2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar
Size 18.9MB
Sample260806-2ffssssakd
SHA256 fa1ddf75e3795e1f1a04708b549b7c853d087ff7a62baadb4c3a78ff9e37f303
MD5 dc8ca139ef5739d612a311ab3e677bda
SHA1 34b936ac01c9345910cc45008bbd69aa699d2f48
SHA512 d837b5a4f104a7b4b21dfc558c9a142516a599c29947192cee73e31c6d603382635faaaa3afda46c4d3dc928b905edc46d5e1dd7b5a4d61c63521d03c8dc512b
SSDEEP 196608:8EUlKfqbJeRhb5E7cRGo8sOgZo0aHqaEttjezQw5yCBvo4po3K9tz6ZHkDKWKRUd:MwibJejRaEtAzlw4p4c6H4nKRN/+58Lo
TLSH
T11717BE02BA9A59EAD19DC870C3474B678F2274CB0636F5BF46C402292F6E7B51F2D316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

File Explorer

2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

.exe 18.9MB

2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

IMPHASH f93f92c2681386f0e7e4a953e1ed1acd
SHA256 fa1ddf75e3795e1f1a04708b549b7c853d087ff7a62baadb4c3a78ff9e37f303
MD5 dc8ca139ef5739d612a311ab3e677bda
SHA1 34b936ac01c9345910cc45008bbd69aa699d2f48
SHA512 d837b5a4f104a7b4b21dfc558c9a142516a599c29947192cee73e31c6d603382635faaaa3afda46c4d3dc928b905edc46d5e1dd7b5a4d61c63521d03c8dc512b
SSDEEP 196608:8EUlKfqbJeRhb5E7cRGo8sOgZo0aHqaEttjezQw5yCBvo4po3K9tz6ZHkDKWKRUd:MwibJejRaEtAzlw4p4c6H4nKRN/+58Lo
TLSH
T11717BE02BA9A59EAD19DC870C3474B678F2274CB0636F5BF46C402292F6E7B51F2D316
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

fa:13:80:dc:f8:8a:69:4c:29:c2:23:f3:13:f8:84:26:e3:46:8d:9c:80:a3:e8:61:c3:ab:00:95:f9:cc:bd:d2:56:9c:46:d8:88:b3:b7:a5:16:86:d0:d3:3e:f8:eb:a6:66:c1:ff:a1:6d:cb:d7:3b:57:24:87:c4:6b:be:26:b9

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Chains

Apr 10, 2026

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dell Technologies Inc.,OU=DUP Client Creation Service,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Serial Number

07:07:0c:f5:87:35:7d:2e:04:24:0b:d1:80:69:12:55

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 2, 2025 - Jun 1, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

7512568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SelfExtractable.pdb

bcryptprimitives

ProcessPrng

kernel32

TerminateProcess GetExitCodeProcess GetModuleHandleA GetNativeSystemInfo GetSystemInfo LCMapStringEx CreateDirectoryW GetFileAttributesW FindFirstFileW RemoveDirectoryW GetDiskFreeSpaceExA CreateMutexW Sleep WaitForSingleObject SetWaitableTimer LocalFree GetFinalPathNameByHandleW DuplicateHandle GetStringTypeW TryEnterCriticalSection InitializeSListHead GetQueuedCompletionStatusEx SetUnhandledExceptionFilter UnhandledExceptionFilter CreateWaitableTimerExW GetStdHandle GetConsoleMode GetConsoleOutputCP SystemTimeToTzSpecificLocalTime WriteConsoleW SetFileInformationByHandle GetFullPathNameW FindFirstFileExW CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx SetEndOfFile SetFilePointerEx GetModuleHandleW FormatMessageW ReadConsoleW GetTempPathW DeleteFileW GetFileAttributesExW CopyFileExW CreateThread WriteFileEx SleepEx ReadFileEx WaitForMultipleObjects GetOverlappedResult CreateEventW CancelIo ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW FindNextFileW PostQueuedCompletionStatus SetConsoleCtrlHandler CreateIoCompletionPort CreateEventA RemoveVectoredExceptionHandler MoveFileExW GlobalFree GetFileSizeEx FlushFileBuffers LoadLibraryExA WriteFile ExitProcess PeekNamedPipe GetDriveTypeW GetFileType RtlPcToFileHeader OutputDebugStringW EncodePointer SetThreadStackGuarantee GetCPInfo AcquireSRWLockExclusive SetEnvironmentVariableW CompareStringOrdinal SetCurrentDirectoryW ReleaseSRWLockExclusive InitializeSRWLock GetStartupInfoW IsDebuggerPresent ResetEvent IsProcessorFeaturePresent RtlUnwindEx GetModuleHandleExW GetSystemTimePreciseAsFileTime GetCommandLineA CompareStringW LCMapStringW GetLocaleInfoW FindClose IsValidLocale GetUserDefaultLCID InitOnceExecuteOnce UnregisterWait RegisterWaitForSingleObject EnumSystemLocalesW GetTimeZoneInformation TlsFree TlsSetValue AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc GlobalLock GlobalUnlock TlsGetValue TlsAlloc FormatMessageA GetLastError LoadLibraryExW FreeLibrary GetSystemDefaultLangID HeapAlloc GetProcAddress GetCurrentThreadId UnmapViewOfFile CreateFileMappingW VirtualProtect MapViewOfFile WideCharToMultiByte GetCurrentDirectoryW MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetUserPreferredUILanguages IsValidCodePage SetThreadErrorMode GlobalSize GetModuleFileNameW GlobalAlloc CloseHandle GetCurrentProcess ReleaseMutex GetCurrentThread RtlCaptureContext SetStdHandle RtlUnwind GetACP LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindVolumeClose GetVolumeInformationA DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLogicalDriveStringsA FindFirstVolumeA FileTimeToSystemTime ExpandEnvironmentStringsA InitializeCriticalSectionEx GetSystemTimeAsFileTime FileTimeToLocalFileTime GetOEMCP SwitchToThread GetTimeZoneInformationForYear lstrlenW HeapDestroy HeapSize GetSystemFirmwareTable SetLastError SetEvent RtlLookupFunctionEntry SetCurrentDirectoryA GetCurrentDirectoryA FindFirstFileA FindNextFileA CreateProcessA GetModuleFileNameA GetStartupInfoA LoadLibraryA GetDateFormatW GetTimeFormatW CopyFileW FindResourceW SizeofResource LockResource WaitForSingleObjectEx CreateMutexA GetCurrentProcessId RtlVirtualUnwind CreateDirectoryA GetFileAttributesA FindResourceExW LoadResource

