2026-08-06_40d887749e505859036cd8808746bdb4_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_40d887749e505859036cd8808746bdb4_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 12.6MB
Sample260806-28aggsck21
SHA256 e652c721cdd1088eaf60ef74f82244deee1e6534aaf58e65bddd47544b30e2d4
MD5 40d887749e505859036cd8808746bdb4
SHA1 bbcb68afaa4e49fb053033b69d6b9fc9a020b79b
SHA512 46f7549969dafa41e239ec77630b6799bf64e5e2339082fa3c259bf72397aab59b32efb6d774b526f100a2a20065dfb7170222b868bf98ce24991aff0d819f4e
SSDEEP 98304:IiOlIlgid1DSV6ldi29Vsv4GqsjPFFfGfMeKmr0RoOr5NNpJyjteXiun:IiOiHfNOv4GqsjNJqMejKNNd
TLSH
T1BAD67C6672BC01D5E0FAC17CD6E64907FAB23851033DDBEB05A146261F2BAE59E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

File Explorer

2026-08-06_40d887749e505859036cd8808746bdb4_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 12.6MB

2026-08-06_40d887749e505859036cd8808746bdb4_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH de307ec0a01ed62f189df31456b42bf4
SHA256 e652c721cdd1088eaf60ef74f82244deee1e6534aaf58e65bddd47544b30e2d4
MD5 40d887749e505859036cd8808746bdb4
SHA1 bbcb68afaa4e49fb053033b69d6b9fc9a020b79b
SHA512 46f7549969dafa41e239ec77630b6799bf64e5e2339082fa3c259bf72397aab59b32efb6d774b526f100a2a20065dfb7170222b868bf98ce24991aff0d819f4e
SSDEEP 98304:IiOlIlgid1DSV6ldi29Vsv4GqsjPFFfGfMeKmr0RoOr5NNpJyjteXiun:IiOiHfNOv4GqsjNJqMejKNNd
TLSH
T1BAD67C6672BC01D5E0FAC17CD6E64907FAB23851033DDBEB05A146261F2BAE59E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Digest

97:a8:96:b2:f3:2a:1f:6a:1d:fe:63:0b:95:d0:d0:0b:ca:23:c0:ba:63:a6:56:6e:01:35:a7:76:82:ec:6a:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0450872012,CN=Xcitium Inc,O=Xcitium Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 18, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

97:a8:96:b2:f3:2a:1f:6a:1d:fe:63:0b:95:d0:d0:0b:ca:23:c0:ba:63:a6:56:6e:01:35:a7:76:82:ec:6a:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

Chains

Aug 18, 2025

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

Serial Number

33:00:04:08:8a:b9:c8:f8:99:bd:0f:49:e4:00:00:00:04:08:8a

Issuer

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 18, 2025 - Aug 21, 2025

Subject

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:06:4a:1a:fa:cf:05:61:6a:74:00:00:00:00:00:06

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:47:e3:95:0b:37:a1:60:dd:c7:00:00:00:00:00:47

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

75:3f:fe:d4:a2:64:7c:b5:d6:cc:8e:39:e7:82:a8:dc

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 16, 2024 - Nov 30, 2025

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

7395524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\CES_UM_git\Release\x64\Symbols\CmdAgent.pdb

urlmon

IsValidURL URLDownloadToFileW

iphlpapi

SendARP GetAdapterIndex GetIfEntry NotifyAddrChange GetAdaptersInfo GetAdaptersAddresses

