2026-08-04_4406763fa14c546a773b4e08a10daf4a_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_4406763fa14c546a773b4e08a10daf4a_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom
Size 11.9MB
Sample260804-tfg2vstgpf
SHA256 0d5cd8f408227b150fcb1d115f7b704d03abd92cc662a630ee395a846ad5a8dc
MD5 4406763fa14c546a773b4e08a10daf4a
SHA1 6fb2568d5f62e5c738894f0193f02fcee9732a15
SHA512 860020035a9e02751e726d50cf8740b285c034a3d99161ac070139c5e1c6dc5cb6cc90f3a277f36a470f59c6f826355afa6a2ec6e154dc29a74761bc348137ce
SSDEEP 98304:mh+Oco1pKsPW3sSJZs0AgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdtnCYD:ejr1I2WcqAjj7UlG8drCeqBvKCzcL7fD
TLSH
T10AC65C1B62EC01DCD0FAD1B9C91B4913E675745A037183DF179086AA2FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_4406763fa14c546a773b4e08a10daf4a_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

File Explorer

2026-08-04_4406763fa14c546a773b4e08a10daf4a_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

.exe 11.9MB

2026-08-04_4406763fa14c546a773b4e08a10daf4a_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom

IMPHASH 23f526e72cd3a35734f0838ba2ae34a7
SHA256 0d5cd8f408227b150fcb1d115f7b704d03abd92cc662a630ee395a846ad5a8dc
MD5 4406763fa14c546a773b4e08a10daf4a
SHA1 6fb2568d5f62e5c738894f0193f02fcee9732a15
SHA512 860020035a9e02751e726d50cf8740b285c034a3d99161ac070139c5e1c6dc5cb6cc90f3a277f36a470f59c6f826355afa6a2ec6e154dc29a74761bc348137ce
SSDEEP 98304:mh+Oco1pKsPW3sSJZs0AgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdtnCYD:ejr1I2WcqAjj7UlG8drCeqBvKCzcL7fD
TLSH
T10AC65C1B62EC01DCD0FAD1B9C91B4913E675745A037183DF179086AA2FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5228752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\AdobeCollabSync.pdb

shlwapi

UrlIsW StrCmpNW PathFindFileNameW UrlCanonicalizeA StrCmpNA PathRemoveFileSpecW PathCreateFromUrlW

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore CryptProtectData CertFreeCertificateContext CryptUnprotectData

msi

ord205 ord70

kernel32

GetOverlappedResult WaitForMultipleObjects WaitNamedPipeW OpenProcess GetTempPathW GetCommandLineW GetCurrentThreadId DeleteFileA GetTempPathA DuplicateHandle CreateThread CreateProcessW GetThreadId lstrcatA GetEnvironmentStringsW FreeEnvironmentStringsW CreateDirectoryW ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject VerifyVersionInfoA GetFileType OpenEventA ConnectNamedPipe GetWindowsDirectoryW SetWaitableTimer ResumeThread TerminateProcess GetCurrentProcessId HeapSetInformation FindResourceA SizeofResource CreateNamedPipeW DeviceIoControl GetFileSize GetFileAttributesExW SetFileAttributesW GlobalFree LockResource LoadResource GetModuleHandleExA WideCharToMultiByte FormatMessageW FormatMessageA GetVersionExW CreateEventA GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy VerifyVersionInfoW LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetSystemDirectoryW GetExitCodeProcess GetCurrentProcess QueryDosDeviceW GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW VerSetConditionMask QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetModuleHandleExW GetModuleFileNameW CreateWaitableTimerA GetThreadErrorMode CreateEventW GlobalAlloc WaitForSingleObject ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError DecodePointer OutputDebugStringW OutputDebugStringA SetThreadErrorMode PostQueuedCompletionStatus TerminateThread lstrlenW GetTickCount Sleep OpenMutexW SetNamedPipeHandleState GetLastError CloseHandle GetStringTypeW WriteFile ReadFile GetVolumeInformationW CreateFileW QueueUserWorkItem SleepConditionVariableCS InitializeConditionVariable WaitForThreadpoolWorkCallbacks SetThreadpoolThreadMinimum DisconnectNamedPipe SetThreadpoolThreadMaximum K32GetProcessMemoryInfo GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread CreateFiberEx QueueUserAPC CloseThreadpoolWork GetProcessTimes AreFileApisANSI DeleteFiber SwitchToFiber RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA ReleaseSemaphore SwitchToThread DeleteFileW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointer MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetSystemTimeAsFileTime GetLocalTime FileTimeToSystemTime RemoveDirectoryW MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetSystemDirectoryA LoadLibraryA lstrlenA GetModuleHandleA FindCloseChangeNotification FindResourceExW FindResourceW GetTimeZoneInformation GetUserDefaultUILanguage CreateFileA ReadDirectoryChangesW FindFirstChangeNotificationW FindNextChangeNotification GetDriveTypeA WaitForSingleObjectEx PeekNamedPipe CancelIoEx WaitForMultipleObjectsEx CreateNamedPipeA LoadLibraryExW GetUserDefaultLCID GetStdHandle GetFileAttributesA GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetExitCodeThread GetNativeSystemInfo CloseThreadpool QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread WriteConsoleW ExitProcess GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadConsoleW SetConsoleCtrlHandler MoveFileExW SetStdHandle FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW VirtualFree GetEnvironmentVariableW AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock SystemTimeToTzSpecificLocalTime RtlUnwind InitOnceComplete InitOnceBeginInitialize CreateIoCompletionPort SleepEx GetQueuedCompletionStatus CreateWaitableTimerW SystemTimeToFileTime CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CreateThreadpool