user32

GetWindowLongPtrW PostMessageW SetWindowTextW CloseClipboard InvalidateRgn GetMonitorInfoW CloseTouchInputHandle MonitorFromRect GetTouchInputInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData PostThreadMessageW SetCapture ScreenToClient PeekMessageW GetKeyboardLayout MsgWaitForMultipleObjectsEx GetKeyState TrackMouseEvent IsWindowVisible MapVirtualKeyA MonitorFromWindow DefWindowProcW GetSystemMetrics GetCursorPos ToUnicodeEx ChangeDisplaySettingsExW RegisterTouchWindow GetUpdateRect RedrawWindow GetRawInputData IsProcessDPIAware DestroyWindow SetWindowDisplayAffinity CreateWindowExW MonitorFromPoint RegisterRawInputDevices RegisterClassExW ValidateRect GetDC ReleaseCapture GetActiveWindow SetWindowLongPtrW GetMessageW GetKeyboardState MapVirtualKeyW GetMenu TranslateMessage DispatchMessageW GetWindowPlacement SystemParametersInfoA SetForegroundWindow IsIconic ShowCursor GetWindowRect ClipCursor GetClipCursor SetWindowPlacement SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow AdjustWindowRectEx GetWindowLongW RegisterWindowMessageA SendInput LoadCursorW SetCursor MessageBoxW SetWindowPos FlashWindowEx ClientToScreen DestroyIcon CreateIcon GetClientRect GetForegroundWindow

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA QueryServiceStatusEx RegEnumValueW OpenSCManagerA CloseServiceHandle RegQueryValueExA RegOpenKeyExA SystemFunction036 GetLengthSid SetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW DeregisterEventSource ReportEventW RegEnumKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW InitiateSystemShutdownW OpenServiceA RegisterEventSourceW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegDeleteKeyExW RegCloseKey RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryValueExW GetUserNameW EqualSid AllocateAndInitializeSid FreeSid

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ntdll

NtReadFile NtWriteFile NtDeviceIoControlFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile

oleaut32

SysAllocString SafeArrayCreate SysAllocStringLen SafeArrayGetUBound SysFreeString VariantClear VariantInit SafeArrayPutElement SafeArrayGetElement SafeArrayGetLBound GetErrorInfo SysStringLen

shlwapi

AssocQueryStringW

gdi32

CreateRectRgn GetDeviceCaps DeleteObject StretchDIBits

wintrust

WinVerifyTrust

ole32

CoCreateGuid RegisterDragDrop RevokeDragDrop OleInitialize CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmAssociateContextEx ImmGetContext

dwmapi

DwmEnableBlurBehindWindow

shell32

DragQueryFileW SHFileOperationA DragFinish SHFileOperationW

bcrypt

BCryptGenRandom

d3dcompiler_47

D3DCompile

uxtheme

SetWindowTheme

ws2_32

inet_ntop getaddrinfo WSAStartup WSACleanup freeaddrinfo getnameinfo

iphlpapi

GetAdaptersAddresses GetIpInterfaceEntry CancelMibChangeNotify2 NotifyIpInterfaceChange

