2026-08-09_eb418ed3e720d896bccd22353f3e0f68_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_eb418ed3e720d896bccd22353f3e0f68_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 8.6MB
Sample260809-s78s8ahm2v
SHA256 4b0c702a639aa48fa6d6529ab3f7ad33598a76ccf0ab58ca79e50e30eff31cab
MD5 eb418ed3e720d896bccd22353f3e0f68
SHA1 f04cd1880f795fc65c07041d0efc2aafe4183599
SHA512 1de79d2a2879c7f1b814018e180225d56aca99a4aa36981477e88c1359d71a8fd20c3f97e67ebd1a7494f239638b926b74e5fab2b1c7edc2267abc68620cc5e7
SSDEEP 98304:Rr+c96q4g7xqQGwwP4OP+l2qBeUOT3x0BGACUoUWaqXD527BWG:pB7xq5Wl/AUq3x0BTCUEaqXVQBWG
TLSH
T1D7969E5AB26800E9D0B6C17CC9975617F7B278550374EBEB16A08A6B0F27BF09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_eb418ed3e720d896bccd22353f3e0f68_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-09_eb418ed3e720d896bccd22353f3e0f68_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 8.6MB

2026-08-09_eb418ed3e720d896bccd22353f3e0f68_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH e92f8f10b04f90bb8dc06d4802a4c35b
SHA256 4b0c702a639aa48fa6d6529ab3f7ad33598a76ccf0ab58ca79e50e30eff31cab
MD5 eb418ed3e720d896bccd22353f3e0f68
SHA1 f04cd1880f795fc65c07041d0efc2aafe4183599
SHA512 1de79d2a2879c7f1b814018e180225d56aca99a4aa36981477e88c1359d71a8fd20c3f97e67ebd1a7494f239638b926b74e5fab2b1c7edc2267abc68620cc5e7
SSDEEP 98304:Rr+c96q4g7xqQGwwP4OP+l2qBeUOT3x0BGACUoUWaqXD527BWG:pB7xq5Wl/AUq3x0BTCUEaqXVQBWG
TLSH
T1D7969E5AB26800E9D0B6C17CC9975617F7B278550374EBEB16A08A6B0F27BF09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5648864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

GetAdaptersAddresses

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

TlsGetValue CreateIoCompletionPort InitializeCriticalSectionAndSpinCount QueueUserAPC TerminateThread WaitForMultipleObjects RaiseException InitializeCriticalSectionEx DecodePointer GetCurrentThreadId GetSystemTime FileTimeToLocalFileTime FileTimeToSystemTime CreateFileW SetFileAttributesW GetFileAttributesW DeviceIoControl GetDriveTypeW GetFileTime GetCurrentProcess GetDiskFreeSpaceW LocalFree FormatMessageA GetThreadId GetCurrentThread SleepEx CreateWaitableTimerW GetVolumeInformationW GetComputerNameW GetModuleFileNameW CreateNamedPipeW ConnectNamedPipe DisconnectNamedPipe WideCharToMultiByte CreateProcessW GlobalMemoryStatusEx GetVersionExW GetSystemInfo GetModuleHandleA GetOverlappedResult LoadLibraryW HeapDestroy HeapReAlloc HeapSize WaitForMultipleObjectsEx CancelIo WaitForSingleObjectEx ReleaseSemaphore CreateSemaphoreW lstrlenW ReadDirectoryChangesW GetLongPathNameW SetThreadErrorMode GetVersionExA CreateDirectoryA GetStdHandle GetFileType GetVersion GetModuleFileNameA GetFileInformationByHandle GetVolumeInformationA FindFirstFileW FindNextFileW ExitThread GetCurrentProcessId GlobalMemoryStatus lstrcpyA lstrcatA lstrlenA FlushFileBuffers MapViewOfFile CreateFileMappingW SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapCompact DeleteFileW DeleteFileA LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection VirtualLock VirtualUnlock MoveFileExW GetEnvironmentVariableW GetModuleHandleExW RtlVirtualUnwind DeleteFiber ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW TlsSetValue WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetFileSizeEx EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleOutputCP SetEnvironmentVariableW GetCommandLineW GetCommandLineA GetTimeZoneInformation ExitProcess DuplicateHandle FreeLibraryAndExitThread SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler RtlPcToFileHeader RtlUnwindEx CopyFileW CreateDirectoryExW SetFilePointerEx RemoveDirectoryW GetDiskFreeSpaceExW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext CreateWaitableTimerA ResumeThread ResetEvent OpenEventA GetStringTypeExA GetUserDefaultLCID LCMapStringA LCMapStringW SetWaitableTimer GetQueuedCompletionStatus CreateThread CreateEventW OutputDebugStringA SetLastError SetConsoleTitleW AllocConsole LoadLibraryExW GetTickCount GetSystemTimeAsFileTime FreeLibrary GetModuleHandleW GetProcAddress SleepConditionVariableCS K32EnumProcesses Process32FirstW Process32NextW CreateToolhelp32Snapshot GetExitCodeProcess QueryPerformanceCounter CreateProcessA QueryPerformanceFrequency GetEnvironmentVariableA CreatePipe SetHandleInformation FindClose FindNextFileA FindFirstFileA GetFileAttributesA RemoveDirectoryA MultiByteToWideChar DeleteCriticalSection InitializeConditionVariable InitializeCriticalSection WakeAllConditionVariable GetProcessHeap HeapAlloc CreateFileA Sleep WriteFile HeapFree WaitNamedPipeA SetNamedPipeHandleState ReadFile WaitForSingleObject CreateEventA TlsFree CloseHandle TlsAlloc SetEvent GetLastError PostQueuedCompletionStatus LeaveCriticalSection EnterCriticalSection GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetStringTypeW GetExitCodeThread GetLocaleInfoEx RtlUnwind

