2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar
Size 5.8MB
Sample260804-j7e2gavdkf
SHA256 b05fa4c13b1fde43bc14a0cb8c36ad6e57cdfcf32d9324e6416a04c0d9375033
MD5 1379f08f16c7c5f6c83150653ae453b6
SHA1 fb2a8b6826c09c2b8ac39f421db71b339d08b025
SHA512 9830e98589c7fd8770038fc1fe557fd1e3bc3ef6433a2d9636f66b65e465903bd2d37a85b48f40ee93550c5c179993792c1deeaf7d8ea12d20e997d9ad337fea
SSDEEP 49152:9BQ2qomrAmdFkTRKiijRSfaweALlP87hLkWaN6+bNXp0+mVITCtElnrsByct43Md:cx/R2qVIK43MKFBKiH0BCm+/qRUf
TLSH
T1F756D51125DA9FDCC04FA474CE0669A16A237C868F61AFDF19807E253E756B46F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

File Explorer

2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

.exe 5.8MB

2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

IMPHASH 53c4160a3dd2113028bc83719f3e2159
SHA256 b05fa4c13b1fde43bc14a0cb8c36ad6e57cdfcf32d9324e6416a04c0d9375033
MD5 1379f08f16c7c5f6c83150653ae453b6
SHA1 fb2a8b6826c09c2b8ac39f421db71b339d08b025
SHA512 9830e98589c7fd8770038fc1fe557fd1e3bc3ef6433a2d9636f66b65e465903bd2d37a85b48f40ee93550c5c179993792c1deeaf7d8ea12d20e997d9ad337fea
SSDEEP 49152:9BQ2qomrAmdFkTRKiijRSfaweALlP87hLkWaN6+bNXp0+mVITCtElnrsByct43Md:cx/R2qVIK43MKFBKiH0BCm+/qRUf
TLSH
T1F756D51125DA9FDCC04FA474CE0669A16A237C868F61AFDF19807E253E756B46F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2565984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\BuildResults\bin\Release_x64\AcrobatExe.pdb

kernel32

CreateFileA FindFirstFileA FindNextFileA GetFileAttributesA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA WideCharToMultiByte SetErrorMode QueryPerformanceCounter HeapSetInformation ReleaseSemaphore WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime QueryPerformanceFrequency IsProcessorFeaturePresent GetVersionExW RtlUnwind UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetModuleFileNameA TerminateThread SetThreadPriority GetCurrentThread CreateEventA lstrcmpW lstrcmpA GetSystemDirectoryW OutputDebugStringW QueryDosDeviceW GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW MultiByteToWideChar SetDllDirectoryW LoadLibraryExW FreeLibrary GetExitCodeProcess GetLongPathNameW SetCurrentDirectoryW GetCommandLineW GetTickCount OpenMutexW GetVolumeInformationW GetModuleHandleW CreateThread CreateEventW CreateMutexW WaitForSingleObject ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe WriteFile ReadFile GetFileType CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot QueryActCtxW FindActCtxSectionStringW DeactivateActCtx WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW LoadLibraryA GetDateFormatW GetStdHandle ExitProcess SetStdHandle GetConsoleMode GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwindEx InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetLocaleInfoEx ActivateActCtx CreateActCtxW LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW OpenProcess TerminateProcess Sleep DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError RaiseException DecodePointer OutputDebugStringA GetStartupInfoW lstrlenW GetCurrentProcessId GetCurrentProcess GetTempPathW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc GetCurrentThreadId GetLastError CloseHandle VerSetConditionMask GetProcAddress GetSystemPowerStatus GetCPInfo CompareStringEx LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RtlPcToFileHeader SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock GetTimeFormatW GetModuleHandleA GetStringTypeW WaitForSingleObjectEx QueryFullProcessImageNameW GlobalHandle CreatePipe MulDiv GlobalUnlock GlobalSize GlobalLock OpenFileMappingW OpenEventW GetComputerNameExW VirtualProtect VirtualQuery ExpandEnvironmentStringsW ProcessIdToSessionId GetProcessId DuplicateHandle GetProcessTimes IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive UnregisterWaitEx RegisterWaitForSingleObject QueryThreadCycleTime GetThreadPriority GetUserDefaultLangID IsDebuggerPresent GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW CopyFileW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetEnvironmentVariableW GetProfileStringW ReadProcessMemory CreateIoCompletionPort GetQueuedCompletionStatus UnregisterWait TerminateJobObject PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread DebugBreak GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation AssignProcessToJobObject SignalObjectAndWait CreateRemoteThread CreateJobObjectW VirtualFree SearchPathW ExitThread FlushInstructionCache VirtualAlloc GetModuleHandleExA GlobalAlloc GlobalFree GetTempFileNameW GetExitCodeThread BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetFullPathNameW GetFileTime CompareFileTime CreateDirectoryExW SetEnvironmentVariableW GetModuleHandleExW

