2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz
Size 135.6MB
Sample260808-dmemba11gv
SHA256 69a562dadf8e61677da1f630a60396c25bebd24dc420dadce65315fe80d40296
MD5 939d6d05e2b4e29e2634a574f69e241f
SHA1 a4911fe856b31ca6bddcd0a019144d06bd2c189c
SHA512 2d7822ae0d7338ca96c720daca7b4a7927ea4b7b4bb9c871b81b6f8887995a54bf36ba0e09322f2cdd4fcaa54b28a63f9b3b4417d1244d3dd8d0425547613b58
SSDEEP 393216:Hy57a3Z40F23nAlWMn9PfDhOru/hm+vxwUdN3QSI8wxSvDazn1N5VRc+9YcEaDzx:HtDn3QtRCc3Ltw18bvxOtxk2v5e
TLSH
T12268AE4267AA1885F9B79B3489E25213E573BC062F3099CB325C07291F7B7E18D76F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

File Explorer

2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

.exe 135.6MB

2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

IMPHASH b96e2264c1113b06cad57e8d49c97190
SHA256 69a562dadf8e61677da1f630a60396c25bebd24dc420dadce65315fe80d40296
MD5 939d6d05e2b4e29e2634a574f69e241f
SHA1 a4911fe856b31ca6bddcd0a019144d06bd2c189c
SHA512 2d7822ae0d7338ca96c720daca7b4a7927ea4b7b4bb9c871b81b6f8887995a54bf36ba0e09322f2cdd4fcaa54b28a63f9b3b4417d1244d3dd8d0425547613b58
SSDEEP 393216:Hy57a3Z40F23nAlWMn9PfDhOru/hm+vxwUdN3QSI8wxSvDazn1N5VRc+9YcEaDzx:HtDn3QtRCc3Ltw18bvxOtxk2v5e
TLSH
T12268AE4267AA1885F9B79B3489E25213E573BC062F3099CB325C07291F7B7E18D76F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

82:1c:4b:84:b2:39:89:7f:1e:11:17:3f:c4:32:1a:dc:91:67:e8:11:fd:23:26:86:af:ed:b9:68:8b:41:35:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Chains

Aug 7, 2026

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Subject

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Serial Number

44:4e:9c:dc:53:52:e1:8b:44:3c:82:69:e6:f3:71:6a

Issuer

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 4, 2026 - Aug 4, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

22250748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

SymSetSearchPathW SymGetSearchPathW SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 SymSetOptions SymCleanup SymGetLineFromAddr64 MiniDumpWriteDump SymGetOptions SymFromAddr SymInitialize UnDecorateSymbolName

ws2_32

htonl WSAGetLastError getservbyname getservbyport ntohs ntohl closesocket getsockopt socket WSAStartup WSAIoctl recvfrom gethostname gethostbyaddr inet_ntoa inet_addr WSACleanup gethostbyname accept sendto bind send recv FreeAddrInfoW GetAddrInfoW GetNameInfoW select WSASocketW WSASend WSAGetOverlappedResult WSADuplicateSocketW shutdown listen htons WSASendTo WSARecvFrom WSARecv setsockopt getsockname getpeername ioctlsocket connect WSASetLastError

ole32

CoTaskMemFree

iphlpapi

if_indextoname CancelMibChangeNotify2 NotifyIpInterfaceChange GetBestRoute2 if_nametoindex GetAdaptersAddresses ConvertInterfaceLuidToNameW ConvertInterfaceIndexToLuid

psapi

GetModuleFileNameExW EnumProcessModules

shell32

SHGetKnownFolderPath

userenv

GetUserProfileDirectoryW

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey GetUserNameW OpenProcessToken RegNotifyChangeKeyValue RegOpenKeyExA RegQueryValueExA RegEnumKeyExA EventWriteTransfer EventSetInformation EventUnregister EventRegister ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegEnumKeyExW GetSecurityInfo SetEntriesInAclA FreeSid AllocateAndInitializeSid SystemFunction036 RegGetValueW RegQueryInfoKeyW RegQueryValueExW

