2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz
Size 113.7MB
Sample260809-vbksmavwfs
SHA256 bc666c0197f7975a1cbca33cb3fde7dce8f988a3c64706ecc1d1d231a40f8420
MD5 562d043c2b8d13b93ccca0e914afeb88
SHA1 5fcaa1841babe810edc29aa098d1c9b37ba37b7c
SHA512 2c41b91b3fa80f4ed9cc3d7667868ccbdab28b57de45413954f91e52cfdbdcfefe9e17d6bf29bf88e20a16d8443ba7f517b95f0cdc584de5a38aef550de79506
SSDEEP 393216:hy57a3Z40F23nAlWMn9PfDhOru/hm+vxwUdN3QSI8wxSvDazn1N5VRc+9YcEaDzH:htDn3QtRCc3Ltw18bvxOtxk2v58
TLSH
T1F948BF4263AA0881E9F7AB3589E61113E577BC026F3099CB725C07291F776E08E76F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

File Explorer

2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

.exe 113.7MB

2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

IMPHASH b96e2264c1113b06cad57e8d49c97190
SHA256 bc666c0197f7975a1cbca33cb3fde7dce8f988a3c64706ecc1d1d231a40f8420
MD5 562d043c2b8d13b93ccca0e914afeb88
SHA1 5fcaa1841babe810edc29aa098d1c9b37ba37b7c
SHA512 2c41b91b3fa80f4ed9cc3d7667868ccbdab28b57de45413954f91e52cfdbdcfefe9e17d6bf29bf88e20a16d8443ba7f517b95f0cdc584de5a38aef550de79506
SSDEEP 393216:hy57a3Z40F23nAlWMn9PfDhOru/hm+vxwUdN3QSI8wxSvDazn1N5VRc+9YcEaDzH:htDn3QtRCc3Ltw18bvxOtxk2v58
TLSH
T1F948BF4263AA0881E9F7AB3589E61113E577BC026F3099CB725C07291F776E08E76F53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

49:2e:86:22:49:44:b5:d4:94:bf:06:72:c4:27:17:30:7e:9c:cc:a6:14:0d:ca:bf:ef:d1:10:65:01:ed:3b:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Chains

Aug 7, 2026

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Subject

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Serial Number

44:4e:9c:dc:53:52:e1:8b:44:3c:82:69:e6:f3:71:6a

Issuer

CN=Cached Software Ltd,OU=Cached Exchange Sync,O=Cached Software Ltd

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 4, 2026 - Aug 4, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

22250748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

SymSetSearchPathW SymGetSearchPathW SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 SymSetOptions SymCleanup SymGetLineFromAddr64 MiniDumpWriteDump SymGetOptions SymFromAddr SymInitialize UnDecorateSymbolName

ws2_32

htonl WSAGetLastError getservbyname getservbyport ntohs ntohl closesocket getsockopt socket WSAStartup WSAIoctl recvfrom gethostname gethostbyaddr inet_ntoa inet_addr WSACleanup gethostbyname accept sendto bind send recv FreeAddrInfoW GetAddrInfoW GetNameInfoW select WSASocketW WSASend WSAGetOverlappedResult WSADuplicateSocketW shutdown listen htons WSASendTo WSARecvFrom WSARecv setsockopt getsockname getpeername ioctlsocket connect WSASetLastError

ole32

CoTaskMemFree

iphlpapi

if_indextoname CancelMibChangeNotify2 NotifyIpInterfaceChange GetBestRoute2 if_nametoindex GetAdaptersAddresses ConvertInterfaceLuidToNameW ConvertInterfaceIndexToLuid

psapi

GetModuleFileNameExW EnumProcessModules

shell32

SHGetKnownFolderPath

userenv

GetUserProfileDirectoryW

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey GetUserNameW OpenProcessToken RegNotifyChangeKeyValue RegOpenKeyExA RegQueryValueExA RegEnumKeyExA EventWriteTransfer EventSetInformation EventUnregister EventRegister ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegEnumKeyExW GetSecurityInfo SetEntriesInAclA FreeSid AllocateAndInitializeSid SystemFunction036 RegGetValueW RegQueryInfoKeyW RegQueryValueExW

