2026-07-20_73254142346e21534287ce3157a6c7c7_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_73254142346e21534287ce3157a6c7c7_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom
Size 11.9MB
Sample260720-qcbtwsa17m
SHA256 cccf17d3a9f5c49c8a1058039c24ec0c8ea0a9a88344a4df8c744e1e2e2d5ff2
MD5 73254142346e21534287ce3157a6c7c7
SHA1 dc950e0cfa29e67db37757776e9ecb7d208f124d
SHA512 1866f6b5effe8f2d18978fff74ef5ad29052e28f0e86e21592c2813d67609cf888fac3f7b88cb561a4dc847b60cceb12e2f1a88b30c67f445b9c240da4f035eb
SSDEEP 98304:Sh+Gco1pKsPW3sSJZswgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdoJ:ivr1I2Wcq1jj7UlG8drCeqBvKCzcL2J
TLSH
T1E2C65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_73254142346e21534287ce3157a6c7c7_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

File Explorer

2026-07-20_73254142346e21534287ce3157a6c7c7_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

.exe 11.9MB

2026-07-20_73254142346e21534287ce3157a6c7c7_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

IMPHASH 23f526e72cd3a35734f0838ba2ae34a7
SHA256 cccf17d3a9f5c49c8a1058039c24ec0c8ea0a9a88344a4df8c744e1e2e2d5ff2
MD5 73254142346e21534287ce3157a6c7c7
SHA1 dc950e0cfa29e67db37757776e9ecb7d208f124d
SHA512 1866f6b5effe8f2d18978fff74ef5ad29052e28f0e86e21592c2813d67609cf888fac3f7b88cb561a4dc847b60cceb12e2f1a88b30c67f445b9c240da4f035eb
SSDEEP 98304:Sh+Gco1pKsPW3sSJZswgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdoJ:ivr1I2Wcq1jj7UlG8drCeqBvKCzcL2J
TLSH
T1E2C65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5228752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\AdobeCollabSync.pdb

shlwapi

UrlIsW StrCmpNW PathFindFileNameW UrlCanonicalizeA StrCmpNA PathRemoveFileSpecW PathCreateFromUrlW

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore CryptProtectData CertFreeCertificateContext CryptUnprotectData

msi

ord205 ord70

kernel32

GetOverlappedResult WaitForMultipleObjects WaitNamedPipeW OpenProcess GetTempPathW GetCommandLineW GetCurrentThreadId DeleteFileA GetTempPathA DuplicateHandle CreateThread CreateProcessW GetThreadId lstrcatA GetEnvironmentStringsW FreeEnvironmentStringsW CreateDirectoryW ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject VerifyVersionInfoA GetFileType OpenEventA ConnectNamedPipe GetWindowsDirectoryW SetWaitableTimer ResumeThread TerminateProcess GetCurrentProcessId HeapSetInformation FindResourceA SizeofResource CreateNamedPipeW DeviceIoControl GetFileSize GetFileAttributesExW SetFileAttributesW GlobalFree LockResource LoadResource GetModuleHandleExA WideCharToMultiByte FormatMessageW FormatMessageA GetVersionExW CreateEventA GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy VerifyVersionInfoW LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetSystemDirectoryW GetExitCodeProcess GetCurrentProcess QueryDosDeviceW GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW VerSetConditionMask QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetModuleHandleExW GetModuleFileNameW CreateWaitableTimerA GetThreadErrorMode CreateEventW GlobalAlloc WaitForSingleObject ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError DecodePointer OutputDebugStringW OutputDebugStringA SetThreadErrorMode PostQueuedCompletionStatus TerminateThread lstrlenW GetTickCount Sleep OpenMutexW SetNamedPipeHandleState GetLastError CloseHandle GetStringTypeW WriteFile ReadFile GetVolumeInformationW CreateFileW QueueUserWorkItem SleepConditionVariableCS InitializeConditionVariable WaitForThreadpoolWorkCallbacks SetThreadpoolThreadMinimum DisconnectNamedPipe SetThreadpoolThreadMaximum K32GetProcessMemoryInfo GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread CreateFiberEx QueueUserAPC CloseThreadpoolWork GetProcessTimes AreFileApisANSI DeleteFiber SwitchToFiber RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA ReleaseSemaphore SwitchToThread DeleteFileW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointer MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetSystemTimeAsFileTime GetLocalTime FileTimeToSystemTime RemoveDirectoryW MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetSystemDirectoryA LoadLibraryA lstrlenA GetModuleHandleA FindCloseChangeNotification FindResourceExW FindResourceW GetTimeZoneInformation GetUserDefaultUILanguage CreateFileA ReadDirectoryChangesW FindFirstChangeNotificationW FindNextChangeNotification GetDriveTypeA WaitForSingleObjectEx PeekNamedPipe CancelIoEx WaitForMultipleObjectsEx CreateNamedPipeA LoadLibraryExW GetUserDefaultLCID GetStdHandle GetFileAttributesA GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetExitCodeThread GetNativeSystemInfo CloseThreadpool QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread WriteConsoleW ExitProcess GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadConsoleW SetConsoleCtrlHandler MoveFileExW SetStdHandle FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW VirtualFree GetEnvironmentVariableW AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock SystemTimeToTzSpecificLocalTime RtlUnwind InitOnceComplete InitOnceBeginInitialize CreateIoCompletionPort SleepEx GetQueuedCompletionStatus CreateWaitableTimerW SystemTimeToFileTime CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CreateThreadpool

