2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat
Size 35.7MB
Sample260727-bqds3stfka
SHA256 d38348722bbde0a0fe9f5ebe755a58c854fed156da0d7a6db7a6c346cc6cf93e
MD5 e5f0fedcad7c6bce2c620914b39fb785
SHA1 da72f897ea2dcd33dbf1925f61355b5d275f225c
SHA512 e93e3bda3fcfa4995d04ca4ed3588d61973b911798c66ca3a98b425b80a668590c0572f5acf818f5dac315bc9be0a982ff0d7ffef7ddefbbe4f657eae302082b
SSDEEP 786432:PK+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLo5S31gDjb07w:PgXGMK4XR3bLSCU/+6yPlo5SSDjb8w
TLSH
T164873312F1D801E9F1729538D162C357FA61B09B47729DFB42A403A35D27FC06E3ABA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat

.exe 35.7MB
entry_patched.pyc

271B

2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat

IMPHASH f2d964aa25498e18e15d94df66a6dca5
SHA256 d38348722bbde0a0fe9f5ebe755a58c854fed156da0d7a6db7a6c346cc6cf93e
MD5 e5f0fedcad7c6bce2c620914b39fb785
SHA1 da72f897ea2dcd33dbf1925f61355b5d275f225c
SHA512 e93e3bda3fcfa4995d04ca4ed3588d61973b911798c66ca3a98b425b80a668590c0572f5acf818f5dac315bc9be0a982ff0d7ffef7ddefbbe4f657eae302082b
SSDEEP 786432:PK+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLo5S31gDjb07w:PgXGMK4XR3bLSCU/+6yPlo5SSDjb8w
TLSH
T164873312F1D801E9F1729538D162C357FA61B09B47729DFB42A403A35D27FC06E3ABA9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CreateFileMappingA CreateFileW CreateProcessW CreateToolhelp32Snapshot DeleteFileW DuplicateHandle FormatMessageW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetTempPathW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteConsoleW WriteFile DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtWriteFile RtlNtStatusToDosError

user32

MessageBoxW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

Name

.text

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35.5MB

Virtual Size

35.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_e5f0fedcad7c6bce2c620914b39fb785_akira_cobalt-strike_glassworm_icedid_njrat

kernel32

ntdll

user32

api-ms-win-core-synch-l1-2-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

entry_patched.pyc