2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 23.2MB
Sample260730-eclhjssva1
SHA256 2f5474bb623e0167b477b6cce51563705df23bacd3f2b65e877bfff35de5d333
MD5 29703f9bd2ea7541d155cf18013d3463
SHA1 8866156d04af61615c056fa75a94482dc814ea5c
SHA512 b5f273f541cf9b95d07bca1645238b30bcfd9153035d41de3fee4ef3cba76747fff9c986b1cefe7454021be25cf709e41ce0833d7b91c95766b63977caa7282d
SSDEEP 393216:zqZCnLgPVPqmdBJAt6wRFCBLGxiArEP6mQ:zqdimdz+2
TLSH
T155378D4576F104A0C173D0788A4B4686E772B81B47349BDB349CB36C1F7BAF48A7AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 23.2MB

2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 091507ffd5237fa599e2262f31fd5c39
SHA256 2f5474bb623e0167b477b6cce51563705df23bacd3f2b65e877bfff35de5d333
MD5 29703f9bd2ea7541d155cf18013d3463
SHA1 8866156d04af61615c056fa75a94482dc814ea5c
SHA512 b5f273f541cf9b95d07bca1645238b30bcfd9153035d41de3fee4ef3cba76747fff9c986b1cefe7454021be25cf709e41ce0833d7b91c95766b63977caa7282d
SSDEEP 393216:zqZCnLgPVPqmdBJAt6wRFCBLGxiArEP6mQ:zqdimdz+2
TLSH
T155378D4576F104A0C173D0788A4B4686E772B81B47349BDB349CB36C1F7BAF48A7AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10856324

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\svc\hola_svc.exe.pdb

advapi32

SetEntriesInAclA GetSecurityInfo SetSecurityInfo SetNamedSecurityInfoW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateProcessAsUserW OpenProcessToken DuplicateTokenEx GetTokenInformation ConvertSidToStringSidW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx StartServiceW AllocateAndInitializeSid FreeSid LookupAccountSidW GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetKeySecurity RegSetValueExW SetEntriesInAclW AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExA RegQueryValueExA ReportEventA CryptAcquireContextA CryptReleaseContext CryptGenRandom RegEnumKeyExA DeregisterEventSource RegisterEventSourceA

ws2_32

WSASetLastError inet_addr ntohl GetAddrInfoW FreeAddrInfoW GetNameInfoW gethostbyname ntohs WSASendTo closesocket WSAIoctl WSASocketW __WSAFDIsSet accept WSARecvFrom WSASend gethostname htonl WSAGetLastError htons bind connect ioctlsocket getpeername getsockname getsockopt listen recv recvfrom select send sendto WSARecv WSADuplicateSocketW setsockopt WSAEventSelect WSACleanup WSAStartup socket shutdown

