2026-08-09_bef139ed5f5c3a8886ab2ad0c73b563e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_bef139ed5f5c3a8886ab2ad0c73b563e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 6.8MB
Sample260809-fmryra1blf
SHA256 4e451637e4f1e6f33a0337616029531394043f43bc51657c97a4a227568c76b1
MD5 bef139ed5f5c3a8886ab2ad0c73b563e
SHA1 fe1f337538d833c7405bff03f44a6256e5bb014b
SHA512 5268baf2d3104143df01692fd7064a2a9846ca6fd7be78b3ac5deffcbba4bdeed6d90c02f464d4fd7bb5882f1c682845fe28f0668683a1413130739ba9013666
SSDEEP 98304:GOXf+/OsYUOtkvBpG7ai/n8L6stPKAkKMV2gVjqk1w:GE+/UUOqLG7ai/n8L6stPVk3V2gsk1w
TLSH
T1AF668E2662B840E8C17AD17CCE5B9923F7B13895033466EB16E45A6B3F57AE05F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_bef139ed5f5c3a8886ab2ad0c73b563e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 6.8MB

2026-08-09_bef139ed5f5c3a8886ab2ad0c73b563e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 2e6703e06248c3d181eaafa52313709d
SHA256 4e451637e4f1e6f33a0337616029531394043f43bc51657c97a4a227568c76b1
MD5 bef139ed5f5c3a8886ab2ad0c73b563e
SHA1 fe1f337538d833c7405bff03f44a6256e5bb014b
SHA512 5268baf2d3104143df01692fd7064a2a9846ca6fd7be78b3ac5deffcbba4bdeed6d90c02f464d4fd7bb5882f1c682845fe28f0668683a1413130739ba9013666
SSDEEP 98304:GOXf+/OsYUOtkvBpG7ai/n8L6stPKAkKMV2gVjqk1w:GE+/UUOqLG7ai/n8L6stPVk3V2gsk1w
TLSH
T1AF668E2662B840E8C17AD17CCE5B9923F7B13895033466EB16E45A6B3F57AE05F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

37:5c:b3:0e:42:32:23:bf:77:c9:15:29:fe:9a:ab:2f:a0:0c:28:de:b6:e8:af:78:d8:ca:e0:df:46:e8:3a:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=D03752763,CN=Epic Games Inc.,OU=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 26, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

37:5c:b3:0e:42:32:23:bf:77:c9:15:29:fe:9a:ab:2f:a0:0c:28:de:b6:e8:af:78:d8:ca:e0:df:46:e8:3a:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 6, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:d2:6b:28:f0:6e:7b:82:0c:6f:99:2f:37:08:a9:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 15, 2025 - Feb 15, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4555420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zenserver.pdb

dbghelp

StackWalk64 SymInitializeW SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr SymCleanup

shell32

ord680 SHGetKnownFolderPath ShellExecuteExW CommandLineToArgvW

user32

GetShellWindow GetWindowThreadProcessId

crypt32

CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertOpenStore CryptQueryObject CertFindCertificateInStore

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptGenRandom BCryptDecrypt

ws2_32

bind WSAIoctl listen getsockname WSARecv htons closesocket WSASend select shutdown WSASendTo inet_pton getsockopt send WSACloseEvent ioctlsocket setsockopt ntohl WSASetLastError getaddrinfo ntohs WSAAddressToStringW htonl freeaddrinfo WSAGetLastError WSACleanup WSAStartup WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents inet_ntop socket recvfrom sendto accept __WSAFDIsSet connect recv getpeername gethostname WSASocketW

advapi32

CryptEncrypt StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW DeleteService SetServiceStatus OpenSCManagerW CloseServiceHandle CreateServiceW InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey GetUserNameA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW LookupPrivilegeValueA BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 RegGetValueA OpenServiceW

mswsock

GetAcceptExSockaddrs AcceptEx

httpapi

HttpCloseServerSession HttpReceiveHttpRequest HttpSetUrlGroupProperty HttpCreateServerSession HttpAddUrlToUrlGroup HttpSetRequestQueueProperty HttpCreateUrlGroup HttpSendResponseEntityBody HttpReceiveRequestEntityBody HttpSendHttpResponse HttpTerminate HttpCloseRequestQueue HttpCreateRequestQueue HttpCloseUrlGroup HttpInitialize

ole32

CoTaskMemFree

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo SetConsoleTextAttribute

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW SetStdHandle GetCommandLineW GetEnvironmentStringsW GetCommandLineA GetStdHandle FreeEnvironmentStringsW GetEnvironmentVariableA SetEnvironmentVariableW

api-ms-win-core-console-l1-1-0

GetConsoleCP SetConsoleMode GetConsoleMode SetConsoleCtrlHandler WriteConsoleA ReadConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents GetConsoleOutputCP WriteConsoleW

api-ms-win-core-file-l1-1-0

CreateFileW LockFileEx SetEndOfFile GetFullPathNameW UnlockFileEx GetFileSize FindFirstFileExW SetFilePointerEx GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW FlushFileBuffers GetFileTime GetVolumeInformationByHandleW GetFileInformationByHandle SetFileAttributesW SetFileInformationByHandle GetFileAttributesW FindClose GetFinalPathNameByHandleW RemoveDirectoryW FindNextFileW FindFirstFileW CreateDirectoryW DeleteFileW CreateFileA WriteFile GetFileSizeEx ReadFile GetFileType

