2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 2.7MB
Sample260925-srwtqa1w9n
SHA256 39b1cd1670d1b925ed9e772c6c13794ab221f3748fd9f637a5b6ecb6cc3c0212
MD5 0ad5af329f1a38eefeed96e1bda9c6eb
SHA1 3bf321a7d770c069a13d8051db73f9ce295553ca
SHA512 33590e7de7bc0a7e9494aa142117ef89a618439a05628df5ae105d8ee660abc0344cb96e0429ffdcaf30c0885fe2b7c55ce221ca1b6398a182d17d3f65cefbc7
SSDEEP 49152:U3K8+5FtFpJzflDNiyH80ytwIW2qqU4rRMBs3KuZhutwKQ7P6Q+02djecpBFzLFO:lnPflW0ytwZ2qP4rRMBs3KuZhutwKQ7O
TLSH
T152D5BE06A6A801E8D0A7C178C91A5657E7B13C8517309BDF12D07A776F73AE21EFE720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 2.7MB

2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 0223e657977421b74941e0cf1a65e977
SHA256 39b1cd1670d1b925ed9e772c6c13794ab221f3748fd9f637a5b6ecb6cc3c0212
MD5 0ad5af329f1a38eefeed96e1bda9c6eb
SHA1 3bf321a7d770c069a13d8051db73f9ce295553ca
SHA512 33590e7de7bc0a7e9494aa142117ef89a618439a05628df5ae105d8ee660abc0344cb96e0429ffdcaf30c0885fe2b7c55ce221ca1b6398a182d17d3f65cefbc7
SSDEEP 49152:U3K8+5FtFpJzflDNiyH80ytwIW2qqU4rRMBs3KuZhutwKQ7P6Q+02djecpBFzLFO:lnPflW0ytwZ2qP4rRMBs3KuZhutwKQ7O
TLSH
T152D5BE06A6A801E8D0A7C178C91A5657E7B13C8517309BDF12D07A776F73AE21EFE720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

530268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\workplace\Androws\p-3c42cd467adc4568971504ca2dcedd62\Build\bin\Release\AndrowsLauncher.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

kernel32

CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex OpenProcess CreateToolhelp32Snapshot GetTimeZoneInformation GetTickCount64 OpenMutexA Process32NextW Process32FirstW CloseHandle LoadLibraryW GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime GetProcessTimes GetExitCodeProcess lstrcpynW GetCurrentProcessId LoadLibraryExW WaitForMultipleObjects CreateEventW Sleep OpenEventW GetFileAttributesExW GetLocaleInfoW WTSGetActiveConsoleSessionId FreeLibrary GetFileAttributesW DeleteFileW GetSystemInfo IsProcessorFeaturePresent CreateMutexW SignalObjectAndWait ReleaseSemaphore CreateSemaphoreW UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery UnlockFileEx HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA HeapCompact UnlockFile LockFileEx GetFileSize SystemTimeToFileTime GetSystemTime GetTickCount SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetModuleFileNameW TerminateProcess GetModuleHandleExW WriteFile GetCurrentProcess WideCharToMultiByte MultiByteToWideChar GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError GetCommandLineA HeapSize InitializeCriticalSectionEx HeapFree LocalFree GetCommandLineW GetFullPathNameA SetFilePointer RtlUnwind LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate InitializeCriticalSection GetDateFormatW GetConsoleMode EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW GetCPInfoExW InitOnceComplete InitOnceBeginInitialize InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection SwitchToThread GetExitCodeThread FormatMessageA QueryPerformanceFrequency CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFullPathNameW SetEndOfFile SetFileInformationByHandle SetFilePointerEx GetTempPathW AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared RtlPcToFileHeader FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetStringTypeW EncodePointer LCMapStringEx GetCPInfo OutputDebugStringW RtlUnwindEx InterlockedPushEntrySList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetFileType WriteConsoleW ExitProcess GetFileSizeEx FlushFileBuffers GetConsoleOutputCP

shell32

ShellExecuteExW CommandLineToArgvW ord680 SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoCreateGuid

oleaut32

VariantClear

advapi32

RegDeleteKeyW RevertToSelf RegDisablePredefinedCache CreateWellKnownSid ImpersonateLoggedOnUser CheckTokenMembership RegSetValueExW RegDeleteValueW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegOpenKeyExW SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExW OpenProcessToken InitializeSecurityDescriptor LookupAccountSidW GetTokenInformation

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

397KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

version

wtsapi32

kernel32

shell32

ole32

oleaut32

advapi32

generic