2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar

resource
2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar

IMPHASH fdb7401cca3e9ef033024f707c7998f8
SHA256 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2
MD5 14ae4de065de6bfc376d12469ba4077a
SHA1 fced4987cb78c96b22a8d195a72e6bff358ac51c
SHA512 6c604b9db62630cf20b58492b01b9f5e658f9c91e09fcc76b8b7eb1548bab83e75fc881242e2b18db56c350cdef848420468f62d4cdc570a60cb50f1e4d78f84
SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07m:G9Q5N0icBdUr/Qx+N0Em7m
TLSH
T149383316BA9988FCC699C070C30B4B726A75B0CA1B316DFF46C4CA743E766F51B38619
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1105432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

binding_7z.pdb

bcryptprimitives

ProcessPrng

kernel32

GetLastError HeapAlloc FormatMessageW GetProcessHeap HeapFree GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW LoadLibraryExW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW HeapSize GetStringTypeW WriteConsoleW CloseHandle GetStdHandle GetConsoleMode GetFileInformationByHandleEx GetModuleHandleW GetProcAddress SetHandleInformation PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile GetOverlappedResult WriteFile SetFileCompletionNotificationModes FreeEnvironmentStringsW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep QueryPerformanceCounter SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW FlushFileBuffers SetFileInformationByHandle GetCurrentProcess DuplicateHandle SetFilePointerEx GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess TerminateProcess QueryPerformanceFrequency HeapReAlloc lstrlenW ReleaseMutex FindNextFileW FindClose CreateFileW CreateEventW GetFileInformationByHandle CreateDirectoryW FindFirstFileExW DeleteFileW MoveFileExW GetFinalPathNameByHandleW CopyFileExW CancelIo GetFileType GetModuleFileNameW SetEnvironmentVariableW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetConsoleOutputCP MultiByteToWideChar IsProcessorFeaturePresent WideCharToMultiByte CreateThread GetModuleHandleA WaitForSingleObjectEx LoadLibraryA CreateMutexA RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlCaptureContext NtCreateFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx RtlVirtualUnwind NtDeviceIoControlFile NtWriteFile RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW SystemFunction036

secur32

InitializeSecurityContextW FreeContextBuffer AcquireCredentialsHandleA AcceptSecurityContext DeleteSecurityContext QueryContextAttributesW DecryptMessage ApplyControlToken FreeCredentialsHandle EncryptMessage

ws2_32

send WSASend setsockopt WSAIoctl shutdown WSAGetLastError WSAStartup WSACleanup freeaddrinfo getaddrinfo ioctlsocket connect closesocket recv bind WSASocketW getsockopt getpeername getsockname

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateCertificateContext CertAddCertificateContextToStore CertOpenStore CertCloseStore CertDuplicateStore

.data

SHA256 31444bee9153e7148b4c64078eb1e31fb3c943b2a6cea86e2a12d05b958341b1
MD5 9c79b9fae77cd748f23d1fd610e5935d
SHA1 87e82c6b4f8c6516add1f05bc4838d17cfdb8787
SHA512 efe1a529124a5b29e71cfbc24d7e46788351efc6c00eb844c1a4d62021f85acc8687ebbfc26d5597371092b734851b9ac1f5b6fd0bbca1fe9e696055fba7f2be
TLSH
T1668123D2B6015A87D70583316EA4DBDCA761BE48081113DB3ACD1ECFCF678868F82844
MD5 SHA1 SHA512 TLSH