user32

LoadStringW SendMessageTimeoutW SetWindowPos SetForegroundWindow GetWindowRect GetDesktopWindow FindWindowW GetClassNameW GetWindowThreadProcessId GetActiveWindow TranslateMessage BringWindowToTop PostMessageW GetClassNameA IsHungAppWindow LoadImageW GetCursorPos GetPropW SetPropW InsertMenuItemW TrackPopupMenu InsertMenuW DestroyMenu CreatePopupMenu DestroyWindow CreateWindowExW RegisterClassW CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA GetSystemMetrics EnumWindows IsWindowVisible ShowWindowAsync IsWindow AttachThreadInput KillTimer SetTimer GetMessageA GetForegroundWindow DispatchMessageA GetUserObjectInformationW EnumDesktopWindows GetProcessWindowStation MessageBoxW PeekMessageA MsgWaitForMultipleObjects SendMessageA FindWindowA

winspool.drv

UploadPrinterDriverPackageW

advapi32

CryptDecrypt CryptImportKey OpenThreadToken ConvertSidToStringSidA CryptHashData CryptGetHashParam RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptEnumProvidersA CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW RegEnumKeyExW RegQueryValueExA OpenProcessToken RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetTokenInformation GetLengthSid DuplicateTokenEx RegDeleteTreeW RegCreateKeyA ConvertStringSecurityDescriptorToSecurityDescriptorA TreeSetNamedSecurityInfoW GetNamedSecurityInfoW RegSetValueExA RegOpenKeyExA RegCreateKeyExA GetSidSubAuthorityCount GetSidSubAuthority GetSecurityDescriptorSacl GetAclInformation GetAce CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW GetTokenInformation

shell32

SHQueryUserNotificationState SHGetSpecialFolderLocation SHGetPathFromIDListW SHFileOperationA ShellExecuteExA ShellExecuteA SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW Shell_NotifyIconW SHCreateDirectoryExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

sensapi

IsNetworkAlive

urlmon

URLDownloadToFileA

psapi

GetModuleFileNameExA GetProcessImageFileNameW

ws2_32

bind connect listen recv select WSAIoctl socket GetAddrInfoW FreeAddrInfoW __WSAFDIsSet WSAEventSelect getservbyname setsockopt ioctlsocket freeaddrinfo htons htonl shutdown WSACreateEvent WSAGetLastError WSACleanup WSAStartup accept WSASocketA getsockopt gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport send WSASend ntohl WSASetLastError WSASocketW getaddrinfo getpeername getsockname ntohs WSAAddressToStringW WSARecv closesocket

wininet

InternetSetCookieExA InternetReadFile InternetWriteFile InternetSetOptionA HttpSendRequestExA HttpEndRequestA HttpAddRequestHeadersA DetectAutoProxyUrl HttpSendRequestA InternetCrackUrlA InternetOpenA InternetConnectA HttpOpenRequestA HttpQueryInfoA InternetCloseHandle

mpr

WNetGetResourceInformationW WNetGetConnectionW WNetAddConnection2W WNetCancelConnection2W

api-ms-win-core-path-l1-1-0

PathCchAppend PathCchAddBackslash

oleaut32

SysAllocString SafeArrayDestroy SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SysFreeString

netapi32

NetShareGetInfo

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpGetProxyForUrl WinHttpCrackUrl

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=261, version=29920,

count=12, id=259, version=27412,

count=221, id=261, version=27412,

count=1, id=253, version=33030,

count=19, id=260, version=33030,

count=20, id=259, version=33030,

count=198, id=265, version=33133,

count=11, id=260, version=33133,

count=112, id=261, version=33030,

count=31, id=260, version=27412,

count=1, id=262, version=27412,

count=762, id=260, version=29920,

count=32, productName=Unmarked objects (old),

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=257, version=27412,

count=632, id=1, productName=Unmarked objects,

count=257, id=261, version=33133,

count=1, id=256, version=33133,

count=1, id=255, version=33133,

count=2, id=151,

count=1, id=258, version=33133,