rpcrt4

UuidToStringA UuidCreateSequential RpcStringFreeA

kernel32

UnlockFile LockFileEx TlsFree FlushFileBuffers SwitchToThread SetFilePointerEx GetFinalPathNameByHandleW TlsGetValue DecodePointer PulseEvent ReleaseMutex CreateMutexW lstrlenW SetFileAttributesW OpenEventW GetOverlappedResult DeviceIoControl SetThreadPriority OutputDebugStringW OutputDebugStringA GetTempFileNameW GetTempPathW ResetEvent GetComputerNameW SystemTimeToFileTime FreeResource GetLocaleInfoW TzSpecificLocalTimeToSystemTime OpenMutexW GetTickCount64 VerifyVersionInfoW VerSetConditionMask FileTimeToLocalFileTime FileTimeToSystemTime GetDriveTypeW GetLogicalDriveStringsW GetCurrentProcessId SetThreadExecutionState K32EnumProcessModules K32EnumProcesses RemoveDirectoryW GetSystemTimeAsFileTime GetCurrentThreadId ProcessIdToSessionId ExitProcess SetProcessWorkingSetSize DeleteFileW GetTickCount DuplicateHandle GetCurrentProcess QueryPerformanceCounter QueryPerformanceFrequency LocalAlloc FormatMessageW LoadLibraryExW RaiseException lstrcmpiW FreeLibrary GetModuleFileNameW GetModuleHandleW WideCharToMultiByte WaitForMultipleObjects ReleaseSemaphore CreateSemaphoreW VirtualQuery MapViewOfFile UnmapViewOfFile SetEvent CreateEventW GetLastError GetCurrentThread Sleep LoadLibraryW TerminateThread WaitForSingleObject CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FlushViewOfFile InitializeCriticalSection CreateFileMappingW GetModuleHandleA GetProcAddress CloseHandle TerminateProcess OpenProcess InitializeCriticalSectionEx MultiByteToWideChar FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetPrivateProfileStringW GetPrivateProfileSectionW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock FindFirstFileExW GetStringTypeW IsDebuggerPresent SetCriticalSectionSpinCount GetVolumeInformationByHandleW EnumResourceNamesW GetFileInformationByHandleEx SetThreadLocale GetStdHandle WakeConditionVariable OpenMutexA GetUserDefaultLCID CreateFileMappingA HeapCompact DeleteFileA WaitForSingleObjectEx CreateFileA GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA GetFullPathNameW HeapCreate TryEnterCriticalSection InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable GetSystemInfo GetFileInformationByHandle WTSGetActiveConsoleSessionId RtlUnwind GetVersion CreateMutexA SetEndOfFile SetFilePointer WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode ExitThread RtlUnwindEx SetThreadContext FlushInstructionCache GetStartupInfoW AreFileApisANSI QueryDosDeviceW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter RtlLookupFunctionEntry VirtualFree VirtualProtect VirtualAlloc GetVersionExW UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread GetThreadTimes RegisterWaitForSingleObject UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer lstrcmpA GetExitCodeThread SetFileTime DosDateTimeToFileTime GetCurrentDirectoryW GetFileType CreateDirectoryW GetSystemDefaultUILanguage GetComputerNameExW SetFileInformationByHandle GetProcessTimes UpdateProcThreadAttribute CreateThreadpoolTimer InitializeProcThreadAttributeList DeleteProcThreadAttributeList LockFile SignalObjectAndWait GetFileSizeEx FormatMessageA LoadLibraryA GetThreadContext ResumeThread SuspendThread RtlCaptureContext WriteFile GetVolumeInformationW Process32NextW Process32FirstW CreateToolhelp32Snapshot FreeConsole SetConsoleCtrlHandler AllocConsole GetCommandLineW SetEnvironmentVariableW FileTimeToDosDateTime SetUnhandledExceptionFilter lstrcpyW ReadFile GetSystemPowerStatus GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW GetSystemTime GetThreadPriority GetFileAttributesExW MoveFileExW GetFileSize CreateEventExW LCMapStringEx GetCPInfo CompareStringEx EncodePointer GetLocaleInfoEx AcquireSRWLockShared ReleaseSRWLockShared GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RtlPcToFileHeader SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable MapViewOfFileEx CreateFileW CopyFileW TlsAlloc TlsSetValue ReadProcessMemory GetExitCodeProcess GetUserDefaultLangID GetWindowsDirectoryW GetSystemDirectoryW K32GetModuleFileNameExW K32GetProcessImageFileNameW SearchPathW GetLongPathNameW ExpandEnvironmentStringsW FindFirstFileW FindNextFileW FindClose SetLastError GetDiskFreeSpaceW GetCompressedFileSizeW GetFileTime SystemTimeToTzSpecificLocalTime CreateWaitableTimerW SetWaitableTimer GetLocalTime GetTimeFormatW GetDateFormatW GetSystemWindowsDirectoryW CreateProcessW MoveFileW GetQueuedCompletionStatus CreateIoCompletionPort PostQueuedCompletionStatus

user32

GetMessageW LoadStringW CharUpperW wsprintfW DispatchMessageW MessageBoxW UnregisterDeviceNotification RegisterDeviceNotificationW PostMessageW RegisterWindowMessageW SendMessageTimeoutW TranslateMessage GetWindowThreadProcessId GetShellWindow IsCharAlphaNumericW IsWindow GetSystemMetrics FindWindowW PostThreadMessageW CharNextW GetThreadDesktop GetUserObjectInformationW CharLowerBuffW ShowWindow

advapi32

RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges AddAccessAllowedAceEx GetUserNameW EqualSid GetAce GetNamedSecurityInfoW LogonUserW DuplicateToken RegSaveKeyExW InitiateSystemShutdownExW QueryServiceStatus QueryServiceConfigW ChangeServiceConfigW StartServiceW CreateProcessWithTokenW AddAccessAllowedAce SetSecurityDescriptorGroup IsValidSecurityDescriptor AccessCheck CreateProcessAsUserW RegConnectRegistryW EnumServicesStatusExW ChangeServiceConfig2W QueryServiceStatusEx QueryServiceConfig2W SetThreadToken CloseEventLog ReadEventLogW CryptAcquireContextW CryptCreateHash CreateServiceW DeleteService ControlService CloseServiceHandle OpenServiceW OpenSCManagerW DeregisterEventSource ReportEventW RegisterEventSourceW RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus SetSecurityDescriptorOwner OpenEventLogW SetNamedSecurityInfoW LookupAccountSidW CheckTokenMembership OpenThreadToken GetSidSubAuthorityCount SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetTokenInformation OpenProcessToken ConvertSidToStringSidW LookupAccountNameW RegUnLoadKeyW RegLoadKeyW ImpersonateLoggedOnUser RevertToSelf RegFlushKey DestroyPrivateObjectSecurity RegSetKeySecurity GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD GetAclInformation InitializeAcl AddAce GetSecurityDescriptorControl GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetSidLengthRequired InitializeSid GetSidSubAuthority IsValidSid CopySid GetLengthSid RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegNotifyChangeKeyValue ImpersonateSelf ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ord165 SHCreateDirectoryExW SHGetFolderPathW SHBindToParent SHFileOperationW SHChangeNotify CommandLineToArgvW ord680 ShellExecuteExW

