2026-09-06_8708f4e5ce605a4e261d8101097caa04_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-06_8708f4e5ce605a4e261d8101097caa04_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.1MB
Sample260906-3e89dshr31
SHA256 8c960fbae9edfd2ca200048196cb7ae4941ff17e4f563a92d960362ac49436a2
MD5 8708f4e5ce605a4e261d8101097caa04
SHA1 803fb5d10712f3d9af7ad3e7bbd533b072ae8795
SHA512 dc530f5708fedb3beed5a25a0f63c93c6372d2e930b340cea8d4ff57a78c8411e8b6d2aeae660937ebe998d2ab7330bcc2dc5cb9282eb0fc91c9b80cb1b2213f
SSDEEP 196608:VA/UEnu6WLla0WkJ3SxNRRo/XPXyANBEsCNW5/KSskB1k:VWw6WLla0WkJ3SxNRRo/XPXyAvEsCNmO
TLSH
T12C869EAAA2BC00E9D4BBD1B8C6565527E7727415137457EF1AA0CAF60F23BE01E3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-06_8708f4e5ce605a4e261d8101097caa04_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.1MB

2026-09-06_8708f4e5ce605a4e261d8101097caa04_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH fffc49ac94dcafacbc0ec24bd316d775
SHA256 8c960fbae9edfd2ca200048196cb7ae4941ff17e4f563a92d960362ac49436a2
MD5 8708f4e5ce605a4e261d8101097caa04
SHA1 803fb5d10712f3d9af7ad3e7bbd533b072ae8795
SHA512 dc530f5708fedb3beed5a25a0f63c93c6372d2e930b340cea8d4ff57a78c8411e8b6d2aeae660937ebe998d2ab7330bcc2dc5cb9282eb0fc91c9b80cb1b2213f
SSDEEP 196608:VA/UEnu6WLla0WkJ3SxNRRo/XPXyANBEsCNW5/KSskB1k:VWw6WLla0WkJ3SxNRRo/XPXyAvEsCNmO
TLSH
T12C869EAAA2BC00E9D4BBD1B8C6565527E7727415137457EF1AA0CAF60F23BE01E3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9c:f0:30:95:d3:15:37:2b:c0:ef:06:00:e3:9d:51:f0:e4:cc:25:10:a8:10:68:7e:8f:ae:c5:cd:82:53:cc:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=7522864,CN=Whiteswan Identity Security\, Corp,O=Whiteswan Identity Security\, Corp,L=Belmont,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 3, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:79:92:c3:70:36:a7:50:55:50:c3:6f:3e:30:ba:88

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 28, 2024 - Dec 23, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6076512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\wsbui\Documents\GitHub\wsonprem\Windows\SetupHelper\x64\Release\wssvc.pdb

rpcrt4

UuidToStringW UuidToStringA RpcStringFreeA RpcStringFreeW

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringW CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertDuplicateCertificateContext CertEnumCertificatesInStore CryptStringToBinaryA CertFindExtension CertGetNameStringA CryptDecodeObject CertGetCertificateContextProperty CertOpenStore CertFindCertificateInStore CryptMsgGetParam CryptMemAlloc CertCloseStore CryptQueryObject CryptMsgOpenToDecode CryptMemFree CryptBinaryToStringA CertFreeCertificateContext CryptMsgUpdate CryptMsgClose CertComparePublicKeyInfo

wintrust

CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext

advapi32

LookupAccountNameW ReportEventW RegisterEventSourceW CryptEncrypt CryptImportKey RegGetValueW RevertToSelf LookupPrivilegeValueA ImpersonateSelf OpenThreadToken CreateProcessAsUserA ConvertSidToStringSidA LookupAccountNameA IsValidSid LookupAccountSidW GetTokenInformation DeregisterEventSource CreateServiceA SetSecurityDescriptorDacl StartServiceCtrlDispatcherA SetServiceStatus ChangeServiceConfig2W RegisterServiceCtrlHandlerA RegCreateKeyExA RegSetValueExW ReportEventA RegSetValueExA InitializeSecurityDescriptor RegOpenKeyExW RegisterEventSourceA ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW SetNamedSecurityInfoW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW GetSecurityInfo GetNamedSecurityInfoW ConvertSecurityDescriptorToStringSecurityDescriptorA RegOpenKeyExA RegQueryValueExA RegCloseKey CryptDestroyKey OpenServiceW QueryServiceConfigW ConvertSidToStringSidW EnumServicesStatusExW ConvertStringSidToSidW GetSidSubAuthority GetSidSubAuthorityCount OpenSCManagerW CloseServiceHandle EnableTraceEx2 OpenTraceW ControlTraceW CloseTrace ProcessTrace StartTraceW QueryServiceStatusEx StartServiceW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

netapi32

NetUserDel NetUserAdd NetUserSetInfo NetShareEnum NetUserGetGroups NetApiBufferFree NetLocalGroupEnum NetUserGetInfo NetUserEnum NetLocalGroupGetMembers NetUserGetLocalGroups