user32

GetMessageW GetUserObjectInformationW GetProcessWindowStation SetProcessWindowStation CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW TranslateMessage GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW GetPropA GetClassNameW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeQueryStringA DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongPtrW SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA GetThreadDesktop PostThreadMessageW IsWindowEnabled MsgWaitForMultipleObjects PeekMessageW CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows FindWindowExW EnableWindow WindowFromPoint GetAncestor GetShellWindow GetRawInputDeviceInfoW SetActiveWindow CreateIconFromResourceEx GetDC GetWindowTextLengthW ReleaseDC RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction LoadIconW SendDlgItemMessageW RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer CloseWindow LoadCursorW GetWindowDC SystemParametersInfoW BeginPaint EndPaint GetClientRect MoveWindow UpdateWindow AdjustWindowRectEx IsChild SetFocus SetRect MonitorFromRect IsRectEmpty GetClassInfoExW GetWindowLongW SetWindowLongW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient SetCapture ReleaseCapture FillRect InvalidateRect InvalidateRgn DestroyAcceleratorTable MapWindowPoints SetCursor IsDialogMessageW LoadBitmapW MapDialogRect SetWindowContextHelpId CreateDialogIndirectParamW PostQuitMessage DefWindowProcA DispatchMessageA GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongPtrW GetWindowTextW IsWindow GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics BringWindowToTop SendMessageTimeoutW EnumDesktopWindows SetWindowTextW GetForegroundWindow CharNextW EndDialog DialogBoxParamW GetGUIThreadInfo GetWindowThreadProcessId FindWindowW AllowSetForegroundWindow SwitchToThisWindow KillTimer SetTimer EmptyClipboard CloseClipboard OpenClipboard SetWindowPos ShowWindow UnregisterClassW PostMessageW

advapi32

CryptGenKey RegGetValueW RegOpenKeyExA RegQueryValueA RegQueryValueExA RegOpenKeyA EqualSid AllocateAndInitializeSid RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW MakeAbsoluteSD InitiateSystemShutdownW LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType GetUserNameW ImpersonateAnonymousToken CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CredReadW CredFree CredWriteW CredDeleteW CryptSetKeyParam CryptContextAddRef

shlwapi

UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathRemoveFileSpecW PathFindExtensionA PathCombineW PathIsRelativeW PathFindExtensionW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathFindFileNameW PathAddBackslashW PathCreateFromUrlW UrlCanonicalizeW UrlUnescapeW PathIsUNCServerShareW ord219 PathIsURLW

winhttp

WinHttpSetCredentials WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders

??4PreamblePatcher@sidestep@@QEAAAEAV01@$$QEAV01@@Z ??4PreamblePatcher@sidestep@@QEAAAEAV01@AEBV01@@Z ?AcrobatIsNearAbsoluteIndirectJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?AllocPageNear@PreamblePatcher@sidestep@@CAPEAXPEAX@Z ?AllocPreambleBlockNear@PreamblePatcher@sidestep@@SAPEAEPEAX@Z ?FreePreambleBlock@PreamblePatcher@sidestep@@SAXPEAE@Z ?Initialize@PreamblePatcher@sidestep@@CAXXZ ?IsMovWithDisplacement@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearAbsoluteCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?PatchMovWithDisplacement@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchNearJumpOrCall@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortConditionalJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?RawPatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX0PEAPEAXPEBD@Z ?RawPatchWithStub@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?RawPatchWithStubAndProtections@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?ResolveTargetImpl@PreamblePatcher@sidestep@@CAPEAXPEAE0_N@Z ?Unpatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX00@Z ?granularity_@PreamblePatcher@sidestep@@0JA ?initialized_@PreamblePatcher@sidestep@@0_NA ?pagesize_@PreamblePatcher@sidestep@@0JA ?preamble_pages_@PreamblePatcher@sidestep@@0PEAUPreamblePage@12@EA AcroRd32IsBrokerProcess GetHandleVerifier GetWinstaDesktopInfo IsSandboxedProcess

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

65KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

725KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_1379f08f16c7c5f6c83150653ae453b6_akira_cobalt-strike_icedid_njrat_remcos_satacom_vidar

kernel32

user32

advapi32

shlwapi

winhttp

generic