2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 5.3MB
Sample261027-bb1z3azzaz
SHA256 436f39734d455443ebeb567114237e5f3de28f2280cd5498a663d9d7793d0e21
MD5 fe698cfcf145ae14a8366e2b56c1fdf0
SHA1 336ffbb9dc2554a05f04da980d8654c456e756d1
SHA512 aafec21663af03f27efc424af5ff05c6eeb3a2686718b6ee91393b405e4d15df688d008b1de42ba94740150916d9943a2baad16e90f6fc7ac20e91ba949c7e35
SSDEEP 49152:VAx8zg9FXADosOg/L9aJEImSzlcc8s9Q5YxmkFI4L29jm7cWw3Erswt4eCb+E3pY:VxE2Ib9xLLBU3Ex6Jm9YliXuHGru6BP
TLSH
T19D463C0256EA036CF0BBE27C4A279D01E77E780A07719AEF06D015771E66FE09E79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 5.3MB

2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH aa2e83089df7d1a7c50acba855d0df54
SHA256 436f39734d455443ebeb567114237e5f3de28f2280cd5498a663d9d7793d0e21
MD5 fe698cfcf145ae14a8366e2b56c1fdf0
SHA1 336ffbb9dc2554a05f04da980d8654c456e756d1
SHA512 aafec21663af03f27efc424af5ff05c6eeb3a2686718b6ee91393b405e4d15df688d008b1de42ba94740150916d9943a2baad16e90f6fc7ac20e91ba949c7e35
SSDEEP 49152:VAx8zg9FXADosOg/L9aJEImSzlcc8s9Q5YxmkFI4L29jm7cWw3Erswt4eCb+E3pY:VxE2Ib9xLLBU3Ex6Jm9YliXuHGru6BP
TLSH
T19D463C0256EA036CF0BBE27C4A279D01E77E780A07719AEF06D015771E66FE09E79721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3982376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipCreatePath GdiplusShutdown GdiplusStartup GdipDeletePath GdipClosePathFigure GdipAddPathEllipse GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCreateStringFormat GdipMeasureString GdipDrawString GdipGetFontHeight GdipGetFontSize GdipDeleteFont GdipCreateFont GdipIsStyleAvailable GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipRestoreGraphics GdipSaveGraphics GdipSetClipPath GdipSetClipRect GdipDrawImageRectRectI GdipDrawImageRectI GdipDrawImageRect GdipFillPath GdipFillEllipse GdipFillPolygon GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipDrawLine GdipScaleWorldTransform GdipTranslateWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipSetTextureTransform GdipCreateTexture GdipCreateFontFamilyFromName GdipDeleteBrush GdipCloneBrush GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipGetPathWorldBounds GdipTransformPath GdipAddPathBezierI GdipAddPathArcI GdipAddPathLineI GdipAddPathString GdipAddPathPath GdipAlloc

gdi32

GetTextFaceW SelectObject GetGlyphIndicesW GetStockObject GetPixel GetDIBits GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt

user32

DestroyMenu GetMenuItemCount AppendMenuW DeleteMenu TrackPopupMenu GetMenuItemInfoW SetMenuItemInfoW SetForegroundWindow GetDC ReleaseDC SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect GetWindowRect MessageBoxW GetCursorPos ClientToScreen CreatePopupMenu SetWindowLongPtrW GetDesktopWindow EnumChildWindows FindWindowW FindWindowExW GetClassNameW GetWindowThreadProcessId LoadCursorW LoadIconW IsDialogMessageW SystemParametersInfoW MonitorFromPoint MonitorFromWindow GetMonitorInfoW EnumDisplayMonitors SetProcessDPIAware GetLastInputInfo GetForegroundWindow SendDlgItemMessageW GetMenuStringW GetSystemMetrics EnableWindow KillTimer SetTimer SetFocus GetKeyState SetDlgItemTextW GetDlgItem EndDialog DialogBoxIndirectParamW IsWindowVisible GetWindowLongPtrW SetWindowPos MoveWindow PrintWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW SendMessageTimeoutW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW

shlwapi

UrlCreateFromPathW PathIsRelativeW PathFindFileNameW PathFileExistsW StrCmpLogicalW ord12

shell32

Shell_NotifyIconW ShellExecuteExW ShellExecuteW CommandLineToArgvW SHCreateDirectoryExW SHGetKnownFolderPath

ole32

CoUninitialize CoIncrementMTAUsage CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance StringFromGUID2 CoCreateGuid PropVariantClear CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

