2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar
Size 9.0MB
Sample260827-mcqfhasgph
SHA256 21d83514511dab3318e5d51f9eb88f916e2922f61269b7f6052ecefc5694d288
MD5 b28481f1abaa4d69e3f577cf29e1e480
SHA1 7c14e0a41783411b3da488e9197c3e4adf84924c
SHA512 07f0da8f4ca5d4b5d1d4bb432bcb7ab4ba19ce766b1de4f9652647ffdbdd4a4dd82f536e266d450f165c325c718981a7a713b10e4ea2f38da411dcb7e24d2a7c
SSDEEP 24576:DjQ+NkkxTD1o/RegV3UUUUUUUUUUUUUUU08888888888888881lllllllllllllc:DjQ+NLxTqHVb9
TLSH
T15096D0C099ECC1B580B47F680C86760BD77D775AA84B31ED23FC5590FAB169CB20DA98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar

File Explorer

2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar

.exe 9.0MB

2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar

IMPHASH 2dd137fcf010eb52d5d71fc141374bde
SHA256 21d83514511dab3318e5d51f9eb88f916e2922f61269b7f6052ecefc5694d288
MD5 b28481f1abaa4d69e3f577cf29e1e480
SHA1 7c14e0a41783411b3da488e9197c3e4adf84924c
SHA512 07f0da8f4ca5d4b5d1d4bb432bcb7ab4ba19ce766b1de4f9652647ffdbdd4a4dd82f536e266d450f165c325c718981a7a713b10e4ea2f38da411dcb7e24d2a7c
SSDEEP 24576:DjQ+NkkxTD1o/RegV3UUUUUUUUUUUUUUU08888888888888881lllllllllllllc:DjQ+NLxTqHVb9
TLSH
T15096D0C099ECC1B580B47F680C86760BD77D775AA84B31ED23FC5590FAB169CB20DA98
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

520952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

btctools_v1_3_4_x86_32.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetSystemTimePreciseAsFileTime CloseHandle InitializeCriticalSectionEx HeapReAlloc GetFileSizeEx HeapFree GetProcessHeap FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetCurrentProcessId GetCurrentThreadId GetTickCount SetStdHandle GetLastError GetSystemInfo SetFilePointerEx GetCommandLineW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry HeapSize LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP SetEnvironmentVariableW WaitForSingleObject GetCPInfo MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetOEMCP GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW WriteFileEx SleepEx ReadFileEx CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread GetACP IsValidCodePage FindNextFileW FreeLibrary OutputDebugStringW GetCommandLineA ExitProcess WriteFile WaitForSingleObjectEx GetModuleHandleExW GetFileType RtlPcToFileHeader LoadLibraryExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

GetSystemMetrics GetDesktopWindow ShutdownBlockReasonCreate MessageBoxW DialogBoxParamW DestroyWindow SetDlgItemTextW EndDialog SetWindowPos CreateWindowExW GetWindowRect ShutdownBlockReasonDestroy

shell32

SHGetKnownFolderPath IsUserAnAdmin

ole32

CoTaskMemFree

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSendRequest WinHttpOpen WinHttpReadData

ntdll

RtlNtStatusToDosError NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile

oleaut32

GetErrorInfo SysStringLen SysFreeString

Name

.z15uo40

Size

612KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.aw5rdvq

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jkl9nub

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.0l41llq

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.r0kzm1d

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.4dxqi4q

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cmgo4if

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_b28481f1abaa4d69e3f577cf29e1e480_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_vidar

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

shell32

ole32

advapi32

winhttp

ntdll

oleaut32

generic