2026-09-29_2b2ca1ba0ed19774551f417871586513_akira

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_2b2ca1ba0ed19774551f417871586513_akira
Size 1.4MB
Sample260930-eespmsz1cy
SHA256 170e49ccf57daa8441c727e2c13e7e2ca00badcc5eb6dbd12fad6d54fe684ee1
MD5 2b2ca1ba0ed19774551f417871586513
SHA1 a801b67d67554213dc54ea2ea7ae6857d7cb657f
SHA512 7d5528368113837becdc0fc034fd3dd836030f963c2697cd7bea8ac7f29d1d456c288c18d3cd714300ae001f82bcb72029dc16fed51749372bff6ed1912de47c
SSDEEP 24576:f5Vh7y5CSbwMjlw49lPFPoeZ2GtSkMgYIO5icp+HW:w5rbjlw49lhoLGtSkMHIArp
TLSH
T11865D015FAD824D8D17BC1B9C65AC402FA723C458774DEDF6BA49A562F236E02E7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2b2ca1ba0ed19774551f417871586513_akira

File Explorer

2026-09-29_2b2ca1ba0ed19774551f417871586513_akira

.exe 1.4MB

2026-09-29_2b2ca1ba0ed19774551f417871586513_akira

IMPHASH 0582a3fe154cc413ad1f8664bd31b047
SHA256 170e49ccf57daa8441c727e2c13e7e2ca00badcc5eb6dbd12fad6d54fe684ee1
MD5 2b2ca1ba0ed19774551f417871586513
SHA1 a801b67d67554213dc54ea2ea7ae6857d7cb657f
SHA512 7d5528368113837becdc0fc034fd3dd836030f963c2697cd7bea8ac7f29d1d456c288c18d3cd714300ae001f82bcb72029dc16fed51749372bff6ed1912de47c
SSDEEP 24576:f5Vh7y5CSbwMjlw49lPFPoeZ2GtSkMgYIO5icp+HW:w5rbjlw49lhoLGtSkMHIArp
TLSH
T11865D015FAD824D8D17BC1B9C65AC402FA723C458774DEDF6BA49A562F236E02E7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

238356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\landun\p-41fe901eedae4a04b036023ad8980608\qqlivepc2\Symbol\ViewsFinalReleasex64\QQLiveSupportService.pdb

qqlivebase

?GetSystemProgramDataPath@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ

kernel32

LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection GetCurrentThreadId Sleep GetCurrentProcessId WideCharToMultiByte WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateDirectoryW GetLocalTime GetFileAttributesW GetPrivateProfileIntW CreateToolhelp32Snapshot Process32FirstW Process32NextW LockResource SetLastError RaiseException SetConsoleTextAttribute InitializeCriticalSectionEx HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetConsoleScreenBufferInfo WriteConsoleA EnterCriticalSection GetStdHandle SizeofResource FindResourceExW GetConsoleMode CreateEventW CreateMutexW LocalFree CreateThread WaitForSingleObject SetEvent DecodePointer InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree GetProcAddress LoadLibraryExA IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CloseHandle GetLastError LoadResource FindResourceW InitializeSListHead EncodePointer WriteFile ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetModuleHandleW

user32

CallWindowProcW DefWindowProcW GetWindowLongPtrW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW RegisterClassExW LoadCursorW GetClassInfoExW UnregisterClassW KillTimer SetTimer SetWindowLongPtrW CreateWindowExW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW CreateProcessAsUserW DuplicateTokenEx ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ _Mbrtowc ?_Xbad_alloc@std@@YAXXZ _Xtime_get_ticks _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join _Mtx_init_in_situ _Mtx_lock _Mtx_unlock _Cnd_signal ?id@?$numpunct@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$numpunct@D@std@@2V0locale@2@A ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memcpy memcmp memmove __std_terminate __std_exception_copy __std_exception_destroy wcsrchr _purecall memset

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _set_app_type _exit terminate _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit _invoke_watson _initialize_onexit_table _crt_atexit _configure_wide_argv _register_onexit_function _errno _invalid_parameter_noinfo exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh _recalloc calloc free malloc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcsnlen wcscpy_s wmemcpy_s isdigit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode __stdio_common_vfprintf __acrt_iob_func fwrite _fileno fclose _filelengthi64 _wfsopen fflush

api-ms-win-crt-time-l1-1-0

_gmtime64_s _localtime64_s strftime _mktime64 _mkgmtime64

api-ms-win-crt-filesystem-l1-1-0

_wmkdir _wstat64i32 _wrename _wremove

api-ms-win-crt-math-l1-1-0

_dsign ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2b2ca1ba0ed19774551f417871586513_akira

qqlivebase

kernel32

user32

advapi32

shell32

ole32

msvcp140

wtsapi32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic