGetKnownFolderPath SHQueryUserNotificationState

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathAllocCanonicalize

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv abort _set_app_type _beginthreadex terminate _cexit _invalid_parameter_noinfo_noreturn _crt_atexit _seh_filter_exe _initialize_onexit_table _register_onexit_function _errno

api-ms-win-crt-stdio-l1-1-0

_fseeki64 _get_stream_buffer_pointers _wfopen_s _fileno _filelength _fwrite_nolock _fsopen _wfsopen _filelengthi64 _set_fmode __stdio_common_vsprintf_s __acrt_iob_func fsetpos fgetc __p__commode ungetc fseek setvbuf __stdio_common_vswprintf _wfopen ftell __stdio_common_vfprintf __stdio_common_vsscanf fgetpos fputc fflush fclose __stdio_common_vsprintf fread fwrite

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtod strtof

api-ms-win-crt-string-l1-1-0

towlower islower strcmp _wcsdup iswspace isupper strcpy_s strcspn wcsnlen tolower __strncnt isdigit toupper isalnum isalpha isspace wcsncmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file rename remove _lock_file _stat64i32 _mkdir

api-ms-win-crt-locale-l1-1-0

_lock_locales _unlock_locales ___lc_locale_name_func setlocale ___lc_codepage_func localeconv ___mb_cur_max_func _configthreadlocale ___lc_collate_cp_func __pctype_func

api-ms-win-crt-heap-l1-1-0

free calloc malloc _callnewh _set_new_mode realloc

api-ms-win-crt-math-l1-1-0

pow acos log asin sinf atan2 cos cosh ceilf acosf sqrtf fmodf exp cosf floor log10 sin __setusermatherr log2f sinh sqrt tan _dsign lroundf _dclass lround tanh frexp atan

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmExtendFrameIntoClientArea DwmGetWindowAttribute

magnification

MagShowSystemCursor MagInitialize

dcomp

DCompositionCreateDevice3

gdi32

BitBlt GetObjectW GetDCOrgEx DeleteObject GetObjectType GetDIBits GetCurrentObject CreateRectRgn PtInRegion

ole32

CoCreateInstance CoInitializeEx CoCreateFreeThreadedMarshaler CoTaskMemFree

oleaut32

SetErrorInfo SysStringLen GetErrorInfo SysFreeString

coremessaging

CreateDispatcherQueueController

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

dxgi

CreateDXGIFactory2

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

d3dcompiler_47

D3DCreateBlob D3DCompile

api-ms-win-crt-time-l1-1-0

_gmtime64_s _localtime64_s _W_Getdays _W_Getmonths _Getdays _W_Gettnames _Wcsftime _Gettnames _Strftime _Getmonths

api-ms-win-crt-utility-l1-1-0

rand_s qsort

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_a2be68f9970d3c4d294c5ed69dad63dc_akira_cobalt-strike_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

api-ms-win-core-path-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

dwmapi

magnification

dcomp

gdi32

ole32

oleaut32

coremessaging

api-ms-win-mm-time-l1-1-0

dxgi

d3d11

d3dcompiler_47

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

imm32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

generic