2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom
Size 16.6MB
Sample261011-fp197sys7p
SHA256 aa10b7b6236d6a7a798dbf3f18fe553906ec4b9886a06920166a9f7d1b936168
MD5 b2ce68cc700b8e34c4f4602746bf7371
SHA1 a1c87374258550909324165dcad2ca199029f7c3
SHA512 f2ca604995b9f6bc822d7ddb62c1fae9c159e61e44cb61d8e2bd1f5bb85a6d40c548daf2417e2ed6f4fb95fb69ab9db74863696dd7290f0a58ad13b45c8e8c70
SSDEEP 98304:9ezUCTlI2eKX7AlZFYIbCDz1mNuoPaXhXZ1NfjBxDPBEfGqpqPnIgHGoq7PnXIPR:E5SqKidfj3NwqPnIOkJg9q1yW1o7
TLSH
T1B6072905BA5F58ECD1AAC874834A4A735E2074DB1B36B9EF40C486393FA9BB05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

File Explorer

2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

.exe 16.6MB

2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

IMPHASH 91c66dae5ccbe66783bea493446da201
SHA256 aa10b7b6236d6a7a798dbf3f18fe553906ec4b9886a06920166a9f7d1b936168
MD5 b2ce68cc700b8e34c4f4602746bf7371
SHA1 a1c87374258550909324165dcad2ca199029f7c3
SHA512 f2ca604995b9f6bc822d7ddb62c1fae9c159e61e44cb61d8e2bd1f5bb85a6d40c548daf2417e2ed6f4fb95fb69ab9db74863696dd7290f0a58ad13b45c8e8c70
SSDEEP 98304:9ezUCTlI2eKX7AlZFYIbCDz1mNuoPaXhXZ1NfjBxDPBEfGqpqPnIgHGoq7PnXIPR:E5SqKidfj3NwqPnIOkJg9q1yW1o7
TLSH
T1B6072905BA5F58ECD1AAC874834A4A735E2074DB1B36B9EF40C486393FA9BB05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11837772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hcom.pdb

kernel32

LoadLibraryW FindNextFileW AssignProcessToJobObject SetConsoleCtrlHandler SetThreadStackGuarantee GetCurrentThread SetConsoleTextAttribute WaitForMultipleObjects GetNumberOfConsoleInputEvents SetConsoleCursorPosition CreateConsoleScreenBuffer FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorInfo CreateFileW GetFileType GetNamedPipeInfo SetInformationJobObject ReadFile WriteFile GetQueuedCompletionStatusEx GetStringTypeW GetCPInfo GetOEMCP GetACP CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW GetCurrentProcess DuplicateHandle GetHandleInformation PostQueuedCompletionStatus IsValidCodePage SetStdHandle GetFileSizeEx FreeLibrary GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA WideCharToMultiByte ReleaseMutex GetConsoleOutputCP SetFilePointerEx MultiByteToWideChar CreateJobObjectW HeapAlloc SetHandleInformation GetModuleHandleW GetFullPathNameW SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandleEx SetFileTime ReadConsoleW LCMapStringW CreateDirectoryW ExitProcess GetOverlappedResult CreateEventW GetProcessTimes CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW CompareStringW GetTempPathW DeleteFileW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer VirtualProtect SetFileAttributesW DeviceIoControl GetProcessId InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime GetFileSize LocalFree UnlockFile HeapDestroy HeapCompact GetSystemInfo DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI Process32NextW FlushFileBuffers FlsFree Process32FirstW FlsSetValue LockFileEx GetCurrentProcessId SetConsoleMode GetFileInformationByHandle lstrlenW CreateToolhelp32Snapshot GetSystemTimePreciseAsFileTime SetConsoleActiveScreenBuffer OpenProcess TerminateProcess WriteFileEx ReadFileEx SleepEx CreateThread GetConsoleScreenBufferInfo ReadConsoleInputW GetConsoleMode GetStdHandle HeapReAlloc GetExitCodeProcess WaitForSingleObject SwitchToThread FindClose CancelIo GenerateConsoleCtrlEvent HeapFree GetProcessHeap GetTimeZoneInformationForYear GetProcAddress GetModuleHandleA Sleep CloseHandle WriteConsoleW FlsGetValue IsProcessorFeaturePresent GetStartupInfoW TlsFree LoadLibraryExW GetModuleHandleExW ExitThread FreeLibraryAndExitThread FlsAlloc GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation SetEnvironmentVariableW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx GetCommandLineA InitializeCriticalSectionAndSpinCount EncodePointer EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA OutputDebugStringW SystemTimeToFileTime FormatMessageA SetCurrentDirectoryW GetCommandLineW FormatMessageW RtlPcToFileHeader GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ExpandEnvironmentStringsW SetErrorMode RtlUnwindEx AddVectoredExceptionHandler IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency InitializeSListHead

bcryptprimitives

ProcessPrng

ws2_32

WSASend WSAIoctl connect WSASocketW WSACleanup freeaddrinfo accept WSAStartup getsockopt shutdown setsockopt getaddrinfo select recv send ioctlsocket closesocket WSAGetLastError listen bind getsockname

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

crypt32

CertGetEnhancedKeyUsage CertCloseStore CertFreeCertificateContext CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertVerifyTimeValidity

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile

advapi32

RegEnumValueW RegCloseKey RegOpenKeyExW

user32

GetWindowThreadProcessId GetKeyboardLayout ToUnicodeEx GetForegroundWindow

Name

.text

Size

11.8MB

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

417KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_b2ce68cc700b8e34c4f4602746bf7371_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom

kernel32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

combase

crypt32

ntdll

advapi32

user32

generic