2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar
Size 15.2MB
Sample260802-jtyxeser9t
SHA256 7eadd550b59235d5eb78564ed4fe6551187c16ff71aee1125aac8f8b12222a39
MD5 cdcd4802b6ec6a4ae26dd902e8dc89dc
SHA1 e753479fa38440beb9ca1369b52a11b868220405
SHA512 00e1cd219a41997fb0c347342a45725fe2fdfc76a1c190da0243cc56fa5763404f869d15cefcba8c81f03a1886f1cb5e02a285517ce4463a372b6d67fab996da
SSDEEP 196608:+EUlKfqbJeRhb5E7cRGo8sOgZo0aHqaEttjez1w5T2bZSf1A9KMV583opoVop:WwibJejRaEtAzhbZWsH58Lu
TLSH
T19FF69D02BA9A59EAD19DC870C3474B678F2274CB0636F5BF46C402292F6E7B51F2D316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

File Explorer

2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

.exe 15.2MB

2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

IMPHASH f93f92c2681386f0e7e4a953e1ed1acd
SHA256 7eadd550b59235d5eb78564ed4fe6551187c16ff71aee1125aac8f8b12222a39
MD5 cdcd4802b6ec6a4ae26dd902e8dc89dc
SHA1 e753479fa38440beb9ca1369b52a11b868220405
SHA512 00e1cd219a41997fb0c347342a45725fe2fdfc76a1c190da0243cc56fa5763404f869d15cefcba8c81f03a1886f1cb5e02a285517ce4463a372b6d67fab996da
SSDEEP 196608:+EUlKfqbJeRhb5E7cRGo8sOgZo0aHqaEttjez1w5T2bZSf1A9KMV583opoVop:WwibJejRaEtAzhbZWsH58Lu
TLSH
T19FF69D02BA9A59EAD19DC870C3474B678F2274CB0636F5BF46C402292F6E7B51F2D316
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

9b:c6:a3:81:c3:16:f8:81:26:71:5a:39:1b:0e:69:48:e2:20:27:f9:c7:44:70:ec:da:a4:28:ac:0b:54:dc:56:9a:15:ef:7b:fb:df:cf:86:26:32:f7:33:30:b9:be:98:cb:56:fd:64:86:59:ac:89:c7:b7:fb:ac:9c:4d:76:50

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Chains

Apr 15, 2026

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Serial Number

07:07:0c:f5:87:35:7d:2e:04:24:0b:d1:80:69:12:55

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 2, 2025 - Jun 1, 2026

Subject

CN=DigiCert SHA512 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

08:19:75:fe:89:b4:fb:30:4b:13:80:77:d2:d3:fe:42

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7512568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SelfExtractable.pdb

bcryptprimitives

ProcessPrng

kernel32

TerminateProcess GetExitCodeProcess GetModuleHandleA GetNativeSystemInfo GetSystemInfo LCMapStringEx CreateDirectoryW GetFileAttributesW FindFirstFileW RemoveDirectoryW GetDiskFreeSpaceExA CreateMutexW Sleep WaitForSingleObject SetWaitableTimer LocalFree GetFinalPathNameByHandleW DuplicateHandle GetStringTypeW TryEnterCriticalSection InitializeSListHead GetQueuedCompletionStatusEx SetUnhandledExceptionFilter UnhandledExceptionFilter CreateWaitableTimerExW GetStdHandle GetConsoleMode GetConsoleOutputCP SystemTimeToTzSpecificLocalTime WriteConsoleW SetFileInformationByHandle GetFullPathNameW FindFirstFileExW CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx SetEndOfFile SetFilePointerEx GetModuleHandleW FormatMessageW ReadConsoleW GetTempPathW DeleteFileW GetFileAttributesExW CopyFileExW CreateThread WriteFileEx SleepEx ReadFileEx WaitForMultipleObjects GetOverlappedResult CreateEventW CancelIo ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW FindNextFileW PostQueuedCompletionStatus SetConsoleCtrlHandler CreateIoCompletionPort CreateEventA RemoveVectoredExceptionHandler MoveFileExW GlobalFree GetFileSizeEx FlushFileBuffers LoadLibraryExA WriteFile ExitProcess PeekNamedPipe GetDriveTypeW GetFileType RtlPcToFileHeader OutputDebugStringW EncodePointer SetThreadStackGuarantee GetCPInfo AcquireSRWLockExclusive SetEnvironmentVariableW CompareStringOrdinal SetCurrentDirectoryW ReleaseSRWLockExclusive InitializeSRWLock GetStartupInfoW IsDebuggerPresent ResetEvent IsProcessorFeaturePresent RtlUnwindEx GetModuleHandleExW GetSystemTimePreciseAsFileTime GetCommandLineA CompareStringW LCMapStringW GetLocaleInfoW FindClose IsValidLocale GetUserDefaultLCID InitOnceExecuteOnce UnregisterWait RegisterWaitForSingleObject EnumSystemLocalesW GetTimeZoneInformation TlsFree TlsSetValue AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc GlobalLock GlobalUnlock TlsGetValue TlsAlloc FormatMessageA GetLastError LoadLibraryExW FreeLibrary GetSystemDefaultLangID HeapAlloc GetProcAddress GetCurrentThreadId UnmapViewOfFile CreateFileMappingW VirtualProtect MapViewOfFile WideCharToMultiByte GetCurrentDirectoryW MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetUserPreferredUILanguages IsValidCodePage SetThreadErrorMode GlobalSize GetModuleFileNameW GlobalAlloc CloseHandle GetCurrentProcess ReleaseMutex GetCurrentThread RtlCaptureContext SetStdHandle RtlUnwind GetACP LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindVolumeClose GetVolumeInformationA DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLogicalDriveStringsA FindFirstVolumeA FileTimeToSystemTime ExpandEnvironmentStringsA InitializeCriticalSectionEx GetSystemTimeAsFileTime FileTimeToLocalFileTime GetOEMCP SwitchToThread GetTimeZoneInformationForYear lstrlenW HeapDestroy HeapSize GetSystemFirmwareTable SetLastError SetEvent RtlLookupFunctionEntry SetCurrentDirectoryA GetCurrentDirectoryA FindFirstFileA FindNextFileA CreateProcessA GetModuleFileNameA GetStartupInfoA LoadLibraryA GetDateFormatW GetTimeFormatW CopyFileW FindResourceW SizeofResource LockResource WaitForSingleObjectEx CreateMutexA GetCurrentProcessId RtlVirtualUnwind CreateDirectoryA GetFileAttributesA FindResourceExW LoadResource