.pdata

SHA256 832c21343e1ccb2b242b5f9c440637c29fce4970261a86284320dd5ab3ebad01
MD5 97d21df6e4409197d57579b9b30aa21b
SHA1 7373ecc868fef892ee10ed3f8fe2cb16759edc0e
SHA512 0f006bd8a641b0014b7cc67dfcc937c9a6675267c5fdf891ed2d77226ceed410d1abe98aa3b5c9f0e14ca240d94d630ab3fc9c27599ed81a39145d54d5eafcd4
SSDEEP 1536:rbF6zlg2BxiDksaJ7NNM3PQYJ8UD8X9H74T3meVK:rbFW1iQsAvqEUIXV74jme
TLSH
T1104317ACF1AC3A68EC4738F7595411F6C9ED38A2A7475EC230C99F2034874696FA5B44
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 d9d96cb4fc660f45a8d66db027fa412a10a3be8c9bf81c2393e1a9de23254e72
MD5 a1d70a6d8e8dea06d6d3dcf1c6173b61
SHA1 3925b1bf7e52aea33e7a358e329ce67c10f89209
SHA512 a59e5fb56f52d8d4343cb6b461fbd16bdcffc5e3321e3ce7a11a737e16e375d8f12b15eda09a2a083f8bdd71b56cf6af2fc4375caeaca864821338e18e9b46e4
SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07:G9Q5N0icBdUr/Qx+N0Em7
TLSH
T14D383306BB99CCEEDBD8D130C8170BB512A1B6801F119FE753D8CD6C7D322AA5B2552E
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 7379a81a8796f9443189bd643712319cfe8e272d1ca59fc626d297984fde7d9e
MD5 d4a060de5cbd080e84c5db3d412ceae6
SHA1 2cc5233d4eb712104edfdbd4a5696a5e2578ef83
SHA512 850353220cdf50e810b6e8b3b09205dcc025a5c66d0ed896e50c5a99e50dc2a04ef12dd57b1ea91412005ce333510f48d796a9aabdb3c46f1f2ee868fe139d1b
SSDEEP 192:3Psm8ON2aqeXL9f81rp4A6nT1Ji4+xskA8StUZDssxEX:/sm3EPeb1Al36T1Jt+BA8DZDssxE
TLSH
T1BC020AAED35706C7C56AC278E47ACE681CA62C74832DE59DF54B0271D3E732A1BD8860
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/GROUP_ICON/MAINICON

SHA256 8c648a603013df7c409f209bcc9857dce1e49ae4beefb9c612017d7df604325d
MD5 d3879b487d402a00b8e2900dfc4d43f6
SHA1 8519fcfbec58fba6c8d7a8dea94a97c20531b160
SHA512 b2feb0b1c357bf86fd9e7c9a5aabf2774d8fc92a5f8254adf3987a70d5dbae8784255ac4c80d99a7fa2985d24046aa06bf0a890dd91302b57c7b2ddc7fbeab40
TLSH
T10FB002F90BA80989C40A23BC96DF174206C9D0F651A31E03192A51BC5C1B3853C73760
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/1

SHA256 45d5549f2e6535dc58ee4a0cfb51731a7176de9095553b49bc8d948c17072ccd
MD5 6d6386a5240be18838611f4ab02f7c85
SHA1 a9d9e1977700467b80068d0f16b5964b8a18984c
SHA512 dcd1f693b1bffa3d97b8ea598de2ef24bec8de75165c0d5d5c96b918f377b349a39924c550c2743bc86100f5993cb87a99ddb19bf3b4a0949ffd4fe97121c9ba
TLSH
T10F0192C34ED63A7ED8F7100F482241B98EB78287D458860C8C23239D41A270959A0CC3
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/2

SHA256 3331d858ce28098a524c987a8c486339c3d36e4bb7ecd70d93e99cb9881a49d2
MD5 d83aeecadc3399bf864935a31c951aaa
SHA1 3045b4532b1cb0f36f6b2434347227e2c675f98c
SHA512 147aeb4fe563fb7b86cb49899de440245c806e92b966d9f359b1b797f1f31b7c1a6dba733ee56a07c10ab22871f30261de8cec106997d1b455e4c50a2fc138c3
TLSH
T112410B860E5F997F8577D303034D91D0A51B5FB71A53F64012FB82E77CA9E562508860
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/3

SHA256 34ae699a8bbe05d6f7e148293847b23afa0c6cb51b882c840b6e6da70a53fcb2
MD5 f193d7f853f4352c28f7b2a8b2f0fdbc
SHA1 b3746edd4cb99dfc953bcaeb17b4dc0975f484b8
SHA512 4b763fbc9e3804b0563fc66a92e4e197c3520cc1fd4720917fb890aa2f457786c9b031e0cb2fcf45f018aa08118f66cb7fc438ac9e53dc2ddd39ef043a90128e
TLSH
T166818D104AF153FC69A9B6F58334331CCDB24D0413A362A93B2B85E362EFFB5080D596
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/4

