2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk
Size 23.2MB
Sample261020-ldgdjsys4k
SHA256 41de068f3024a1bcbfea8ad488455c648ee07903e09e9fca4d663436789d0731
MD5 04cfcfd5c8815839e925693041fc03ab
SHA1 b98f53cba856d8ac53e1db78c4329450589b4521
SHA512 1758392046608b02a247622fbedd140688ee39b6988f283b0ff1b04342cb49dd3fd77d322ff8e7d358807971867958da868a9aa5125cc15e01692063ce904d3e
SSDEEP 196608:qUl4Dq00nK/Eo7FVkY4qduOoHXwcDFm1vG:qUl4Dq9K/E0FVkYzboHXw0FsvG
TLSH
T1A437F6217E5A586CD19AC47083468AB20E3130DB1B35B9FF849996393F7DAF56F3C218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk

File Explorer

2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk

.exe 23.2MB

2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk

IMPHASH 2843eebf623b4387756d4b04611fb7a0
SHA256 41de068f3024a1bcbfea8ad488455c648ee07903e09e9fca4d663436789d0731
MD5 04cfcfd5c8815839e925693041fc03ab
SHA1 b98f53cba856d8ac53e1db78c4329450589b4521
SHA512 1758392046608b02a247622fbedd140688ee39b6988f283b0ff1b04342cb49dd3fd77d322ff8e7d358807971867958da868a9aa5125cc15e01692063ce904d3e
SSDEEP 196608:qUl4Dq00nK/Eo7FVkY4qduOoHXwcDFm1vG:qUl4Dq9K/E0FVkYzboHXw0FsvG
TLSH
T1A437F6217E5A586CD19AC47083468AB20E3130DB1B35B9FF849996393F7DAF56F3C218
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17309640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zccache.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringOrdinal CompareStringW ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GenerateConsoleCtrlEvent GetACP GetCPInfo GetCommandLineA GetCommandLineW GetCompressedFileSizeW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetVolumeInformationByHandleW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32EnumProcessModulesEx K32GetModuleInformation K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OpenThread PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadDirectoryChangesW ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetStdHandle SetThreadErrorMode SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SuspendThread SwitchToThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile WriteFileEx lstrlenW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

AdjustTokenPrivileges ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW EqualSid GetAclInformation GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetTokenInformation LookupPrivilegeValueA OpenProcessToken RegGetValueW SetNamedSecurityInfoW SystemFunction036

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

EnumProcessModules GetModuleFileNameExW GetModuleInformation

shell32

CommandLineToArgvW SHGetKnownFolderPath

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

combase

CoTaskMemFree

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity

Name

.text

Size

16.8MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

915KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_04cfcfd5c8815839e925693041fc03ab_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

ws2_32

userenv

psapi

shell32

pdh

powrprof

combase

bcrypt

crypt32

generic