2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom
Size 7.2MB
Sample260718-mapfesfz7k
SHA256 ae7473fbde213c54fe4401c3b9e9e9e4c90eaffca0d2f2b378acbb5138de8f63
MD5 da8657841fe3ba9666dc27b01057221c
SHA1 9c19f8610dc0ddcce66a3e5cab645200dc726cf4
SHA512 7167aec359cff0e0136967023ac603234f5a5d7bbfc0fd84c3ff33e035cd450004f96bfed4374750670c7505d4165accc153e688a25a3b79b70961cff682c447
SSDEEP 98304:GaWxsVbjRN9JUjvaI2bF9jIu1V0tYdeBZycj:Bukwil0afeBV
TLSH
T1F9767C13FA6147EFC01DC874D6E75B239622F849073362EB16C40D54FEEAAD06A293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

File Explorer

2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

.exe 7.2MB

2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

IMPHASH fb1590ccdd5d30a1612751c4eec74cb3
SHA256 ae7473fbde213c54fe4401c3b9e9e9e4c90eaffca0d2f2b378acbb5138de8f63
MD5 da8657841fe3ba9666dc27b01057221c
SHA1 9c19f8610dc0ddcce66a3e5cab645200dc726cf4
SHA512 7167aec359cff0e0136967023ac603234f5a5d7bbfc0fd84c3ff33e035cd450004f96bfed4374750670c7505d4165accc153e688a25a3b79b70961cff682c447
SSDEEP 98304:GaWxsVbjRN9JUjvaI2bF9jIu1V0tYdeBZycj:Bukwil0afeBV
TLSH
T1F9767C13FA6147EFC01DC874D6E75B239622F849073362EB16C40D54FEEAAD06A293B5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

157824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCKBLOCK_VPN_setup.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile NtOpenFile NtCreateNamedPipeFile

kernel32

CloseHandle WTSGetActiveConsoleSessionId SetFilePointerEx WaitForSingleObject FlushFileBuffers GetSystemTimePreciseAsFileTime GetLastError HeapSize AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW GetTempPathW DeleteFileW WriteFileEx SleepEx ReadFileEx ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateThread LCMapStringW GetExitCodeProcess CompareStringW GetConsoleOutputCP LoadLibraryExW VirtualProtect QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

wtsapi32

WTSQueryUserToken

advapi32

DuplicateTokenEx CreateProcessAsUserW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

user32

MessageBoxW

Name

.text

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_da8657841fe3ba9666dc27b01057221c_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

wtsapi32

advapi32

userenv

user32

generic