user32

GetWindowLongPtrW PostMessageW SetWindowTextW CloseClipboard InvalidateRgn GetMonitorInfoW CloseTouchInputHandle MonitorFromRect GetTouchInputInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData PostThreadMessageW SetCapture ScreenToClient PeekMessageW GetKeyboardLayout MsgWaitForMultipleObjectsEx GetKeyState TrackMouseEvent IsWindowVisible MapVirtualKeyA MonitorFromWindow DefWindowProcW GetSystemMetrics GetCursorPos ToUnicodeEx ChangeDisplaySettingsExW RegisterTouchWindow GetUpdateRect RedrawWindow GetRawInputData IsProcessDPIAware DestroyWindow SetWindowDisplayAffinity CreateWindowExW MonitorFromPoint RegisterRawInputDevices RegisterClassExW ValidateRect GetDC ReleaseCapture GetActiveWindow SetWindowLongPtrW GetMessageW GetKeyboardState MapVirtualKeyW GetMenu TranslateMessage DispatchMessageW GetWindowPlacement SystemParametersInfoA SetForegroundWindow IsIconic ShowCursor GetWindowRect ClipCursor GetClipCursor SetWindowPlacement SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow AdjustWindowRectEx GetWindowLongW RegisterWindowMessageA SendInput LoadCursorW SetCursor MessageBoxW SetWindowPos FlashWindowEx ClientToScreen DestroyIcon CreateIcon GetClientRect GetForegroundWindow

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA QueryServiceStatusEx RegEnumValueW OpenSCManagerA CloseServiceHandle RegQueryValueExA RegOpenKeyExA SystemFunction036 GetLengthSid SetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW DeregisterEventSource ReportEventW RegEnumKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW InitiateSystemShutdownW OpenServiceA RegisterEventSourceW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegDeleteKeyExW RegCloseKey RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryValueExW GetUserNameW EqualSid AllocateAndInitializeSid FreeSid

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ntdll

NtReadFile NtWriteFile NtDeviceIoControlFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile

oleaut32

SysAllocString SafeArrayCreate SysAllocStringLen SafeArrayGetUBound SysFreeString VariantClear VariantInit SafeArrayPutElement SafeArrayGetElement SafeArrayGetLBound GetErrorInfo SysStringLen

shlwapi

AssocQueryStringW

gdi32

CreateRectRgn GetDeviceCaps DeleteObject StretchDIBits

wintrust

WinVerifyTrust

ole32

CoCreateGuid RegisterDragDrop RevokeDragDrop OleInitialize CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmAssociateContextEx ImmGetContext

dwmapi

DwmEnableBlurBehindWindow

shell32

DragQueryFileW SHFileOperationA DragFinish SHFileOperationW

bcrypt

BCryptGenRandom

d3dcompiler_47

D3DCompile

uxtheme

SetWindowTheme

ws2_32

inet_ntop getaddrinfo WSAStartup WSACleanup freeaddrinfo getnameinfo

iphlpapi

GetAdaptersAddresses GetIpInterfaceEntry CancelMibChangeNotify2 NotifyIpInterfaceChange