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTime SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess SwitchToThread GetExitCodeThread GetCurrentThreadId TlsSetValue CreateThread GetCurrentThread QueueUserAPC TlsAlloc ProcessIdToSessionId TerminateThread GetProcessTimes TerminateProcess InitializeProcThreadAttributeList GetProcessId GetThreadId ExitThread GetCurrentProcessId UpdateProcThreadAttribute ExitProcess CreateProcessW TlsFree TlsGetValue GetCurrentProcess GetStartupInfoW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject CreateMutexA InitializeCriticalSection ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive SetWaitableTimer WaitForSingleObjectEx CreateEventW SleepEx InitializeCriticalSectionEx ResetEvent AcquireSRWLockShared ReleaseSRWLockShared InitializeCriticalSectionAndSpinCount CreateEventA TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects CreateWaitableTimerW

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus DeviceIoControl PostQueuedCompletionStatus CreateIoCompletionPort CancelIoEx

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter RaiseException SetLastError GetLastError SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetCPInfo IsValidCodePage GetUserDefaultLCID LCMapStringW GetLocaleInfoW GetLocaleInfoEx LCMapStringEx IsValidLocale EnumSystemLocalesW GetOEMCP FormatMessageA FormatMessageW GetACP

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte CompareStringEx CompareStringW GetStringTypeW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleFileNameA GetModuleHandleExW LoadLibraryExW FreeLibrary GetProcAddress LoadLibraryExA FreeLibraryAndExitThread GetModuleHandleA GetModuleFileNameW

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber FlushInstructionCache IsProcessorFeaturePresent OpenProcess

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW OutputDebugStringA

api-ms-win-core-memory-l1-1-0

VirtualFreeEx VirtualAllocEx VirtualProtect OpenFileMappingW VirtualAlloc UnmapViewOfFile VirtualQuery CreateFileMappingW MapViewOfFile VirtualFree

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolIo CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolCleanupGroup CreateThreadpool SetThreadpoolThreadMaximum CloseThreadpool CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CancelThreadpoolIo WaitForThreadpoolWorkCallbacks CloseThreadpoolWork StartThreadpoolIo SetThreadpoolThreadMinimum

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA LoadLibraryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx GetSystemInfo GetVersion GetSystemTime GetTickCount64 GetSystemTimeAsFileTime GetLocalTime GetSystemDirectoryW GetTickCount GetLogicalProcessorInformation

api-ms-win-core-synch-l1-2-0

Sleep WakeAllConditionVariable InitOnceBeginInitialize SleepConditionVariableCS InitializeConditionVariable SleepConditionVariableSRW InitOnceExecuteOnce WakeConditionVariable InitOnceComplete

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx MoveFileExW CopyFileExW

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW TransactNamedPipe PeekNamedPipe WaitNamedPipeW CreatePipe SetNamedPipeHandleState

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetNativeSystemInfo VerSetConditionMask

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlUnwind RtlCaptureStackBackTrace

api-ms-win-core-heap-l1-1-0

HeapReAlloc HeapAlloc HeapSize GetProcessHeap HeapFree HeapQueryInformation HeapSetInformation

api-ms-win-core-memory-l1-1-1

GetLargePageMinimum

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsGetValue FlsSetValue

api-ms-win-core-memory-l1-1-6

VirtualAlloc2

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

winhttp

WinHttpCrackUrl WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCloseHandle

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

kernel32

Module32NextW GetNumaNodeProcessorMask GetComputerNameW GetComputerNameA Module32FirstW CreateToolhelp32Snapshot MoveFileW OpenMutexA VerifyVersionInfoW

api-ms-win-core-console-l1-2-0

PeekConsoleInputA

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler AddVectoredExceptionHandler

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.zcold

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

372KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zlog

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=259, version=30795,

count=230, id=261, version=30795,

count=32, id=260, version=30795,

count=90, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=253, version=34321,

count=19, id=260, version=34321,

count=14, id=259, version=34321,

count=1, id=262, version=30795,

count=5, id=259, version=34435,

count=23, id=257, version=30795,

count=13, productName=Unmarked objects (old),

count=56, id=261, version=30156,

count=85, id=261, version=34435,

count=196, id=260, version=34435,

count=446, id=1, productName=Unmarked objects,

count=109, id=261, version=34321,

count=138, id=265, version=34435,

count=1, id=255, version=34435,

count=1, id=151,

count=1, id=258, version=34435,