2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
Size 1.5MB
Sample260816-ry4bpscr6y
SHA256 c7238bb84b405f842c06aa67bd57301c011b07f137886a65e085927791ef2da2
MD5 48d1bde245818f5dfe65f246c3e40f76
SHA1 28bd1add98dec9ca44b7f247719a9f4bfe39d84b
SHA512 eab2a07e4b8c66c3abf63cb22b0b063f3fa8bc0f22b3fcda7ab2b977c870e5b6deb95623d8116381629d5679069b4e7dfa1f1b6be939246aaba983dcd08575a5
SSDEEP 24576:CZTMPo38SOau028X8qtsAv9BXJAO0RHzoIIkkiA:RBHaZ2HqX9BKO2HY
TLSH
T1D2657B03F99241E9E05DC134C7764776DA32BC469F31E5FB02D0AA152EA7AD08F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

.exe 1.5MB

2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH ebc3a7dc69efec583a1b47701a41debb
SHA256 c7238bb84b405f842c06aa67bd57301c011b07f137886a65e085927791ef2da2
MD5 48d1bde245818f5dfe65f246c3e40f76
SHA1 28bd1add98dec9ca44b7f247719a9f4bfe39d84b
SHA512 eab2a07e4b8c66c3abf63cb22b0b063f3fa8bc0f22b3fcda7ab2b977c870e5b6deb95623d8116381629d5679069b4e7dfa1f1b6be939246aaba983dcd08575a5
SSDEEP 24576:CZTMPo38SOau028X8qtsAv9BXJAO0RHzoIIkkiA:RBHaZ2HqX9BKO2HY
TLSH
T1D2657B03F99241E9E05DC134C7764776DA32BC469F31E5FB02D0AA152EA7AD08F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

02:d1:4b:6f:95:ac:1d:68:5e:64:ad:03:ac:df:80:68:0f:01:27:bd:e7:1e:ed:49:69:cc:76:af:40:71:67:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 20, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

463936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msedge_pwa_launcher.exe.pdb

advapi32

CreateProcessAsUserW EventRegister EventUnregister EventWrite RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

user32

AllowSetForegroundWindow PostMessageW

winmm

timeGetTime

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

Name

.text

Size

981KB

Virtual Size

980KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

36B

Characteristics

Name

.tls

Size

512B

Virtual Size

289B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_48d1bde245818f5dfe65f246c3e40f76_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

PE Signature issue

advapi32

kernel32

shell32

userenv

user32

winmm

ole32

generic