??0CMTRedfishCRUDOperation@@QEAA@AEBV0@@Z ??0CMTRedfishCRUDOperation@@QEAA@XZ ??0DSMIPMIInterfaceImpl@@QEAA@XZ ??1CMTRedfishCRUDOperation@@QEAA@XZ ??1DSMIPMIInterfaceImpl@@UEAA@XZ ??4CMTRedfishCRUDOperation@@QEAAAEAV0@AEBV0@@Z ??4DSMIPMIInterfaceImpl@@QEAAAEAV0@AEBV0@@Z ??_7DSMIPMIInterfaceImpl@@6B@ ?AddAuthInfo@CMTRedfishCRUDOperation@@AEAAXPEAUICMTRedfishOAuthMethod@@AEAUCMTRedfishConnection@@@Z ?AddSocketInfo@CMTRedfishCRUDOperation@@AEAAXAEAUCMTRedfishConnection@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H1@Z ?CreateRedfishBasicAuthIF@API_CMT_REDFISH@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PEAPEAUICMTRedfishBasicAuthMethod@@@Z ?CreateRedfishCRUDInterfaceObj@CMTRedfishCRUDOperation@@AEAAPEAVICMTRedfishCRUDInterface@@W4CMT_REDFISH_URL_CALL_TYPE@@@Z ?CreateRedfishInventoryIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSoftwareInventory@@@Z ?CreateRedfishOAuthAuthIF@API_CMT_REDFISH@@YAHPEAPEAUICMTRedfishOAuthMethod@@@Z ?CreateRedfishSystemActionIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSystemAction@@@Z ?CreateRedfishSystemInfoIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSystemInfo@@@Z ?CreateRedfishUpdateIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSoftwareUpdate@@@Z ?CreateUsbnicInterface@API_CMT_REDFISH@@YAHPEAPEAUICMTUsbnicInterface@@@Z ?ExecuteRedfishCall@CMTRedfishCRUDOperation@@QEAAHW4CMT_REDFISH_URL_CALL_TYPE@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV34@11@Z ?Finalize@API_CMT_REDFISH@@YAHXZ ?FinalizeRedfishInterface@CMTRedfishCRUDOperation@@AEAAXXZ ?GetConnectedBMCType@CMTRedfishCRUDOperation@@QEAA?AW4CMT_BMC_TYPES@@XZ ?GetSystemGeneration@API_CMT_REDFISH@@YAHXZ ?IPMIRequest@DSMIPMIInterfaceImpl@@QEAAIPEAU_DSMIPMICommandData@@@Z ?Initialize@API_CMT_REDFISH@@YAHAEBUCMTRedfishLibInitParam@@@Z ?Initialize@DSMIPMIInterfaceImpl@@QEAAIPEBU_DSMIPMIConfiguration@@@Z ?Initialize@DSMIPMIInterfaceImpl@@QEAAIVDSMString@@@Z ?InitializeDSMLogger@DSMIPMIInterfaceImpl@@AEAAXXZ ?InitializeRedfishInterface@CMTRedfishCRUDOperation@@AEAAHXZ ?Release@DSMIPMIInterfaceImpl@@QEAAIXZ ?SetBMCType@CMTRedfishCRUDOperation@@AEAAHAEAW4CMT_BMC_TYPES@@@Z ?USBNicInterfaceDisable@CMTRedfishCRUDOperation@@AEAAHPEAUICMTUsbnicInterface@@@Z ?USBNicInterfaceEnable@CMTRedfishCRUDOperation@@AEAAHPEAUICMTUsbnicInterface@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAH1@Z ?freePMInfo@@YAHPEAUPMInfo@@@Z ?getHttpStatus@CMTRedfishCRUDOperation@@QEAAHXZ ?getPMInfo@@YAHHPEAPEAUPMInfo@@@Z ?getPMStatus@@YAHXZ ?getResponseBody@CMTRedfishCRUDOperation@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getResponseHeader@CMTRedfishCRUDOperation@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getTestPMInfo@@YAHHPEAPEAUPMInfo@@@Z get_redfish_pm_details

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_cdcd4802b6ec6a4ae26dd902e8dc89dc_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

bcryptprimitives

kernel32

user32

advapi32

api-ms-win-core-synch-l1-2-0

version

ntdll

oleaut32

shlwapi

gdi32

wintrust

ole32

winmm

imm32

dwmapi

shell32

bcrypt

d3dcompiler_47

uxtheme

ws2_32

iphlpapi

generic