2026-09-16_2c852c972d37fd03567f3226a9452a58_akira_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_2c852c972d37fd03567f3226a9452a58_akira_icedid
Size 23.9MB
Sample260916-2xpr2a1v8m
SHA256 5a8b794b9aece519ddbfeab8bec50bc40922f107f24ce143e571762a8c5446da
MD5 2c852c972d37fd03567f3226a9452a58
SHA1 d901e04fa199639bb577c0c901e891ecef41a20b
SHA512 b48cf1ef87fd462b7e76199f4b6e865b5acd8b045076b202fb7105a49f7924d70a5e74fc8c8d24228bd832a51f8efad8118c8744f1b8ab27f2953123e1ba4324
SSDEEP 393216:mCjHllxmdlrzd1Wn6xOjAZ8WSI4AtJRA82xXphKiCwqFf4vIr5wFndQOqv4CDIVL:vjF+dxzd1Wn6bZfPtJRAVhKiVqFwvwSx
TLSH
T1B9473390F2A151B9E51AC43293064AB16B7FBC658704E8FB11E871173F76B704F3E6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-16_2c852c972d37fd03567f3226a9452a58_akira_icedid

.exe 23.9MB

2026-09-16_2c852c972d37fd03567f3226a9452a58_akira_icedid

IMPHASH e58be8e78c6384b41e02410bd9047e42
SHA256 5a8b794b9aece519ddbfeab8bec50bc40922f107f24ce143e571762a8c5446da
MD5 2c852c972d37fd03567f3226a9452a58
SHA1 d901e04fa199639bb577c0c901e891ecef41a20b
SHA512 b48cf1ef87fd462b7e76199f4b6e865b5acd8b045076b202fb7105a49f7924d70a5e74fc8c8d24228bd832a51f8efad8118c8744f1b8ab27f2953123e1ba4324
SSDEEP 393216:mCjHllxmdlrzd1Wn6xOjAZ8WSI4AtJRA82xXphKiCwqFf4vIr5wFndQOqv4CDIVL:vjF+dxzd1Wn6bZfPtJRAVhKiVqFwvwSx
TLSH
T1B9473390F2A151B9E51AC43293064AB16B7FBC658704E8FB11E871173F76B704F3E6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

20:56:8d:37:ab:17:94:2f:1a:2b:f1:c3:b4:07:0d:f0:2d:2a:8e:96:3b:70:6e:3a:c4:c0:ff:61:6d:04:ef:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91350206MADMB9451C,CN=Xiamen Shengdakai Technology Co.\, Ltd.,O=Xiamen Shengdakai Technology Co.\, Ltd.,ST=Fujian Sheng,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 29, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

d0:b1:58:d6:ca:a5:8f:79:e9:da:e3:b3:f9:7a:49:ff

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2026 - Apr 1, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

307880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap HeapAlloc FormatMessageW GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx DeleteFileW HeapSize GetModuleHandleW LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetProcAddress FlsFree FlushFileBuffers AddVectoredExceptionHandler SetThreadStackGuarantee GetConsoleOutputCP AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsSetValue FlsGetValue FlsAlloc GetCommandLineW lstrlenW GetProcessId GetFileInformationByHandleEx WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess CopyFileExW HeapReAlloc AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW DuplicateHandle GetFileType SetStdHandle SetEnvironmentVariableW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetWindowsDirectoryW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess WriteFile RtlPcToFileHeader LoadLibraryExW TlsFree GetSystemDirectoryW QueryPerformanceCounter Sleep TlsSetValue QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer TlsGetValue GetModuleHandleA GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode TlsAlloc MultiByteToWideChar WriteConsoleW GetCurrentProcess GetEnvironmentVariableW GetModuleFileNameW CreateFileW GetFileInformationByHandle InitializeCriticalSectionAndSpinCount GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList SetLastError GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx SetFilePointerEx CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind SetFileInformationByHandle SwitchToThread DeleteCriticalSection LeaveCriticalSection HeapFree EnterCriticalSection RaiseException CloseHandle GetLastError GetSystemTimeAsFileTime FreeLibrary EncodePointer GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlGetVersion NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoInitialize CoCreateInstance CoTaskMemFree

comctl32

SetWindowSubclass GetWindowSubclass InitCommonControlsEx DefSubclassProc RemoveWindowSubclass

user32

GetDC GetMenuItemCount DestroyMenu DefWindowProcW ShowWindow DispatchMessageW DestroyWindow ReleaseDC DeleteMenu GetAncestor GetMessageW GetMenuItemID GetSubMenu GetClassNameW AllowSetForegroundWindow GetParent SetParent SendMessageW PostMessageW EnumChildWindows SetWindowPos IsWindow GetMonitorInfoW MonitorFromWindow AdjustWindowRectEx CreateWindowExW RegisterClassExW LoadCursorW SendNotifyMessageW GetClientRect IsDialogMessageW TranslateMessage

gdi32

DeleteObject CreateDIBSection CreateSolidBrush

shell32

SHGetKnownFolderPath DragFinish

shlwapi

SHCreateMemStream

windowscodecs

WICConvertBitmapSource

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

358KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.9MB

Virtual Size

22.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

556KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_2c852c972d37fd03567f3226a9452a58_akira_icedid

kernel32

ntdll

ole32

comctl32

user32

gdi32

shell32

shlwapi

windowscodecs

bcrypt

advapi32

generic