CryptDestroyHash GetUserNameW OpenProcessToken OpenThreadToken GetTokenInformation ConvertSidToStringSidW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW GetSidSubAuthorityCount GetSidSubAuthority EnumDynamicTimeZoneInformation RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData

winhttp

WinHttpWebSocketQueryCloseStatus WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData

crypt32

CryptUnprotectData CryptProtectData

pdh

PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA FreeEnvironmentStringsW GetStdHandle GetEnvironmentVariableW GetCommandLineW GetEnvironmentStringsW SetStdHandle

api-ms-win-core-file-l1-1-0

SetFilePointerEx UnlockFileEx WriteFile GetFileInformationByHandle DeleteFileW CreateFileW ReadFile LockFileEx GetFullPathNameW CreateDirectoryW CompareFileTime GetFileAttributesExW GetFileAttributesW SetEndOfFile GetDriveTypeW FlushFileBuffers FindNextFileW FindFirstFileExW GetFinalPathNameByHandleW RemoveDirectoryW FindFirstFileW GetFileType GetFileSizeEx FindClose

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-namedpipe-l1-1-0

CreatePipe PeekNamedPipe WaitNamedPipeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl CancelIoEx

api-ms-win-core-synch-l1-1-0

WaitForSingleObject SleepEx CreateMutexW OpenMutexW ReleaseMutex SetEvent CreateEventW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread UpdateProcThreadAttribute TerminateProcess ExitProcess CreateThread DeleteProcThreadAttributeList GetCurrentThreadId TlsFree ResumeThread TlsAlloc TlsGetValue ExitThread TlsSetValue CreateProcessW GetExitCodeProcess InitializeProcThreadAttributeList GetCurrentProcess GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetTickCount GlobalMemoryStatusEx GetSystemDirectoryW GetTickCount64 GetSystemTime GetSystemTimeAsFileTime GetLocalTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait

api-ms-win-core-job-l2-1-0

SetInformationJobObject AssignProcessToJobObject CreateJobObjectW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW GetModuleHandleExW LoadLibraryExW GetModuleFileNameW FreeLibrary FreeLibraryAndExitThread

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree GlobalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetLocaleInfoEx IsValidLocale LCMapStringW IsValidCodePage FormatMessageW LCMapStringEx GetACP EnumSystemLocalesW GetUserDefaultLCID GetOEMCP

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx MoveFileExW

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation GetTimeZoneInformationForYear SystemTimeToTzSpecificLocalTimeEx

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx GetTimeFormatEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringOrdinal WideCharToMultiByte

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode GetConsoleOutputCP SetConsoleCtrlHandler ReadConsoleW AllocConsole

api-ms-win-core-console-l1-2-0

AttachConsole FreeConsole

api-ms-win-core-console-l2-1-0

SetConsoleOutputCP SetConsoleCP

api-ms-win-core-console-l3-2-0

GetConsoleWindow

ws2_32

bind accept WSAStartup socket ntohs setsockopt send select recv getsockname htonl listen WSACleanup closesocket ioctlsocket

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFullName GetCurrentApplicationUserModelId

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoActivateInstance RoRegisterActivationFactories RoGetActivationFactory RoRevokeActivationFactories

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString WindowsPromoteStringBuffer WindowsDeleteStringBuffer WindowsPreallocateStringBuffer WindowsCreateStringReference

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus GetComputerNameW

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

kernel32

GetProcessHeap OutputDebugStringW OutputDebugStringA SetProcessWorkingSetSize TerminateJobObject DefineDosDeviceW WakeConditionVariable DeleteCriticalSection InitializeSListHead GetStartupInfoW WakeAllConditionVariable IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent InitializeCriticalSectionAndSpinCount GetCPInfo HeapFree DecodePointer EncodePointer RaiseException RtlPcToFileHeader GetStringTypeW LocalAlloc QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive InitializeConditionVariable AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection CompareStringEx SleepConditionVariableCS SleepConditionVariableSRW InitializeCriticalSectionEx InitOnceBeginInitialize IsDebuggerPresent TryEnterCriticalSection InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedFlushSList

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapReAlloc HeapCompact HeapSize

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysStringLen SysFreeString

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1023KB

Virtual Size

1023KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar

gdiplus

gdi32

user32

shlwapi

shell32

ole32

comdlg32

advapi32

winhttp

crypt32

pdh

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-2

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l3-2-0

ws2_32

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

setupapi

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

api-ms-win-core-sysinfo-l1-2-0

generic