user32

LoadStringW SendMessageTimeoutW SetWindowPos SetForegroundWindow GetWindowRect GetDesktopWindow FindWindowW GetClassNameW GetWindowThreadProcessId GetActiveWindow TranslateMessage BringWindowToTop PostMessageW GetClassNameA IsHungAppWindow LoadImageW GetCursorPos GetPropW SetPropW InsertMenuItemW TrackPopupMenu InsertMenuW DestroyMenu CreatePopupMenu DestroyWindow CreateWindowExW RegisterClassW CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA GetSystemMetrics EnumWindows IsWindowVisible ShowWindowAsync IsWindow AttachThreadInput KillTimer SetTimer GetMessageA GetForegroundWindow DispatchMessageA GetUserObjectInformationW EnumDesktopWindows GetProcessWindowStation MessageBoxW PeekMessageA MsgWaitForMultipleObjects SendMessageA FindWindowA

winspool.drv

UploadPrinterDriverPackageW

advapi32

CryptDecrypt CryptImportKey OpenThreadToken ConvertSidToStringSidA CryptHashData CryptGetHashParam RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptEnumProvidersA CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW RegEnumKeyExW RegQueryValueExA OpenProcessToken RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetTokenInformation GetLengthSid DuplicateTokenEx RegDeleteTreeW RegCreateKeyA ConvertStringSecurityDescriptorToSecurityDescriptorA TreeSetNamedSecurityInfoW GetNamedSecurityInfoW RegSetValueExA RegOpenKeyExA RegCreateKeyExA GetSidSubAuthorityCount GetSidSubAuthority GetSecurityDescriptorSacl GetAclInformation GetAce CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW GetTokenInformation

shell32

SHQueryUserNotificationState SHGetSpecialFolderLocation SHGetPathFromIDListW SHFileOperationA ShellExecuteExA ShellExecuteA SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW Shell_NotifyIconW SHCreateDirectoryExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

sensapi

IsNetworkAlive

urlmon

URLDownloadToFileA

psapi

GetModuleFileNameExA GetProcessImageFileNameW

ws2_32

bind connect listen recv select WSAIoctl socket GetAddrInfoW FreeAddrInfoW __WSAFDIsSet WSAEventSelect getservbyname setsockopt ioctlsocket freeaddrinfo htons htonl shutdown WSACreateEvent WSAGetLastError WSACleanup WSAStartup accept WSASocketA getsockopt gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport send WSASend ntohl WSASetLastError WSASocketW getaddrinfo getpeername getsockname ntohs WSAAddressToStringW WSARecv closesocket

wininet

InternetSetCookieExA InternetReadFile InternetWriteFile InternetSetOptionA HttpSendRequestExA HttpEndRequestA HttpAddRequestHeadersA DetectAutoProxyUrl HttpSendRequestA InternetCrackUrlA InternetOpenA InternetConnectA HttpOpenRequestA HttpQueryInfoA InternetCloseHandle

mpr

WNetGetResourceInformationW WNetGetConnectionW WNetAddConnection2W WNetCancelConnection2W

api-ms-win-core-path-l1-1-0

PathCchAppend PathCchAddBackslash

oleaut32

SysAllocString SafeArrayDestroy SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SysFreeString

netapi32

NetShareGetInfo

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpGetProxyForUrl WinHttpCrackUrl

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=261, version=29920,

count=12, id=259, version=27412,

count=221, id=261, version=27412,

count=1, id=253, version=33030,

count=19, id=260, version=33030,

count=20, id=259, version=33030,

count=198, id=265, version=33133,

count=11, id=260, version=33133,

count=112, id=261, version=33030,

count=31, id=260, version=27412,

count=1, id=262, version=27412,

count=762, id=260, version=29920,

count=32, productName=Unmarked objects (old),

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=257, version=27412,

count=632, id=1, productName=Unmarked objects,

count=257, id=261, version=33133,

count=1, id=256, version=33133,

count=1, id=255, version=33133,

count=2, id=151,

count=1, id=258, version=33133,