user32

DispatchMessageA TranslateMessage GetProcessWindowStation MessageBoxW CharUpperA GetSystemMetrics GetMessageA MapVirtualKeyW GetUserObjectInformationW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

kernel32

CreateEventW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader RaiseException ExitProcess GetModuleHandleExW SetStdHandle ExitThread FreeLibraryAndExitThread GetFileAttributesExW SetFileAttributesW GetConsoleOutputCP GetDriveTypeW HeapSize GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetEndOfFile OutputDebugStringW GetProcessHeap FindFirstFileExW IsValidCodePage GetOEMCP CreateProcessW VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableA WideCharToMultiByte CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLocalTime SetConsoleCtrlHandler LoadResource LockResource SizeofResource FindResourceA GetLastError WaitForSingleObject CreateRemoteThread OpenProcess OpenFileMappingW GetFileType AddVectoredExceptionHandler RemoveVectoredExceptionHandler RtlCaptureStackBackTrace GetStdHandle GetCurrentProcess GetCurrentProcessId VirtualQuery MultiByteToWideChar WriteConsoleW LocalFree FormatMessageA InitOnceExecuteOnce CreateEventA GetModuleHandleA GetProcAddress LoadLibraryExA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathW SetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Sleep GetProcessTimes SetPriorityClass GetPriorityClass GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetVersionExW GetSystemTimePreciseAsFileTime GetModuleFileNameW GetProcessIoCounters FileTimeToSystemTime GetConsoleTitleW SetConsoleTitleW K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32First Process32Next SetHandleInformation CreateIoCompletionPort SetFileCompletionNotificationModes CreateFileA CreateFileW DuplicateHandle PostQueuedCompletionStatus SetEvent ResetEvent QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CancelIoEx CancelIo SwitchToThread GetStartupInfoW CreateDirectoryW GetFileAttributesW SetFileInformationByHandle TerminateProcess GetExitCodeProcess RtlUnwind GetProcessId UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject LCMapStringW K32GetModuleBaseNameW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore GetCurrentThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentProcessorNumber GetNativeSystemInfo GetProcessAffinityMask SetThreadAffinityMask CreateSemaphoreA FlushFileBuffers ReadFile WriteFile ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW CancelSynchronousIo CreateNamedPipeA GetNamedPipeHandleStateA GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl FlushViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW DebugBreak FreeLibrary LoadLibraryExW SetErrorMode GetQueuedCompletionStatus GetCurrentThreadId ReadConsoleA VirtualAlloc VirtualProtect VirtualFree VirtualLock GetACP GetModuleHandleW LoadLibraryA LoadLibraryW GetSystemTime SystemTimeToFileTime GetSystemDirectoryA SwitchToFiber DeleteFiber CreateFiberEx ConvertFiberToThread ConvertThreadToFiberEx RtlVirtualUnwind RtlAddFunctionTable RtlDeleteFunctionTable IsDebuggerPresent OutputDebugStringA SuspendThread GetThreadContext GetLocaleInfoEx GetNumberFormatEx GetCurrencyFormatEx ResolveLocaleName SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetTimeFormatEx GetDateFormatEx CreateThread ExpandEnvironmentStringsA GetQueuedCompletionStatusEx GetThreadTimes GetDynamicTimeZoneInformation GetGeoInfoW GetUserGeoID LocaleNameToLCID LCIDToLocaleName DeleteFileA GetFileSize GetTempPathA GetTempFileNameA MapViewOfFileEx SetThreadPriority GetThreadPriority QueryThreadCycleTime SleepConditionVariableSRW SetUnhandledExceptionFilter InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

winmm

timeGetTime

Name

.text

Size

21.5MB

Virtual Size

21.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43.6MB

Virtual Size

43.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

198KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

139KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

567KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cache

Size

68.5MB

Virtual Size

68.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_939d6d05e2b4e29e2634a574f69e241f_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

PE Signature issue

dbghelp

ws2_32

ole32

iphlpapi

psapi

shell32

userenv

advapi32

user32

crypt32

bcrypt

kernel32

winmm

generic