user32

SendNotifyMessageW RegisterWindowMessageW PostMessageW SendMessageTimeoutA LoadStringA GetCursorPos GetSystemMetrics GetAsyncKeyState SetWindowsHookExW UnhookWindowsHookEx ClipCursor CallNextHookEx GetDC ReleaseDC GetDesktopWindow SetCursorPos GetCursorInfo ShowCursor MessageBoxW GetProcessWindowStation GetUserObjectInformationW

gdi32

GetPixel

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW CryptGenRandom OpenSCManagerW CloseServiceHandle CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptVerifySignatureW CryptAcquireContextW CryptDestroyKey GetUserNameA CryptSignHashW CryptImportKey StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus CryptEnumProvidersW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam RegSetValueExA ReportEventA RegisterEventSourceA ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl CreateWellKnownSid AddAccessAllowedAceEx RegSetKeyValueA RegEnumKeyExA RegGetValueA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegQueryValueExW RegOpenKeyExW GetUserNameW OpenServiceA

shell32

ShellExecuteW SHFileOperationW SHGetSpecialFolderPathA SHOpenFolderAndSelectItems SHGetFolderPathW SHCreateItemFromParsingName ord190 ord155 SHGetFolderPathA

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance CoInitialize CoInitializeSecurity CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

ws2_32

ntohs getsockopt WSASend setsockopt ioctlsocket WSASetLastError WSAGetLastError WSAStartup WSACleanup freeaddrinfo connect socket getaddrinfo closesocket htons ntohl htonl listen getsockname bind WSASocketW shutdown WSARecv getpeername recv gethostbyaddr inet_addr gethostbyname sendto send select recvfrom accept __WSAFDIsSet gethostname WSAAddressToStringA WSAStringToAddressA

mswsock

AcceptEx GetAcceptExSockaddrs

rpcrt4

UuidCreateSequential UuidToStringW RpcStringFreeW UuidCreate RpcStringFreeA UuidToStringA

bcrypt

BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptEncrypt

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptDecodeObjectEx CryptImportPublicKeyInfo CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

shlwapi

UrlEscapeW UrlEscapeA PathBuildRootW PathGetDriveNumberW UrlUnescapeA PathFindFileNameW

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpOpenRequest WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

netapi32

NetApiBufferFree NetWkstaGetInfo

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

319KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

628KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=18, id=259, version=27412,

count=231, id=261, version=27412,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=14, id=253, version=28518,

count=19, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=10, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=15, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=106, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=28, id=260, version=27412,

count=3, id=262, version=27412,

count=28, productName=Unmarked objects (old),

count=30, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=36, id=257, version=27412,

count=9, id=206, productName=VS2012 build 50727, version=50727,

count=2, id=205, productName=VS2012 build 50727, version=50727,

count=1, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=3, id=203, version=65501,

count=569, id=1, productName=Unmarked objects,

count=120, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=499, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,

count=298, id=265, version=29915,

count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,