2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar
Size 22.7MB
Sample260813-lb5ncsvxcx
SHA256 5e572b065ba792763ff30834d2a5c0157b10992e2152d46c706f2e7430d7184c
MD5 690555ad5b3b6a26d9af1319173bc93f
SHA1 71ec0f32a988242f9cbdf5c9256e1492aba712b4
SHA512 4cf75e62962d7b8ebb85bc9d383e2b59189965227b9fcbfa67114b85d5e7be2ee269b0305be332c93059036307c39904d6b0e41c294d0c4964ee47444957520a
SSDEEP 393216:/MXV0iGXCMPqbVk0ktvNwNoSWCvi4k5dsu0d0LPAmk:sV0vXCMPKOtVwyCvijL0d0LQ
TLSH
T141379D217B82963AC49586BCD87E7B565B29FD640B6183C763843B2D6D732C31E32F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

File Explorer

2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

.exe 22.7MB

2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

IMPHASH 7ffc84def73211519398bcc24d422f96
SHA256 5e572b065ba792763ff30834d2a5c0157b10992e2152d46c706f2e7430d7184c
MD5 690555ad5b3b6a26d9af1319173bc93f
SHA1 71ec0f32a988242f9cbdf5c9256e1492aba712b4
SHA512 4cf75e62962d7b8ebb85bc9d383e2b59189965227b9fcbfa67114b85d5e7be2ee269b0305be332c93059036307c39904d6b0e41c294d0c4964ee47444957520a
SSDEEP 393216:/MXV0iGXCMPqbVk0ktvNwNoSWCvi4k5dsu0d0LPAmk:sV0vXCMPKOtVwyCvijL0d0LQ
TLSH
T141379D217B82963AC49586BCD87E7B565B29FD640B6183C763843B2D6D732C31E32F06
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1868624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glClear glViewport glClearColor

ws2_32

WSAGetLastError WSAStartup WSACleanup htons ntohs getservbyname getaddrinfo freeaddrinfo getnameinfo accept bind closesocket connect ioctlsocket getpeername getsockname getsockopt listen recv WSAIoctl ntohl inet_addr WSASendTo WSASend WSARecvFrom WSARecv socket shutdown setsockopt sendto send recvfrom

shell32

DragQueryPoint DragFinish DragQueryFileW ShellExecuteA ShellExecuteExW DragAcceptFiles

crypt32

PFXImportCertStore CryptDecodeObjectEx CertDuplicateCertificateContext CertGetNameStringW CertOpenSystemStoreW CertAddStoreToCollection CertAddCertificateContextToStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertVerifyCertificateChainPolicy CertVerifyRevocation CertFreeCertificateChain CertGetCertificateChain CertOpenStore

