2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 45.2MB
Sample261003-k6s3dacd46
SHA256 14a7ed0b6724f3fef0e7b7db325e623803adf8c439df597e1513df724e5e0310
MD5 8010a862ac4227b5bb015f7a35dfb571
SHA1 ed9ce3946db500f1c611df58a3b9317b541d08c9
SHA512 56d3868b5821ed7b3f4daee77f6b46a1f6d4140fff3d069b868bbb46a80a19eac33c1e22e19bc56f1a3367469a9238f23f4722e218684f2a006fa2ccf0c85599
SSDEEP 393216:FO+LA1O1UucDVyfCwdfgjV1p1LIt28MTtxOGtaB98QjoMQFBS6CKZOyKHo:Ff71WAjMTt4VB98QjZQFQpKZOyKI
TLSH
T1E5A71B115B4D8785D226BD3CD0874501D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 45.2MB

2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH cd4617bde3fb8bdcdbf4352235e5f0d4
SHA256 14a7ed0b6724f3fef0e7b7db325e623803adf8c439df597e1513df724e5e0310
MD5 8010a862ac4227b5bb015f7a35dfb571
SHA1 ed9ce3946db500f1c611df58a3b9317b541d08c9
SHA512 56d3868b5821ed7b3f4daee77f6b46a1f6d4140fff3d069b868bbb46a80a19eac33c1e22e19bc56f1a3367469a9238f23f4722e218684f2a006fa2ccf0c85599
SSDEEP 393216:FO+LA1O1UucDVyfCwdfgjV1p1LIt28MTtxOGtaB98QjoMQFBS6CKZOyKHo:Ff71WAjMTt4VB98QjZQFQpKZOyKI
TLSH
T1E5A71B115B4D8785D226BD3CD0874501D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40951591

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Symbols\__=^.^=_hi_buddy.pdb

ws2_32

freeaddrinfo WSASetLastError listen inet_ntop WSAStartup getaddrinfo WSACleanup WSAGetLastError setsockopt ioctlsocket htons htonl getsockopt ntohl select gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSARecv WSAAddressToStringW connect ntohs getsockname getpeername WSASend closesocket gethostname WSAResetEvent WSAWaitForMultipleEvents inet_pton __WSAFDIsSet accept bind WSAIoctl WSASocketW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses GetNetworkParams

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitialize CoCreateInstance CoUninitialize

kernel32

GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx ResumeThread GetThreadContext GetThreadId SetThreadContext GetCommandLineA ExitProcess ReadFile WaitNamedPipeA SetWaitableTimer SetLastError GetUserDefaultLocaleName InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateMutexA CreateEventW GetTimeZoneInformation GetTickCount64 CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetExitCodeThread GetProcessId Module32Next IsWow64Process GetSystemInfo VirtualAllocEx VirtualFreeEx WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread VirtualQueryEx LoadLibraryW SuspendThread GetThreadTimes OpenThread SetUnhandledExceptionFilter GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo TerminateThread EncodePointer GetStringTypeW RaiseException WakeConditionVariable TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW AreFileApisANSI SetFileInformationByHandle SetEvent FormatMessageW PostQueuedCompletionStatus WaitForSingleObject TerminateProcess Process32First FormatMessageA GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateDirectoryA WriteConsoleW DeleteCriticalSection LocalFree DecodePointer GetFileAttributesA GetLastError GetTempPathA GetCurrentThreadId InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFullPathNameW WaitNamedPipeW GetFileType InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive LeaveCriticalSection WaitForMultipleObjects EnterCriticalSection GetSystemTime GetModuleHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW PeekNamedPipe GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetSystemDirectoryA CloseHandle Process32Next HeapReAlloc HeapSize HeapQueryInformation SetEndOfFile IsValidCodePage QueueUserAPC CreateToolhelp32Snapshot LCMapStringEx Module32First GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ReleaseSemaphore CreateSemaphoreW SetNamedPipeHandleState OpenProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared TransactNamedPipe

user32

DispatchMessageA GetDpiForSystem UpdateWindow PostQuitMessage DefWindowProcA GetMonitorInfoA SetWindowLongA GetUserObjectInformationW GetProcessWindowStation RegisterClassExW UnregisterClassW GetSystemMetrics SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos MoveWindow ReleaseCapture PeekMessageA SetProcessDPIAware GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxW SetCursorPos TranslateMessage EnumDisplayDevicesW GetWindowRect CreateWindowExW SetWindowPos IsWindowUnicode ShowWindow DestroyWindow wsprintfW MessageBoxA PostMessageA

gdi32

CreateRectRgn DeleteObject

advapi32

RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteKeyA RegCloseKey RegDeleteTreeA OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus LookupPrivilegeValueA AdjustTokenPrivileges RegDeleteValueA RegEnumValueA GetUserNameW ConvertSidToStringSidW CreateProcessAsUserA SetThreadToken SetTokenInformation LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW OpenSCManagerW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority ConvertStringSecurityDescriptorToSecurityDescriptorA ControlService FreeSid CheckTokenMembership OpenServiceW RevertToSelf PrivilegeCheck RegOpenKeyExA

oleaut32

VariantClear SysFreeString

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

shlwapi

SHDeleteKeyW

ntdll

RtlInitAnsiString RtlNtStatusToDosError RtlFreeUnicodeString RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlAnsiStringToUnicodeString

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetConnectW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

26.7MB

Virtual Size

26.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text2

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_8010a862ac4227b5bb015f7a35dfb571_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

oleaut32

imm32

dwmapi

shlwapi

ntdll

bcrypt

crypt32

wininet

generic