2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk
Size 3.2MB
Sample260812-l4e86sthpb
SHA256 670e4f180a873457bdd4513e2be10d633d3ab5a7ab415ff3f3be5c4996c1d7dc
MD5 2076ae3a520536116b6dcad1298346e3
SHA1 ef0ee303bd2b91f61a78354483aa5aac6bb4d6ad
SHA512 9bc433264236bfb218ff5eeb230d9727d55e2568d62f39dadcb046be4f9c217b6951207a5cffd1ca3151a7bdc3b2b0b587762fdd8b49bd0979d2ec6265593f03
SSDEEP 49152:JgpA28W5NF+dEVU0Ytz1ojkWwc1cE5OKS2N+51NRaQxu37BvdebQKl:epzpfVSEAKBNKNGv8Ll
TLSH
T1FBF5AE07A7A581F8D9B7C1388965C507E772780517389BDF01A0C66E2FB3AF18A7A335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk

.exe 3.2MB

2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk

IMPHASH eaa6039d7eb6e6c5df830272879946da
SHA256 670e4f180a873457bdd4513e2be10d633d3ab5a7ab415ff3f3be5c4996c1d7dc
MD5 2076ae3a520536116b6dcad1298346e3
SHA1 ef0ee303bd2b91f61a78354483aa5aac6bb4d6ad
SHA512 9bc433264236bfb218ff5eeb230d9727d55e2568d62f39dadcb046be4f9c217b6951207a5cffd1ca3151a7bdc3b2b0b587762fdd8b49bd0979d2ec6265593f03
SSDEEP 49152:JgpA28W5NF+dEVU0Ytz1ojkWwc1cE5OKS2N+51NRaQxu37BvdebQKl:epzpfVSEAKBNKNGv8Ll
TLSH
T1FBF5AE07A7A581F8D9B7C1388965C507E772780517389BDF01A0C66E2FB3AF18A7A335
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1496528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wa_3rd_party_host_64.pdb

kernel32

GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetTickCount64 SizeofResource GetModuleHandleExW GetModuleFileNameW LocalAlloc FreeResource LockResource LoadResource FindResourceW SetErrorMode LoadLibraryExW InitializeCriticalSectionEx Sleep GetWindowsDirectoryW GetEnvironmentStringsW GetCurrentDirectoryW SetCurrentDirectoryW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime GetFileTime GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetSystemWindowsDirectoryW lstrcpyW GetModuleHandleW WaitForMultipleObjects CreateEventW SetEvent CreateNamedPipeW OpenProcess CreateThread GetOverlappedResult ConnectNamedPipe GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW DisconnectNamedPipe CreateDirectoryW GetCurrentProcess CreateProcessW CopyFileW SetLastError lstrcpynW GetLocaleInfoW TerminateProcess GetTempFileNameW ExpandEnvironmentStringsW GetVersionExW GetTimeZoneInformation GetSystemDirectoryW ReleaseMutex CreateMutexA VirtualAlloc VirtualFree VirtualQuery WriteConsoleW ReadConsoleW SetStdHandle MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer AreFileApisANSI InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile DecodePointer FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread RtlUnwindEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency RtlPcToFileHeader EncodePointer QueueUserWorkItem InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetCPInfo CreateTimerQueue GetThreadTimes LoadLibraryExA

user32

PostThreadMessageW wsprintfW

advapi32

RegQueryValueExW EqualSid AllocateAndInitializeSid FreeSid CheckTokenMembership QueryServiceStatus OpenServiceW RegCloseKey RegEnumKeyExW RegOpenKeyExW CloseServiceHandle OpenSCManagerW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation AccessCheck GetFileSecurityW DuplicateToken MapGenericMask LookupPrivilegeValueW AdjustTokenPrivileges RegSaveKeyW OpenProcessToken

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance IIDFromString CLSIDFromString CoAddRefServerProcess CoReleaseServerProcess OleRun

oleaut32

GetErrorInfo VariantTimeToSystemTime VariantClear SafeArrayCreateVector SafeArrayCreate SafeArrayLock VariantCopy SafeArrayPutElement SysAllocString SysFreeString SafeArrayGetDim SysStringLen SysAllocStringLen SafeArrayDestroy VariantInit SafeArrayGetElement SafeArrayUnlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

StrStrIW

wininet

HttpSendRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetReadFile HttpOpenRequestW

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_2076ae3a520536116b6dcad1298346e3_akira_glassworm_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

ole32

oleaut32

version

shlwapi

wininet

generic