kernel32

WaitForDebugEvent TerminateProcess InitializeProcThreadAttributeList InitializeCriticalSectionEx DebugActiveProcessStop ResumeThread ContinueDebugEvent UnmapViewOfFile DuplicateHandle OpenProcess CreateEventW GetLastError UpdateProcThreadAttribute CloseHandle DeleteProcThreadAttributeList HeapAlloc DecodePointer GetProcAddress CreateFileMappingA DebugActiveProcess DeleteCriticalSection ReadProcessMemory GetProcessHeap GetModuleHandleW CreateProcessA MapViewOfFile IsWow64Process Wow64SetThreadContext Wow64GetThreadContext SuspendThread GetModuleHandleA GetThreadContext CreateFileMappingW SetThreadContext OpenThread LocalFree MoveFileExW ExitProcess GetCurrentProcessId FormatMessageA VirtualAllocEx VirtualFreeEx QueryFullProcessImageNameW GetProcessTimes GetModuleFileNameW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA FreeLibrary EnterCriticalSection LeaveCriticalSection GetVersionExW LoadLibraryW GetVolumeInformationA InitializeCriticalSection GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot QueryPerformanceCounter GetSystemTimeAsFileTime Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetCurrentThreadId Thread32First Thread32Next GetNativeSystemInfo WaitForSingleObject TerminateThread GetExitCodeThread GetThreadTimes GetCurrentThread GetProcessId ReadFile CreateNamedPipeW CreateThread ResetEvent GetTickCount Sleep GetFileAttributesW FormatMessageW CreateFileW DeleteFileW GetTempFileNameW WriteFile GetTempPathW CreateActCtxW ReleaseActCtx CreateRemoteThread VirtualProtectEx VirtualQueryEx GetEnvironmentVariableW ExitThread GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW ActivateActCtx DeactivateActCtx Module32FirstW GetSystemInfo DeviceIoControl WriteConsoleW FlushFileBuffers GetDynamicTimeZoneInformation HeapFree TlsAlloc TlsGetValue TlsSetValue TlsFree VerSetConditionMask GetModuleHandleExW QueryPerformanceFrequency GetHandleInformation SetLastError CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce GetTickCount64 SetFileCompletionNotificationModes GetStdHandle InitializeCriticalSectionAndSpinCount CreateDirectoryW GetFileAttributesExW SetEndOfFile SetFilePointer GetFileSize LoadLibraryExW GetLongPathNameW SetEnvironmentVariableW GetComputerNameW GetStartupInfoW ReleaseMutex GetConsoleMode GetTimeZoneInformation FindClose FindFirstFileW FindNextFileW SetEvent CreateMutexW WaitForMultipleObjects RaiseException FreeLibraryAndExitThread SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SetStdHandle GetCPInfo LCMapStringEx EncodePointer InitOnceBeginInitialize InitOnceComplete CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx RtlPcToFileHeader TryAcquireSRWLockExclusive GetCurrentProcess WriteProcessMemory InterlockedPushEntrySList RtlUnwindEx OutputDebugStringW SetThreadExecutionState GetFileType GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc HeapSize HeapQueryInformation IsValidCodePage GetACP IsDebuggerPresent GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW RtlUnwind

user32

EnumDisplaySettingsExW EnumDisplayDevicesW ToUnicode UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW LoadImageW DestroyIcon LoadCursorW EnumDisplayMonitors EnumDisplaySettingsW OffsetRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW RemovePropW GetPropW PtInRect ChangeDisplaySettingsExW SetPropW ReleaseDC GetRawInputDeviceInfoA GetRawInputDeviceList SetLayeredWindowAttributes MessageBoxA GetShellWindow UnregisterClassW GetWindowThreadProcessId GetWindowTextW EnumWindows SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetWindowLongW GetPropA GetDC SetForegroundWindow ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus IsZoomed BringWindowToTop IsIconic SetWindowPlacement GetWindowPlacement SetWindowPos IsWindowVisible ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent wsprintfW GetWindowLongW GetMessageExtraInfo RemovePropA SetPropA CallWindowProcW SetWindowLongPtrW GetWindowLongPtrW

gdi32

ChoosePixelFormat DeleteObject CreateRectRgn GetDeviceCaps SetDeviceGammaRamp SwapBuffers SetPixelFormat DescribePixelFormat CreateDCW DeleteDC

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString

advapi32

CryptGenRandom RegSetValueExW RegCreateKeyW RegOpenKeyW GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash RegGetValueA CryptAcquireContextW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken RegOpenKeyExW RegQueryValueExW RegEnumValueW

shlwapi

SHDeleteKeyW

mswsock

TransmitFile

bcrypt

BCryptGenerateSymmetricKey BCryptSecretAgreement BCryptSetProperty BCryptGenRandom BCryptEncrypt BCryptDestroyKey BCryptGetProperty BCryptFinalizeKeyPair BCryptDecrypt BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptExportKey BCryptCloseAlgorithmProvider BCryptDeriveKey BCryptDestroySecret BCryptImportKeyPair

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

iphlpapi

GetAdaptersAddresses

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16.8MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

330KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_690555ad5b3b6a26d9af1319173bc93f_akira_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

opengl32

ws2_32

shell32

crypt32

kernel32

user32

gdi32

ole32

oleaut32

advapi32

shlwapi

mswsock

bcrypt

imm32

iphlpapi

generic