2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 9.4MB
Sample260709-pf8scsa181
SHA256 bce600fa02918b9cf35b10df80e00a9260bbd594a9f1d78f57fd63f27497eaf3
MD5 b61e5492fd2df8688bf181809d925734
SHA1 a5a9119016aa4c295d0b2f014c2acff92c4c0e1d
SHA512 b1afc2fad815f170b3cbcc42b7bec16debfe6276e2e6e22a232968fcaedebbd339e2bef9cf625ebd2f59b881396041db012437ec42960cea3c6d1fdb5e98ab33
SSDEEP 98304:QmgJbfhHqjaModHF8+xe8pNSmDToXzQr2OGTUzSAA:fgJbJyVmHF9s8rQUz
TLSH
T12FA6191F135991AEC076E27DE9021F80E17E7C0647615ADB039039FA6D7FAE88F79620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 9.4MB

2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH e05665cbea28e53be015056a99ed952c
SHA256 bce600fa02918b9cf35b10df80e00a9260bbd594a9f1d78f57fd63f27497eaf3
MD5 b61e5492fd2df8688bf181809d925734
SHA1 a5a9119016aa4c295d0b2f014c2acff92c4c0e1d
SHA512 b1afc2fad815f170b3cbcc42b7bec16debfe6276e2e6e22a232968fcaedebbd339e2bef9cf625ebd2f59b881396041db012437ec42960cea3c6d1fdb5e98ab33
SSDEEP 98304:QmgJbfhHqjaModHF8+xe8pNSmDToXzQr2OGTUzSAA:fgJbJyVmHF9s8rQUz
TLSH
T12FA6191F135991AEC076E27DE9021F80E17E7C0647615ADB039039FA6D7FAE88F79620
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4115440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\jenkins\workspace\uto-update_release_PDFY24FEB_1.0\target\Windows\x64\symbols\Release\AdskAccessServiceHost.pdb

msi

ord173 ord217

shlwapi

PathFileExistsW PathRemoveFileSpecW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSOpenServerW WTSCloseServer WTSQueryUserToken

secur32

LsaGetLogonSessionData LsaEnumerateLogonSessions LsaFreeReturnBuffer

kernel32

CreateThread SetConsoleCtrlHandler GetExitCodeProcess MultiByteToWideChar GetProcAddress LoadLibraryA GetModuleFileNameA GetSystemTime SystemTimeToFileTime AreFileApisANSI CreateFileA ReadFile WriteFile GetSystemDirectoryW SetHandleInformation SetUnhandledExceptionFilter CreatePipe GetProcessTimes GetCurrentProcess TerminateProcess GetCurrentThreadId TlsAlloc TlsFree CreateProcessW FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessA LoadLibraryExW OpenProcess GetModuleHandleW AddDllDirectory LoadLibraryW GlobalAlloc GlobalFree lstrcpyW QueryFullProcessImageNameW SetDllDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW CreateFileW GetFileAttributesExW GetFileSize InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared CreateEventA WaitForSingleObjectEx CreateMutexA ReleaseMutex GetSystemInfo GetEnvironmentStrings FreeEnvironmentStringsA PostQueuedCompletionStatus OpenMutexA QueryPerformanceCounter QueryPerformanceFrequency ResetEvent ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer CreateEventW ResumeThread TlsGetValue TlsSetValue GetLogicalProcessorInformation GetModuleHandleA CreateWaitableTimerA GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl GetWindowsDirectoryW CreateDirectoryExW CopyFileExW MoveFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW ConnectNamedPipe DisconnectNamedPipe GetOverlappedResult CancelIo CreateNamedPipeA WaitNamedPipeA LockFileEx UnlockFileEx PeekNamedPipe SetLastError GetCurrentThread GetThreadTimes CreateSymbolicLinkW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread InterlockedFlushSList WaitForSingleObject SetEvent CloseHandle InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId RtlCaptureStackBackTrace WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer EnumSystemLocalesW GetFileType GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP GetConsoleMode ReadConsoleW HeapQueryInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitializeCriticalSectionAndSpinCount OutputDebugStringW IsDebuggerPresent GetOEMCP SetEnvironmentVariableW SetStdHandle WriteConsoleW Sleep RtlUnwind GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx SwitchToThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent GetStringTypeW SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx EncodePointer

user32

EnumWindows ExitWindowsEx GetWindowThreadProcessId UnregisterClassW GetShellWindow

shell32

ord51 ShellExecuteExW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize

advapi32

CreateProcessWithTokenW SetServiceStatus StartServiceCtrlDispatcherW CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser CryptGenRandom CryptReleaseContext CryptAcquireContextA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW ConvertSidToStringSidW RegisterServiceCtrlHandlerW LookupPrivilegeValueW LookupAccountSidW GetTokenInformation FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RevertToSelf

dbgeng

DebugCreate

ws2_32

WSAStartup WSACleanup

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

wintrust

WinVerifyTrust

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CryptQueryObject CryptMsgClose

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

564KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

397KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_b61e5492fd2df8688bf181809d925734_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

msi

shlwapi

userenv

wtsapi32

secur32

kernel32

user32

shell32

ole32

advapi32

dbgeng

ws2_32

bcrypt

wintrust

crypt32

version

generic