2026-10-22_f4eeea61a25527444997abbdad0a9669_akira_glassworm_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_f4eeea61a25527444997abbdad0a9669_akira_glassworm_icedid_mespinoza_njrat_ryuk
Size 3.0MB
Sample261023-cp76zacb23
SHA256 278e176c7d9d434e50b8fe548352eae046fc7b40e1e7763e4d791f308dfca1ed
MD5 f4eeea61a25527444997abbdad0a9669
SHA1 a6854742fbc5a9016646cba5c9cfd9566e97a1f7
SHA512 9f7850a2a8c4dc25cd9244c477e41cdc1d3334bc151a5a52d58110921eb6c43be2092ad0332170cf0937e50766c9377feb7ef68f0378f5d12ccb0e19af883f9d
SSDEEP 49152:WhDwH1OaB2gvNWjgqXFhSl9LYPNV/XcNqo+D5zS7od:aEHHSXcXu
TLSH
T1E6E58D07B7EA01E8D9B7C278C565A107E6B138551735A7EF0260836E2F33AE14E7B325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_f4eeea61a25527444997abbdad0a9669_akira_glassworm_icedid_mespinoza_njrat_ryuk

.exe 3.0MB

2026-10-22_f4eeea61a25527444997abbdad0a9669_akira_glassworm_icedid_mespinoza_njrat_ryuk

IMPHASH f1b18e871bfd5db75e85a8f2169b074a
SHA256 278e176c7d9d434e50b8fe548352eae046fc7b40e1e7763e4d791f308dfca1ed
MD5 f4eeea61a25527444997abbdad0a9669
SHA1 a6854742fbc5a9016646cba5c9cfd9566e97a1f7
SHA512 9f7850a2a8c4dc25cd9244c477e41cdc1d3334bc151a5a52d58110921eb6c43be2092ad0332170cf0937e50766c9377feb7ef68f0378f5d12ccb0e19af883f9d
SSDEEP 49152:WhDwH1OaB2gvNWjgqXFhSl9LYPNV/XcNqo+D5zS7od:aEHHSXcXu
TLSH
T1E6E58D07B7EA01E8D9B7C278C565A107E6B138551735A7EF0260836E2F33AE14E7B325
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a3:bb:07:45:08:1d:a1:21:10:eb:0c:da:a2:76:19:b8:a6:15:4c:3c:78:4f:2f:fa:cd:da:26:02:2d:84:2a:b2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

Chains

Sep 8, 2026

CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

0d:ad:d7:6d:c4:42:db:11:4e:a3:74:8e:94:b2:88:d8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2024 - May 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1654432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wa_3rd_party_host_64.pdb

kernel32

FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetNativeSystemInfo RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers InitializeCriticalSectionEx GetTickCount64 DecodePointer SizeofResource GetModuleHandleExW GetModuleFileNameW LocalAlloc FreeResource LockResource LoadResource FindResourceW SetErrorMode LoadLibraryExW GetWindowsDirectoryW GetEnvironmentStringsW OutputDebugStringW SetCurrentDirectoryW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime GetFileTime GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetSystemWindowsDirectoryW lstrcpyW CreateEventW SetEvent WaitForMultipleObjects GetCurrentProcess CreateNamedPipeW GetNamedPipeClientProcessId DisconnectNamedPipe OpenProcess CreateThread GetOverlappedResult QueryFullProcessImageNameW ConnectNamedPipe GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CreateDirectoryW CreateProcessW CopyFileW SetLastError lstrcpynW GetLocaleInfoW TerminateProcess GetTempFileNameW ExpandEnvironmentStringsW GetVersionExW GetTimeZoneInformation GetSystemDirectoryW ReleaseMutex CreateMutexA VirtualAlloc VirtualFree VirtualQuery WriteConsoleW ReadConsoleW SetStdHandle GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW AreFileApisANSI GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile GetCurrentDirectoryW FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread RtlUnwindEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread QueryPerformanceFrequency RtlPcToFileHeader EncodePointer QueueUserWorkItem InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetCPInfo CreateTimerQueue GetThreadTimes LoadLibraryExA

user32

PostThreadMessageW wsprintfW

advapi32

AdjustTokenPrivileges EqualSid CheckTokenMembership QueryServiceStatus OpenServiceW CloseServiceHandle OpenSCManagerW GetSidSubAuthorityCount GetSidSubAuthority AccessCheck GetFileSecurityW DuplicateToken MapGenericMask LookupPrivilegeValueW RegSaveKeyW SetSecurityDescriptorDacl SetSecurityDescriptorOwner AllocateAndInitializeSid SetEntriesInAclW CopySid OpenProcessToken FreeSid InitializeSecurityDescriptor GetLengthSid SetSecurityDescriptorControl GetTokenInformation RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance IIDFromString CLSIDFromString CoAddRefServerProcess CoReleaseServerProcess OleRun

oleaut32

GetErrorInfo VariantTimeToSystemTime VariantClear SafeArrayCreateVector SafeArrayCreate SafeArrayLock VariantCopy SafeArrayPutElement SysAllocString SysFreeString SafeArrayGetDim SysStringLen SysAllocStringLen SafeArrayDestroy VariantInit SafeArrayGetElement SafeArrayUnlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

StrStrIW

wininet

HttpSendRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetReadFile HttpOpenRequestW

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

714KB

Virtual Size

713KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_f4eeea61a25527444997abbdad0a9669_akira_glassworm_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

ole32

oleaut32

version

shlwapi

wininet

generic