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW

ole32

CoUninitialize CoTaskMemFree StringFromCLSID CoInitializeEx CoSetProxyBlanket CoCreateInstance CoCreateGuid CoInitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptEncrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptGenRandom BCryptDecrypt BCryptFinishHash

shlwapi

StrStrIW PathFileExistsA

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSLogoffSession WTSQueryUserToken WTSDisconnectSession WTSEnumerateSessionsA

ntdsapi

DsUnBindW DsBindW DsCrackNamesW DsFreeNameResultW

tdh

TdhGetEventMapInformation TdhFormatProperty TdhGetProperty TdhGetEventInformation TdhGetPropertySize

ws2_32

__WSAFDIsSet WSAIoctl WSAResetEvent select getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa sendto htons WSASetLastError getnameinfo WSAPoll ntohl getpeername htonl getsockname bind accept WSAWaitForMultipleEvents WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAGetLastError shutdown setsockopt recv getsockopt ioctlsocket connect socket closesocket send WSACleanup getaddrinfo WSAStartup freeaddrinfo inet_ntop inet_pton InetNtopW ntohs gethostname recvfrom listen inet_addr

ntdll

RtlCaptureContext RtlUnwind RtlVirtualUnwind RtlUnwindEx RtlLookupFunctionEntry VerSetConditionMask RtlPcToFileHeader

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wevtapi

EvtOpenChannelConfig EvtSetChannelConfigProperty EvtSaveChannelConfig EvtClose

secur32

QueryCredentialsAttributesA QueryContextAttributesA FreeContextBuffer InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA EncryptMessage DecryptMessage DeleteSecurityContext

kernel32

IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize TlsFree GetThreadId FormatMessageA TlsGetValue TlsAlloc GetExitCodeThread ExitThread CreateThread WaitForMultipleObjects CreateMutexA SleepEx ReleaseMutex ResetEvent DeleteCriticalSection SetStdHandle HeapReAlloc DeleteFileW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetSystemTime AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock QueryPerformanceFrequency QueryPerformanceCounter FlsGetValue FlsAlloc HeapFree FlushFileBuffers HeapAlloc GetConsoleOutputCP GetCommandLineW GetCommandLineA GetModuleFileNameW SetFilePointerEx SetConsoleCtrlHandler SetEndOfFile SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread LoadLibraryExW InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList IsDebuggerPresent GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateDirectoryA GetExitCodeProcess GetProcessTimes GetEnvironmentVariableA VerifyVersionInfoW InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer RaiseException GetStringTypeW GetNativeSystemInfo SwitchToThread GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive GetFileSizeEx GetModuleHandleA PeekNamedPipe WaitForSingleObjectEx MoveFileExW GetSystemDirectoryW TlsSetValue WriteConsoleW FormatMessageW ReadConsoleW ReadConsoleA SetConsoleMode GetSystemTimeAsFileTime GetStartupInfoA GetACP GetEnvironmentVariableW GetFileType GetModuleHandleExW FindNextFileW FindFirstFileW FindClose VirtualFree SetLastError FreeLibrary GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetCurrentThreadId GetConsoleMode MoveFileExA GetCurrentProcessId GetSystemDirectoryA ExitProcess GetComputerNameA LocalAlloc lstrcmpA GetLastError FileTimeToSystemTime FileTimeToLocalFileTime LocalFree SystemTimeToFileTime WideCharToMultiByte ReadFile GetLogicalDrives GetCurrentProcess DuplicateHandle MultiByteToWideChar CreateFileA LoadLibraryA CloseHandle GetProcAddress GetDriveTypeW GetModuleFileNameA Sleep InitializeCriticalSectionEx ProcessIdToSessionId OpenEventW SetEvent GetSystemInfo GetTimeFormatEx GetDateFormatEx GetTickCount64 GetComputerNameW SetThreadPriority SetFilePointer CreateFileW GetCurrentThread CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe InitOnceExecuteOnce TerminateProcess K32GetModuleFileNameExW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW LoadLibraryW GetModuleHandleW WaitForSingleObject CreateProcessA OutputDebugStringA CreateEventA GetTickCount QueryDosDeviceW SetHandleInformation CreatePipe ResumeThread GetLogicalDriveStringsW GetFileAttributesA

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

86KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-06_8708f4e5ce605a4e261d8101097caa04_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

rpcrt4

crypt32

wintrust

advapi32

netapi32

user32

ole32

oleaut32

bcrypt

shlwapi

wtsapi32

ntdsapi

tdh

ws2_32

ntdll

userenv

wevtapi

secur32

kernel32

generic