2026-07-12_2753e187cb6aa9bcfb2374faa191d12a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_2753e187cb6aa9bcfb2374faa191d12a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 6.6MB
Sample260712-q9ebaaa16r
SHA256 ff2ca6b1bcc9488349f999debf1f23bdc548986f26595debf4e84149f0141192
MD5 2753e187cb6aa9bcfb2374faa191d12a
SHA1 d3f4232a1d316882e9af6f61d97a9001b4320335
SHA512 408009a6f0cab80484ea6ad70eccf959f3d1581b2ab31236faa3af7d3d7a930a7480f623945ea2752f9ee0d515800f669a1002ec20f25114d1280f01d457b22d
SSDEEP 98304:++efdv4akKu/v1sufznJbfzDDzL0DVlu6dZWj:+3dvvkKu/v1s6znJbf/DPWk6dZs
TLSH
T1F7669D46A7F501F4C2B6C038D5526227F6B278559330A7DB6BE84A2B0F637E09E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_2753e187cb6aa9bcfb2374faa191d12a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-07-12_2753e187cb6aa9bcfb2374faa191d12a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 6.6MB

2026-07-12_2753e187cb6aa9bcfb2374faa191d12a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH c0539c14e8bd5525f57ac147c27583cd
SHA256 ff2ca6b1bcc9488349f999debf1f23bdc548986f26595debf4e84149f0141192
MD5 2753e187cb6aa9bcfb2374faa191d12a
SHA1 d3f4232a1d316882e9af6f61d97a9001b4320335
SHA512 408009a6f0cab80484ea6ad70eccf959f3d1581b2ab31236faa3af7d3d7a930a7480f623945ea2752f9ee0d515800f669a1002ec20f25114d1280f01d457b22d
SSDEEP 98304:++efdv4akKu/v1sufznJbfzDDzL0DVlu6dZWj:+3dvvkKu/v1s6znJbf/DPWk6dZs
TLSH
T1F7669D46A7F501F4C2B6C038D5526227F6B278559330A7DB6BE84A2B0F637E09E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2623752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\joe\Desktop\my_tools\HACK_pubg_source_code\MEGA hk 4.3.3\x64\Release\meg 4.3.pdb

ws2_32

WSACleanup accept WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSASetLastError select getnameinfo __WSAFDIsSet inet_pton shutdown WSAStartup closesocket gethostname sendto recvfrom ntohl freeaddrinfo getaddrinfo ioctlsocket listen htonl socket send recv WSAGetLastError

wldap32

ord26 ord27 ord22 ord41 ord45 ord60 ord211 ord46 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143 ord50

crypt32

CertDuplicateCertificateContext CertGetCertificateContextProperty CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertAddCertificateContextToStore CryptStringToBinaryA CertFreeCertificateContext CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore

advapi32

CryptEnumProvidersW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CryptSignHashW CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CreateServiceA CloseServiceHandle OpenSCManagerA DeleteService ChangeServiceConfigA ControlService StartServiceA OpenServiceA ConvertSidToStringSidA OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW SetConsoleCtrlHandler GetTimeZoneInformation DeleteFileW HeapReAlloc CreateProcessW SetStdHandle HeapSize IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetEnvironmentVariableW SetConsoleMode ReadConsoleA FormatMessageW GetDateFormatW ReadProcessMemory ReadFile WriteFile PeekNamedPipe CreateFileW GetLastError CloseHandle GetCurrentProcessId WaitNamedPipeW lstrlenW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess SizeofResource WriteProcessMemory GetCurrentProcess TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW LockResource DeleteFileA Process32FirstW LoadResource FindResourceW VirtualProtectEx LocalFree GetExitCodeProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA CreateEventW LoadLibraryA GetProcAddress QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter SwitchToFiber SetConsoleTitleA GetStdHandle GetCurrentDirectoryA CreateFileA CreateThread GetConsoleWindow SetConsoleOutputCP VirtualAllocEx VirtualFreeEx VirtualQueryEx FreeConsole GetTimeFormatW FormatMessageA GetTickCount EnterCriticalSection LCMapStringW InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType WaitForMultipleObjects GetFileSizeEx RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx LCMapStringEx DecodePointer EncodePointer UnhandledExceptionFilter GetModuleHandleW GetSystemTimeAsFileTime GetFileInformationByHandleEx AreFileApisANSI SetFilePointerEx SetEndOfFile GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW SystemTimeToTzSpecificLocalTime HeapFree FlushFileBuffers HeapAlloc GetConsoleOutputCP FindNextFileW FindFirstFileExW FindClose GetDriveTypeW FreeLibraryAndExitThread ExitThread WriteConsoleW GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue ReadConsoleW GetConsoleMode TlsAlloc RaiseException RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentDirectoryW SleepConditionVariableSRW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCommandLineW GetCommandLineA LeaveCriticalSection FileTimeToSystemTime IsProcessorFeaturePresent SetUnhandledExceptionFilter SetLastError CompareStringW DeleteFiber CreateFiber LoadLibraryW ConvertFiberToThread ConvertThreadToFiber FindFirstFileW GetSystemTime SystemTimeToFileTime RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleTextAttribute RtlUnwind GetCurrentThreadId InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS

user32

MessageBoxW GetSystemMetrics GetClassNameA DispatchMessageW PeekMessageW EnumWindows TranslateMessage GetWindowLongW IsIconic GetWindowTextW GetKeyState ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow SetCapture SetForegroundWindow GetClientRect ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetWindowDisplayAffinity MessageBoxA GetCursorPos DefWindowProcW FindWindowExW GetWindowRect RegisterClassExW ShowWindow MoveWindow CreateWindowExA LoadIconW FindWindowW LoadCursorW SetWindowLongW UpdateWindow GetAsyncKeyState mouse_event SetCursor GetProcessWindowStation GetUserObjectInformationW BringWindowToTop

shell32

ShellExecuteA ShellExecuteExA ShellExecuteW

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateFontW D3DXCreateTextureFromFileInMemory

bcrypt

BCryptGenRandom

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

urlmon

URLDownloadToFileW URLDownloadToFileA

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=260, version=27412,

count=27, id=259, version=27412,

count=216, id=261, version=27412,

count=6, id=253, version=28518,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=4, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=101, id=261, version=30034,

count=29, id=257, version=27412,

count=404, id=1, productName=Unmarked objects,

count=23, productName=Unmarked objects (old),

count=668, id=260, productName=VS2019 v16.5.5 build 28614, version=28614,

count=1, id=259, productName=VS2019 v16.5.5 build 28614, version=28614,

count=33, id=261, productName=VS2019 v16.5.5 build 28614, version=28614,

count=33, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=258, version=30159,