kernel32

GetCommandLineA CreatePipe SystemTimeToTzSpecificLocalTime GetDriveTypeW GetConsoleOutputCP SetFileAttributesW SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess EncodePointer GetStdHandle ReadFile FreeConsole GetProcessId WTSGetActiveConsoleSessionId GetSystemPowerStatus GetCurrentProcessId CreateFileW CloseHandle GetLastError DeviceIoControl GetOverlappedResult CreateEventW OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessImageFileNameW ReleaseMutex WaitForSingleObject CreateMutexW ProcessIdToSessionId HeapFree GetProcessHeap CopyFileW GetQueuedCompletionStatus PostQueuedCompletionStatus IsDebuggerPresent OutputDebugStringW GetProcAddress LoadLibraryW GetCommandLineW GetTempPathW RaiseException SetUnhandledExceptionFilter Sleep GetProcessTimes GetCurrentProcess TerminateProcess GetExitCodeProcess GlobalMemoryStatusEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent SwitchToThread GetCurrentThreadId TerminateThread DuplicateHandle QueueUserAPC GetCurrentThread SetConsoleCtrlHandler ExpandEnvironmentStringsW GetVersionExW ReadFileEx WriteFile WriteFileEx SetHandleInformation ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe SleepEx RtlCaptureStackBackTrace OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next Module32FirstW Module32NextW GetThreadTimes VirtualQuery GetModuleFileNameW LocalFree GetTickCount GetEnvironmentStringsW WaitForSingleObjectEx CreateProcessW FindClose FindFirstFileW FindNextFileW CreateNamedPipeW CancelIo VirtualAlloc VirtualProtect VirtualFree UnregisterWaitEx RegisterWaitForSingleObject SetErrorMode VirtualLock VirtualUnlock FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA GetVersionExA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InitializeConditionVariable IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead WakeConditionVariable WakeAllConditionVariable GetModuleHandleW GetSystemTimeAdjustment ReadConsoleA ConvertThreadToFiber ConvertFiberToThread FindNextFileA FindFirstFileA SleepConditionVariableCS ReleaseSemaphore CreateEventA TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA CreateFiber DeleteFiber SwitchToFiber InitializeCriticalSectionAndSpinCount GetModuleHandleExA CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetCPInfo IsValidCodePage GetACP GetTempFileNameA GetOEMCP FindFirstFileExW GetStringTypeW GetTimeZoneInformation QueryPerformanceFrequency SetThreadPriority GetThreadPriority QueryThreadCycleTime QueueUserWorkItem InitOnceExecuteOnce InitializeCriticalSectionEx LCMapStringEx DecodePointer GetQueuedCompletionStatusEx GetFileType CreateRemoteThread OpenFileMappingW WriteConsoleW FreeLibrary UnregisterWait WriteConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetWindowsDirectoryA ExpandEnvironmentStringsA SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryA GetModuleHandleA ReadDirectoryChangesW GetShortPathNameW GetLongPathNameW CreateSymbolicLinkW CreateHardLinkW MoveFileExW ReOpenFile SetFileTime SetFilePointerEx RemoveDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandle CreateDirectoryW LCMapStringW SetInformationJobObject AssignProcessToJobObject CreateJobObjectW CreateNamedPipeA CancelSynchronousIo CancelIoEx WaitNamedPipeW DebugBreak SetFileCompletionNotificationModes SetLastError FreeEnvironmentStringsW LoadLibraryExW GetNamedPipeHandleStateA GetStartupInfoW Process32Next Process32First SetConsoleTitleW GetConsoleTitleW FileTimeToSystemTime VerifyVersionInfoA GetProcessIoCounters GetPriorityClass SetPriorityClass GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW SetConsoleMode ReadConsoleInputW ReadConsoleW GetNumberOfConsoleInputEvents GetConsoleMode SetConsoleTextAttribute SetConsoleCursorInfo SetConsoleCursorPosition GetConsoleCursorInfo GetConsoleScreenBufferInfo CreateIoCompletionPort

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

powrprof

CallNtPowerInformation

fwpuclnt

FwpmFreeMemory0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmFilterAdd0 FwpmGetAppIdFromFileName0 FwpmEngineOpen0

rpcrt4

UuidCreate

shell32

SHGetFolderPathW CommandLineToArgvW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

iphlpapi

GetAdaptersInfo GetIpForwardTable GetExtendedTcpTable CancelIPChangeNotify NotifyRouteChange NhpAllocateAndGetInterfaceInfoFromStack ConvertInterfaceIndexToLuid GetAdaptersAddresses

psapi

GetModuleFileNameExW GetModuleInformation EnumProcesses EnumProcessModules GetProcessMemoryInfo

rasapi32

RasEnumEntriesW RasSetCredentialsW RasGetEntryPropertiesW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiCallClassInstaller CM_Get_DevNode_Status_Ex SetupDiSetClassInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInfoListDetailW SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeBeginPeriod timeGetTime timeEndPeriod

ole32

CoInitializeEx CoUninitialize CoCreateGuid

user32

MsgWaitForMultipleObjectsEx RegisterDeviceNotificationW UnregisterDeviceNotification SendMessageW FindWindowW SystemParametersInfoW EnumWindows GetWindowThreadProcessId GetLastInputInfo AttachThreadInput ShowWindow IsWindowVisible BringWindowToTop GetForegroundWindow SetForegroundWindow GetWindowTextW GetWindowTextLengthW MessageBoxA GetUserObjectInformationW GetProcessWindowStation MapVirtualKeyW DispatchMessageA TranslateMessage GetMessageA GetWindowRect GetMonitorInfoW MonitorFromRect GetWindowLongW GetDesktopWindow GetShellWindow GetClassNameW