ole32

CoGetCurrentLogicalThreadId CoGetClassObject CoFreeUnusedLibrariesEx StringFromGUID2 StringFromCLSID CLSIDFromString CLSIDFromProgID CoResumeClassObjects CoReleaseServerProcess CoAddRefServerProcess CoRevokeClassObject CoRegisterClassObject CoInitializeSecurity CoInitializeEx CoRevertToSelf CoImpersonateClient CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitialize CoCreateGuid

oleaut32

SafeArrayGetElement VarDateFromStr SysFreeString SysStringLen VariantClear SysAllocString VarUI4FromStr SysStringByteLen SysAllocStringByteLen VarBstrCmp SafeArrayGetLBound SafeArrayGetVartype SafeArrayUnlock SafeArrayLock VariantInit VariantChangeType SafeArrayDestroy UnRegisterTypeLi LoadTypeLi RegisterTypeLi VariantCopyInd SafeArrayPutElement VariantCopy SafeArrayCopy VarUdateFromDate SafeArrayGetUBound VarBstrCat SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayRedim SafeArrayCreate SysAllocStringLen

ntdll

RtlIpv6StringToAddressW RtlVirtualUnwind RtlIpv4StringToAddressW

shlwapi

PathRemoveExtensionW PathIsNetworkPathW PathStripPathW PathRemoveBackslashW PathRemoveFileSpecW PathFileExistsA SHCreateStreamOnFileEx PathIsDirectoryEmptyW PathFindFileNameW PathFileExistsW AssocQueryStringW StrRetToBufW UrlUnescapeW PathAppendW PathAddBackslashW SHCopyKeyW SHDeleteKeyW

userenv

ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

winmm

timeGetTime

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

netapi32

NetApiBufferFree NetShareEnum

ws2_32

socket connect recv WSASendTo WSAAddressToStringW select recvfrom WSAEventSelect WSASocketW WSAEnumNetworkEvents closesocket WSAGetLastError ntohs htons WSACleanup WSAStartup inet_addr htonl ntohl gethostbyname inet_ntoa WSARecvFrom send sendto gethostbyaddr getprotobynumber

setupapi

SetupGetInfFileListW SetupOpenInfFileW SetupFindFirstLineW SetupDiSetClassInstallParamsW SetupDiDestroyDeviceInfoList SetupCopyOEMInfW SetupUninstallOEMInfW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW InstallHinfSectionW SetupDiEnumDeviceInfo SetupDiGetClassDevsW CM_Get_DevNode_Status SetupDiGetDeviceInstallParamsW SetupCloseInfFile SetupDiCallClassInstaller SetupGetStringFieldW

mpr

WNetGetUniversalNameW

crypt32

CryptProtectData CryptUnprotectData CertGetNameStringW CryptBinaryToStringW CertGetCertificateContextProperty CertFreeCertificateContext CertCompareIntegerBlob CertCompareCertificateName CryptMsgClose CryptMsgUpdate CryptMsgOpenToDecode CryptMsgGetParam CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDeleteCertificateFromStore CryptQueryObject CertCloseStore CertFindCertificateInStore CertOpenSystemStoreW CertDuplicateCertificateContext

msi

ord224

fltlib

FilterReplyMessage FilterConnectCommunicationPort FilterSendMessage FilterGetMessage

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

winhttp

WinHttpTimeToSystemTime WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpQueryOption WinHttpCloseHandle WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetCredentials WinHttpReadData WinHttpQueryAuthSchemes WinHttpOpenRequest

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

rasapi32

RasGetEntryPropertiesW RasSetEntryPropertiesW

cmdres

CmdResInit CmdResLoadStringByDigitalId CmdResGetLangInfo CmdResClose

xmllite

CreateXmlWriter CreateXmlWriterOutputWithEncodingName

Name

.text

Size

9.0MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

404KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

375KB

Virtual Size

375KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_40d887749e505859036cd8808746bdb4_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

urlmon

iphlpapi

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

ntdll

shlwapi

userenv

winmm

wtsapi32

netapi32

ws2_32

setupapi

mpr

crypt32

msi

fltlib

wintrust

winhttp

version

rasapi32

cmdres

xmllite

generic