??0CMTRedfishCRUDOperation@@QEAA@AEBV0@@Z ??0CMTRedfishCRUDOperation@@QEAA@XZ ??0DSMIPMIInterfaceImpl@@QEAA@XZ ??1CMTRedfishCRUDOperation@@QEAA@XZ ??1DSMIPMIInterfaceImpl@@UEAA@XZ ??4CMTRedfishCRUDOperation@@QEAAAEAV0@AEBV0@@Z ??4DSMIPMIInterfaceImpl@@QEAAAEAV0@AEBV0@@Z ??_7DSMIPMIInterfaceImpl@@6B@ ?AddAuthInfo@CMTRedfishCRUDOperation@@AEAAXPEAUICMTRedfishOAuthMethod@@AEAUCMTRedfishConnection@@@Z ?AddSocketInfo@CMTRedfishCRUDOperation@@AEAAXAEAUCMTRedfishConnection@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H1@Z ?CreateRedfishBasicAuthIF@API_CMT_REDFISH@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PEAPEAUICMTRedfishBasicAuthMethod@@@Z ?CreateRedfishCRUDInterfaceObj@CMTRedfishCRUDOperation@@AEAAPEAVICMTRedfishCRUDInterface@@W4CMT_REDFISH_URL_CALL_TYPE@@@Z ?CreateRedfishInventoryIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSoftwareInventory@@@Z ?CreateRedfishOAuthAuthIF@API_CMT_REDFISH@@YAHPEAPEAUICMTRedfishOAuthMethod@@@Z ?CreateRedfishSystemActionIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSystemAction@@@Z ?CreateRedfishSystemInfoIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSystemInfo@@@Z ?CreateRedfishUpdateIF@API_CMT_REDFISH@@YAHAEBUCMTRedfishConnection@@PEAPEAUICMTRedfishSoftwareUpdate@@@Z ?CreateUsbnicInterface@API_CMT_REDFISH@@YAHPEAPEAUICMTUsbnicInterface@@@Z ?ExecuteRedfishCall@CMTRedfishCRUDOperation@@QEAAHW4CMT_REDFISH_URL_CALL_TYPE@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV34@11@Z ?Finalize@API_CMT_REDFISH@@YAHXZ ?FinalizeRedfishInterface@CMTRedfishCRUDOperation@@AEAAXXZ ?GetConnectedBMCType@CMTRedfishCRUDOperation@@QEAA?AW4CMT_BMC_TYPES@@XZ ?GetSystemGeneration@API_CMT_REDFISH@@YAHXZ ?IPMIRequest@DSMIPMIInterfaceImpl@@QEAAIPEAU_DSMIPMICommandData@@@Z ?Initialize@API_CMT_REDFISH@@YAHAEBUCMTRedfishLibInitParam@@@Z ?Initialize@DSMIPMIInterfaceImpl@@QEAAIPEBU_DSMIPMIConfiguration@@@Z ?Initialize@DSMIPMIInterfaceImpl@@QEAAIVDSMString@@@Z ?InitializeDSMLogger@DSMIPMIInterfaceImpl@@AEAAXXZ ?InitializeRedfishInterface@CMTRedfishCRUDOperation@@AEAAHXZ ?Release@DSMIPMIInterfaceImpl@@QEAAIXZ ?SetBMCType@CMTRedfishCRUDOperation@@AEAAHAEAW4CMT_BMC_TYPES@@@Z ?USBNicInterfaceDisable@CMTRedfishCRUDOperation@@AEAAHPEAUICMTUsbnicInterface@@@Z ?USBNicInterfaceEnable@CMTRedfishCRUDOperation@@AEAAHPEAUICMTUsbnicInterface@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAH1@Z ?freePMInfo@@YAHPEAUPMInfo@@@Z ?getHttpStatus@CMTRedfishCRUDOperation@@QEAAHXZ ?getPMInfo@@YAHHPEAPEAUPMInfo@@@Z ?getPMStatus@@YAHXZ ?getResponseBody@CMTRedfishCRUDOperation@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getResponseHeader@CMTRedfishCRUDOperation@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getTestPMInfo@@YAHHPEAPEAUPMInfo@@@Z get_redfish_pm_details

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_dc8ca139ef5739d612a311ab3e677bda_akira_cobalt-strike_icedid_megazord_njrat_rusty-stealer_satacom_stealc_vidar

bcryptprimitives

kernel32

user32

advapi32

api-ms-win-core-synch-l1-2-0

version

ntdll

oleaut32

shlwapi

gdi32

wintrust

ole32

winmm

imm32

dwmapi

shell32

bcrypt

d3dcompiler_47

uxtheme

ws2_32

iphlpapi

generic