ntdll

NtTestAlert NtFsControlFile RtlNtStatusToDosError NtQueryInformationProcess VerSetConditionMask NtCreateFile RtlInitUnicodeString NtQuerySystemInformation NtDeviceIoControlFile NtCreateSection RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx NtUnmapViewOfSection NtMapViewOfSection RtlUnwind

bcrypt

BCryptGenRandom

dbghelp

SymCleanup SymInitialize SymFromAddr UnDecorateSymbolName

napi_acquire_threadsafe_function napi_add_env_cleanup_hook napi_add_finalizer napi_adjust_external_memory napi_async_destroy napi_async_init napi_call_function napi_call_threadsafe_function napi_cancel_async_work napi_close_callback_scope napi_close_escapable_handle_scope napi_close_handle_scope napi_coerce_to_bool napi_coerce_to_number napi_coerce_to_object napi_coerce_to_string napi_create_array napi_create_array_with_length napi_create_arraybuffer napi_create_async_work napi_create_bigint_int64 napi_create_bigint_uint64 napi_create_bigint_words napi_create_buffer napi_create_buffer_copy napi_create_dataview napi_create_double napi_create_error napi_create_external napi_create_external_arraybuffer napi_create_external_buffer napi_create_function napi_create_int32 napi_create_int64 napi_create_object napi_create_promise napi_create_range_error napi_create_reference napi_create_string_latin1 napi_create_string_utf16 napi_create_string_utf8 napi_create_symbol napi_create_threadsafe_function napi_create_type_error napi_create_typedarray napi_create_uint32 napi_define_class napi_define_properties napi_delete_async_work napi_delete_element napi_delete_property napi_delete_reference napi_escape_handle napi_fatal_error napi_fatal_exception napi_get_and_clear_last_exception napi_get_array_length napi_get_arraybuffer_info napi_get_boolean napi_get_buffer_info napi_get_cb_info napi_get_dataview_info napi_get_element napi_get_global napi_get_last_error_info napi_get_named_property napi_get_new_target napi_get_node_version napi_get_null napi_get_property napi_get_property_names napi_get_prototype napi_get_reference_value napi_get_threadsafe_function_context napi_get_typedarray_info napi_get_undefined napi_get_uv_event_loop napi_get_value_bigint_int64 napi_get_value_bigint_uint64 napi_get_value_bigint_words napi_get_value_bool napi_get_value_double napi_get_value_external napi_get_value_int32 napi_get_value_int64 napi_get_value_string_latin1 napi_get_value_string_utf16 napi_get_value_string_utf8 napi_get_value_uint32 napi_get_version napi_has_element napi_has_named_property napi_has_own_property napi_has_property napi_instanceof napi_is_array napi_is_arraybuffer napi_is_buffer napi_is_dataview napi_is_error napi_is_exception_pending napi_is_promise napi_is_typedarray napi_make_callback napi_module_register napi_new_instance napi_open_callback_scope napi_open_escapable_handle_scope napi_open_handle_scope napi_queue_async_work napi_ref_threadsafe_function napi_reference_ref napi_reference_unref napi_reject_deferred napi_release_threadsafe_function napi_remove_env_cleanup_hook napi_remove_wrap napi_resolve_deferred napi_run_script napi_set_element napi_set_named_property napi_set_property napi_strict_equals napi_throw napi_throw_error napi_throw_range_error napi_throw_type_error napi_typeof napi_unref_threadsafe_function napi_unwrap napi_wrap

Name

.text

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.5MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

547KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_29703f9bd2ea7541d155cf18013d3463_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

advapi32

ws2_32

kernel32

userenv

powrprof

fwpuclnt

rpcrt4

shell32

wtsapi32

iphlpapi

psapi

rasapi32

setupapi

version

winmm

ole32

user32

ntdll

bcrypt

dbghelp

generic