user32

DispatchMessageA TranslateMessage GetProcessWindowStation MessageBoxW CharUpperA GetSystemMetrics GetMessageA MapVirtualKeyW GetUserObjectInformationW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

kernel32

CreateEventW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader RaiseException ExitProcess GetModuleHandleExW SetStdHandle ExitThread FreeLibraryAndExitThread GetFileAttributesExW SetFileAttributesW GetConsoleOutputCP GetDriveTypeW HeapSize GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetEndOfFile OutputDebugStringW GetProcessHeap FindFirstFileExW IsValidCodePage GetOEMCP CreateProcessW VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableA WideCharToMultiByte CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLocalTime SetConsoleCtrlHandler LoadResource LockResource SizeofResource FindResourceA GetLastError WaitForSingleObject CreateRemoteThread OpenProcess OpenFileMappingW GetFileType AddVectoredExceptionHandler RemoveVectoredExceptionHandler RtlCaptureStackBackTrace GetStdHandle GetCurrentProcess GetCurrentProcessId VirtualQuery MultiByteToWideChar WriteConsoleW LocalFree FormatMessageA InitOnceExecuteOnce CreateEventA GetModuleHandleA GetProcAddress LoadLibraryExA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathW SetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Sleep GetProcessTimes SetPriorityClass GetPriorityClass GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetVersionExW GetSystemTimePreciseAsFileTime GetModuleFileNameW GetProcessIoCounters FileTimeToSystemTime GetConsoleTitleW SetConsoleTitleW K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32First Process32Next SetHandleInformation CreateIoCompletionPort SetFileCompletionNotificationModes CreateFileA CreateFileW DuplicateHandle PostQueuedCompletionStatus SetEvent ResetEvent QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CancelIoEx CancelIo SwitchToThread GetStartupInfoW CreateDirectoryW GetFileAttributesW SetFileInformationByHandle TerminateProcess GetExitCodeProcess RtlUnwind GetProcessId UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject LCMapStringW K32GetModuleBaseNameW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore GetCurrentThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentProcessorNumber GetNativeSystemInfo GetProcessAffinityMask SetThreadAffinityMask CreateSemaphoreA FlushFileBuffers ReadFile WriteFile ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW CancelSynchronousIo CreateNamedPipeA GetNamedPipeHandleStateA GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl FlushViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW DebugBreak FreeLibrary LoadLibraryExW SetErrorMode GetQueuedCompletionStatus GetCurrentThreadId ReadConsoleA VirtualAlloc VirtualProtect VirtualFree VirtualLock GetACP GetModuleHandleW LoadLibraryA LoadLibraryW GetSystemTime SystemTimeToFileTime GetSystemDirectoryA SwitchToFiber DeleteFiber CreateFiberEx ConvertFiberToThread ConvertThreadToFiberEx RtlVirtualUnwind RtlAddFunctionTable RtlDeleteFunctionTable IsDebuggerPresent OutputDebugStringA SuspendThread GetThreadContext GetLocaleInfoEx GetNumberFormatEx GetCurrencyFormatEx ResolveLocaleName SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetTimeFormatEx GetDateFormatEx CreateThread ExpandEnvironmentStringsA GetQueuedCompletionStatusEx GetThreadTimes GetDynamicTimeZoneInformation GetGeoInfoW GetUserGeoID LocaleNameToLCID LCIDToLocaleName DeleteFileA GetFileSize GetTempPathA GetTempFileNameA MapViewOfFileEx SetThreadPriority GetThreadPriority QueryThreadCycleTime SleepConditionVariableSRW SetUnhandledExceptionFilter InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

winmm

timeGetTime

Name

.text

Size

21.5MB

Virtual Size

21.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43.6MB

Virtual Size

43.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

198KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

139KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

567KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cache

Size

46.6MB

Virtual Size

46.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_562d043c2b8d13b93ccca0e914afeb88_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz

PE Signature issue

dbghelp

ws2_32

ole32

iphlpapi

psapi

shell32

userenv

advapi32

user32

crypt32

bcrypt

kernel32

winmm

generic