2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar
Size 17.6MB
Sample260905-zaemfasclb
SHA256 05301be2b0cd0e951179b08cc09fc21983d568f7617cbb929460ba05f45a0373
MD5 ec6ab89b6e0f9f7d2c2ba709b7bb4dd9
SHA1 a0a6440626bb07e2d08b8d53e2da38256afc975c
SHA512 f559498a204612f8baf9eb75e684db77594f0f220af60ccee2bf4511fe8dfd91964cb548067a40a641116836ea9c6a6ec5efaddc900e2778a6a0bb83767641f9
SSDEEP 393216:W9SLAtr+7kmitEscwyXM9Mt4Miy5aGR+i3whTnp3BEvKufG:WQAwUtEsHitHae
TLSH
T1740739E116D381C9C169C1798182672BB67B7B230331ABDF757C52F65E22B827927B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar

.exe 17.6MB

2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 1adf8673bdb26b922cd89c7ce6e90d29
SHA256 05301be2b0cd0e951179b08cc09fc21983d568f7617cbb929460ba05f45a0373
MD5 ec6ab89b6e0f9f7d2c2ba709b7bb4dd9
SHA1 a0a6440626bb07e2d08b8d53e2da38256afc975c
SHA512 f559498a204612f8baf9eb75e684db77594f0f220af60ccee2bf4511fe8dfd91964cb548067a40a641116836ea9c6a6ec5efaddc900e2778a6a0bb83767641f9
SSDEEP 393216:W9SLAtr+7kmitEscwyXM9Mt4Miy5aGR+i3whTnp3BEvKufG:WQAwUtEsHitHae
TLSH
T1740739E116D381C9C169C1798182672BB67B7B230331ABDF757C52F65E22B827927B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14996748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Documents\GitHub\web\loader\binary\Production\loader.pdb

ws2_32

WSAStartup select WSASend WSACleanup WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons htonl getsockopt WSARecv WSAAddressToStringW connect ntohs closesocket WSAIoctl bind gethostname accept __WSAFDIsSet WSAResetEvent sendto recvfrom recv send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents inet_pton inet_ntop socket gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname shutdown listen getsockname getpeername getaddrinfo WSASocketW WSASetLastError ntohl

iphlpapi

GetAdaptersInfo

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoUninitialize CoInitialize

kernel32

QueueUserAPC GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx WriteProcessMemory VirtualAlloc ResumeThread GetThreadContext GetThreadId ReadProcessMemory GetModuleHandleW SetThreadContext GetCommandLineA ExitProcess ReadFile SetWaitableTimer SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateMutexA CreateEventW CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetExitCodeThread GetProcessId IsWow64Process GetSystemInfo VirtualAllocEx VirtualFreeEx VirtualProtectEx CreateRemoteThread Module32Next LoadLibraryW SuspendThread GetThreadTimes OpenThread CreateSemaphoreW GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo TerminateThread LCMapStringEx EncodePointer GetStringTypeW RaiseException TryAcquireSRWLockExclusive WakeConditionVariable CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW SetEvent FormatMessageW PostQueuedCompletionStatus WaitForSingleObject TerminateProcess Process32First FormatMessageA GetCurrentThreadId GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateDirectoryA DeleteCriticalSection LocalFree DecodePointer GetFileAttributesA GetLastError GetTempPathA InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FreeLibrary SetNamedPipeHandleState VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers CopyFileW AreFileApisANSI TransactNamedPipe WaitNamedPipeW GetFileType InitializeSRWLock ReleaseSRWLockExclusive LeaveCriticalSection SetFileInformationByHandle WaitForMultipleObjects EnterCriticalSection GetSystemTime CloseHandle Process32Next GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW PeekNamedPipe GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetSystemDirectoryA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared GetTimeZoneInformation HeapReAlloc HeapSize CreateToolhelp32Snapshot OpenProcess HeapQueryInformation SetEndOfFile IsValidCodePage GetOEMCP GetCommandLineW Module32First GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ReleaseSemaphore SetUnhandledExceptionFilter CreateEventA VirtualQueryEx WriteConsoleW

user32

wsprintfW MessageBoxA DestroyWindow CreateWindowExW GetSystemMetrics GetUserObjectInformationW GetProcessWindowStation UnregisterClassW GetMonitorInfoA DefWindowProcA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware RegisterClassExW SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxW EnumDisplayDevicesW GetWindowRect ShowWindow PostMessageA SetWindowPos PeekMessageA TranslateMessage MoveWindow DispatchMessageA PostQuitMessage GetClientRect GetDpiForSystem UpdateWindow SetWindowLongA

gdi32

CreateRectRgn DeleteObject

advapi32

SetTokenInformation RegSetValueExA RegCreateKeyExA RegQueryValueExA CryptAcquireContextA CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteKeyA RegCloseKey RegDeleteTreeA OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus GetTokenInformation OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA RegDeleteValueA RegEnumValueA RegOpenKeyExA LookupPrivilegeValueW RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW OpenSCManagerW ConvertStringSecurityDescriptorToSecurityDescriptorA ControlService OpenServiceW RevertToSelf PrivilegeCheck SetThreadToken DuplicateTokenEx CreateProcessAsUserA ConvertSidToStringSidW GetUserNameW

shell32

ShellExecuteW ShellExecuteA

oleaut32

VariantClear SysFreeString

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

shlwapi

SHDeleteKeyW

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry RtlNtStatusToDosError RtlPcToFileHeader RtlAnsiStringToUnicodeString RtlFreeUnicodeString RtlInitAnsiString

urlmon

URLDownloadToFileA

dbghelp

SymGetTypeFromName SymInitialize SymFromName SymUnloadModule64 SymGetTypeInfo SymLoadModuleEx SymCleanup

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertOpenStore CertFreeCertificateChain

wininet

InternetCloseHandle InternetConnectW InternetOpenW InternetCrackUrlW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

14.7MB

Virtual Size

14.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_ec6ab89b6e0f9f7d2c2ba709b7bb4dd9_akira_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_stealc_vidar

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

shell32

oleaut32

imm32

dwmapi

shlwapi

ntdll

urlmon

dbghelp

bcrypt

crypt32

wininet

generic