2026-10-26_f0787037298de9e43993386512ec8907_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f0787037298de9e43993386512ec8907_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 11.8MB
Sample261027-c8y3eaaz4j
SHA256 20f898723487bb59a4066650981b348fbaf6c42ea75848c9093db917c450d100
MD5 f0787037298de9e43993386512ec8907
SHA1 b1b108fc62cb3d16aa8cf443ef043e3e9b125ea1
SHA512 b357e4d679b4a3db0ffd1d044d901fc78f09b3485db5f73bb25337684c910ed37ff25fee93a6eead8dbd9f90cdb111617d39ae86b9b4d9f0f2b5803ad52d7e01
SSDEEP 98304:0+M/AoWL+S40BkzgEQfrddAGlx0UtR/DxBbGrRSLNPfx/hRzNNy:0JFWWSksEozzzrtR/Dx1GILN5/LNQ
TLSH
T19EC69D6A72BC00EDE4BBD1BCDA465617E772740603709BDF16A046AA1F63AE05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_f0787037298de9e43993386512ec8907_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 11.8MB

2026-10-26_f0787037298de9e43993386512ec8907_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9b2adad182368d4acaa1b3794db8c35c
SHA256 20f898723487bb59a4066650981b348fbaf6c42ea75848c9093db917c450d100
MD5 f0787037298de9e43993386512ec8907
SHA1 b1b108fc62cb3d16aa8cf443ef043e3e9b125ea1
SHA512 b357e4d679b4a3db0ffd1d044d901fc78f09b3485db5f73bb25337684c910ed37ff25fee93a6eead8dbd9f90cdb111617d39ae86b9b4d9f0f2b5803ad52d7e01
SSDEEP 98304:0+M/AoWL+S40BkzgEQfrddAGlx0UtR/DxBbGrRSLNPfx/hRzNNy:0JFWWSksEozzzrtR/Dx1GILN5/LNQ
TLSH
T19EC69D6A72BC00EDE4BBD1BCDA465617E772740603709BDF16A046AA1F63AE05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

68:9c:3c:04:72:a8:2a:8b:b8:3f:ce:b4:68:cd:58:00:ca:06:4a:95:34:75:61:b8:ac:80:99:41:e9:02:5b:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Chains

Sep 8, 2025

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Serial Number

33:00:04:46:20:e5:26:fd:b1:60:32:b3:1b:00:00:00:04:46:20

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 7, 2025 - Sep 10, 2025

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:53:52:c2:03:8b:e5:9a:f8:4e:00:00:00:00:00:53

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 27, 2025 - Feb 26, 2026

Minor OS version

Major OS version

Entry point

8553464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\W10_installer_build\dev\build_x64\bin\BuildDataExtractor64.pdb

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

wsock32

inet_ntoa getservbyname getservbyport gethostbyname gethostbyaddr inet_addr getsockopt send recv ntohs htons setsockopt listen getsockname getpeername socket closesocket bind WSAGetLastError WSASetLastError gethostname ntohl htonl WSACleanup WSAStartup select connect shutdown ioctlsocket

dbghelp

SymFromAddr

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

ws2_32

inet_ntop getaddrinfo freeaddrinfo WSAIoctl WSASocketA WSAGetOverlappedResult WSARecv WSASend inet_pton recvfrom __WSAFDIsSet WSAConnect WSARecvFrom

advapi32

SetSecurityDescriptorDacl OpenProcessToken CopySid GetLengthSid GetTokenInformation SystemFunction036 RegEnumKeyExA ReportEventW RegisterEventSourceW RegGetValueA RegQueryValueExA InitializeSecurityDescriptor RegOpenKeyExA RegCloseKey GetUserNameA ReportEventA RegisterEventSourceA DeregisterEventSource IsValidSid

iphlpapi

GetBestRoute2 GetUnicastIpAddressTable FreeMibTable GetAdaptersAddresses

kernel32

InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead ResetEvent GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc InitializeCriticalSectionEx LoadLibraryExW GetModuleHandleExW InitOnceComplete RtlUnwind ExitThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW GetConsoleOutputCP ExitProcess GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx IsValidCodePage GetOEMCP GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetStdHandle WriteFile GetCurrentProcessId GetCurrentThreadId LocalFree FormatMessageA FormatMessageW GetDynamicTimeZoneInformation WideCharToMultiByte GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileSizeEx CreateFile2 CloseHandle GetLastError SetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile GetSystemInfo IsDebuggerPresent OutputDebugStringA SetHandleInformation Sleep GetCurrentProcess OpenProcess QueryFullProcessImageNameA GetTimeZoneInformation MultiByteToWideChar GetEnvironmentVariableW CreateFileW GetSystemTimeAsFileTime GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryA PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject GetTickCount SwitchToThread QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA GetFullPathNameW GetProcessTimes DuplicateHandle CreateFileA FindFirstFileA FindNextFileA FindClose SetEndOfFile SetFilePointer CreateMutexA ReleaseMutex CreateFileMappingA MapViewOfFileEx CreateSemaphoreA ReleaseSemaphore CreateDirectoryA RemoveDirectoryA CreateIoCompletionPort GetQueuedCompletionStatus FreeEnvironmentStringsW CreateEventW FlushFileBuffers GetSystemTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection TryEnterCriticalSection WriteConsoleW GetCurrentDirectoryW FindFirstFileW FindNextFileW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualAlloc VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetFileType GetModuleHandleW RtlVirtualUnwind GetACP ConvertFiberToThread ConvertThreadToFiberEx SetConsoleMode ReadConsoleA ReadConsoleW GetCurrentProcessorNumber CreateEventA CreateThread GetEnvironmentVariableA InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation ExpandEnvironmentStringsA GetWindowsDirectoryA GetVersionExA InitOnceBeginInitialize GetStringTypeW IsProcessorFeaturePresent GetLocaleInfoEx RtlPcToFileHeader GetExitCodeThread TryAcquireSRWLockExclusive WakeAllConditionVariable CreateDirectoryW FindFirstFileExW GetFileInformationByHandle SetFileInformationByHandle MoveFileExW GetFileInformationByHandleEx

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

358KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f0787037298de9e43993386512ec8907_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

user32

wsock32

dbghelp

bcrypt

ws2_32

advapi32

iphlpapi

kernel32

shell32

ole32

generic