SHA256 1387f9ba64c94e5a6fa5282d88c36e36e115fd018341d05461ff80e461635bcd
MD5 9905bd5f80343c15b6b5aea4ca45e683
SHA1 8b159c8b8cee494a377fa5c6ead2ee1f478c9fec
SHA512 12b774bd8f66e697cbfcd28498169e730912d2531fa2e9fcac1e1018bf059592b217020b680ea792255ab32585607b6765ae4773c4e82f3c86201cdbfa61715a
SSDEEP 192:NtCgvDy6iIWSkmiqanKWlc4DV7cNfdhzCkW:NtJOIWSyqaKWy4DVofo
TLSH
T1CAD1AFF7AD04233B94302E1307294B91B515B25E570FE714B1E29E5785AC67CA5E3C3D
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/5

SHA256 afd0aeefc0822e4388822f0e6fb756256355b0b6813394cac1bb060fcfda0cf0
MD5 d210afd229287963bfbfbce787fba3a3
SHA1 9b89965745368bf9624be1b07cd158deb796dd39
SHA512 b5f31349ecb5d8fac1c56eacd27cf35f3ae6013459a71dc0c75fb8cacb393780498a6f341f004d3d7efb888dc8cab8e1736771cc3f0762fcd152f829e38ed7c0
SSDEEP 384:BV3zyMheQpjYaWOWhnNJoJXoeysogyv6iaO:BxycrpJDWhnQJXoNsAvr
TLSH
T12982D0C06082F25EF984777A54571872C7DFA678C6E7169FDA980582FC0436BB4A22A2
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/6

SHA256 276919f4bc35d52238657c9f550919bbca3586fc36712968c53f57ddaa497d18
MD5 ba310202b8b768374b70b1d7b754f181
SHA1 fcdbbfdc5092596a87aa20a9c98315a13a66bc92
SHA512 2a0d83a2e2526fe9bff7c3da0355f448f67824fba0cda8cd22aa89777aacd642e7b89549df21ceacb978cc7c629821c9eb475a2a6920373009ec70579795afb8
SSDEEP 1536:a+zQO2S/P74ivK+NR4UZ9OAKwb9mFLVoAwgGWh:XEZ5sK+TnZ0yb9mFpygh
TLSH
T18753021753C82CE7D79687B410BE782CA72C43E398B07DF9414B2649AEDE815E60580B
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/MANIFEST/1

SHA256 ca87d7c948e18207198e03fb28ddb13b53a500e2dc384e127e758e613da92178
MD5 c35124763079b01b86cd01df873a6ab1
SHA1 4424fca340c91e61f95ff2d52d5660706f5d876b
SHA512 1ce67db156a217990ddd325b237cfd60d79f81399f6133ac0a4c85f6f7174382bc5c4d2427da0705584e26170f4e338167744e5a86a55872d30b7cf01a6993ba
TLSH
T10201EF91C928A09AE30102E73B34E549153AE76F088C46FCC4C6477DA20298BCA62191
MD5 SHA1 SHA512 TLSH

.text

SHA256 b0d0d2e21bf5dad414add5fb23286ce262d4daa89b8520e18eaded71bee13d69
MD5 7974bf61a03c5b7baffc0a75ae755957
SHA1 15b26be1e126d2e653de9861b5cb22606dee1437
SHA512 6c3d71883c91418c32ce09ff30fb649f9d36731a0f11e6af035b6d9663d6d18fd153bd74c1bdfe90d0861114a52778733e5a343cf26a0e742f72d67cb3c0f2f0
SSDEEP 24576:eteGuA+isLvVuoEhWOaBz/BZYpY3bwHL:e4GIuoEEOa+O3bwr
TLSH
T1974527257AA660BCC16AC0B4D34B8A72AA3574CF173578FF069482703B59EF52B3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

SHA256 06710de9105673fffdd6f955b8bf23991ac0cae12a41ed8cc5221fda4c5e7fc5
MD5 cb61250476ee4690b53652640c483513
SHA1 e2d30f3d411f41a9f30a0c01ca70a253af5c156f
SHA512 95bb69858fdfeae5fd86084a033edd6a31902ea9fad4362cffc9c2993c4aa55ef4e9088de765ccfea44b7c01eb9609a4abf2a6ad61f0f85dad069aa1b2e89154
SSDEEP 192:HF+VsqFubrZscF8Bd1L8QsXOBZHkpz85uFWI/cHBu6t:HFVqirZsHL8NXEh4sq0Hjt
TLSH
T1C4020BA6C7941C42AD67AD2135E0CA1AAF3177C1BA60C5F7B15EC4548B8279338FC2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer