2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc
Size 49.9MB
Sample261029-2c9ayaft3x
SHA256 480860ecb8820faa123b73f3e594f08a4d49471c842950ce14139b85571902b9
MD5 9eefe4f43d28f8878a724632bfddc5ba
SHA1 eb2b4704d71cf6ac51076feb0941c8a4012e6b4f
SHA512 ffe8675f370c9fef3e74433d37d1a89b814a0076fc8eaa40289d5d10f5c385fed097740e382771591ae23f39f5589bf574b573c6d9229f988af55aef501c677e
SSDEEP 393216:hQqaP661MiQcxNtjDBSCU0OWI3YqkuICInMfZOkNaHu4blvmaj:hQEi1zG0OfYqEMYr5v
TLSH
T1CEB79F13F2A640EDC02ED1798B579623FA7178454734AAEF06D487322F67EE46A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc

File Explorer

2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc

.exe 49.9MB

2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc

IMPHASH f5fd40ecf89e577e462f00a712c3ab71
SHA256 480860ecb8820faa123b73f3e594f08a4d49471c842950ce14139b85571902b9
MD5 9eefe4f43d28f8878a724632bfddc5ba
SHA1 eb2b4704d71cf6ac51076feb0941c8a4012e6b4f
SHA512 ffe8675f370c9fef3e74433d37d1a89b814a0076fc8eaa40289d5d10f5c385fed097740e382771591ae23f39f5589bf574b573c6d9229f988af55aef501c677e
SSDEEP 393216:hQqaP661MiQcxNtjDBSCU0OWI3YqkuICInMfZOkNaHu4blvmaj:hQEi1zG0OfYqEMYr5v
TLSH
T1CEB79F13F2A640EDC02ED1798B579623FA7178454734AAEF06D487322F67EE46A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35615568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MainPC\Documents\GitHub\cs2-external\binary\Production\cs2-external.pdb

d3d12

ord102 D3D12SerializeVersionedRootSignature ord101

d3d11

D3D11CreateDevice CreateDirect3D11DeviceFromDXGIDevice

d3dcompiler_47

D3DReflect D3DCreateBlob D3DCompile D3DPreprocess

dxgi

DXGIGetDebugInterface1 CreateDXGIFactory2 CreateDXGIFactory1

ws2_32

WSASetLastError WSAIoctl getsockopt setsockopt WSAStartup WSACleanup socket WSAGetLastError closesocket ioctlsocket shutdown inet_pton WSARecvFrom recv send ntohl WSAStringToAddressW getsockname select connect listen WSARecv WSASend WSASocketW getaddrinfo freeaddrinfo htons bind accept htonl __WSAFDIsSet

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenSystemStoreA CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertCloseStore CertCreateCertificateContext CertOpenStore CertAddEncodedCertificateToStore

iphlpapi

GetIfTable2 FreeMibTable GetIpForwardTable2 ResolveIpNetEntry2

wininet

InternetCloseHandle InternetOpenA HttpQueryInfoA InternetOpenUrlA InternetReadFile

bcrypt

BCryptGenRandom

dbghelp

StackWalk64 MiniDumpWriteDump SymSetOptions SymInitialize SymGetSearchPathW SymSetSearchPathW SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr SymGetLineFromAddr64

cfgmgr32

CM_Open_DevNode_Key CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_DevNode_PropertyW CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeW

tbs

Tbsi_GetDeviceInfo

wlanapi

WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanCloseHandle WlanQueryInterface

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CoUninitialize

kernel32

CompareStringW LCMapStringW GetOEMCP GetTimeFormatW GetDateFormatW GetCommandLineW SetStdHandle GetConsoleOutputCP HeapSize GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent RtlUnwind FlsFree CloseHandle GetModuleHandleA GetTickCount64 GetCurrentThreadId GetLocalTime GetCurrentProcessId CreateFileW GetCurrentProcess GetModuleHandleW GetModuleFileNameW GetFileAttributesW SetUnhandledExceptionFilter AddVectoredExceptionHandler SetThreadStackGuarantee AcquireSRWLockExclusive ReleaseSRWLockExclusive Sleep TerminateProcess RtlPcToFileHeader SetThreadDescription GetCurrentThread UnmapViewOfFile OpenFileMappingW OpenEventW GetLastError MapViewOfFile SetEvent WaitForSingleObject SwitchToThread ResetEvent HeapAlloc GetProcessHeap HeapReAlloc HeapFree FormatMessageA FormatMessageW InitializeSRWLock TryAcquireSRWLockExclusive WideCharToMultiByte LocalFree CreateEventW WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus SetLastError CreateWaitableTimerA CancelIoEx GetLogicalProcessorInformationEx FlsSetValue SetProcessDefaultCpuSets CreateMutexW SetPriorityClass ReleaseMutex CreateThread GetCurrentThreadStackLimits MultiByteToWideChar EnterCriticalSection LeaveCriticalSection SetErrorMode LoadLibraryA GetProcAddress FreeLibrary LoadLibraryW WriteFile ReadFile GetFileSizeEx SetFileInformationByHandle FlushFileBuffers GetSystemTimeAsFileTime SetFileTime GetFinalPathNameByHandleW CompareStringOrdinal GetFileInformationByHandleEx HeapQueryInformation GetACP QueryPerformanceFrequency GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetProcessTimes GetThreadTimes SetFileAttributesW DeleteFileW RemoveDirectoryW MoveFileExW CopyFileW SetFilePointerEx SetEndOfFile GetSystemTimes IsDebuggerPresent ProcessIdToSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess K32EnumProcessModulesEx K32GetModuleBaseNameW ReadProcessMemory WriteProcessMemory GetSystemDirectoryW LoadLibraryExW CreateWaitableTimerExW SetWaitableTimerEx OutputDebugStringA LCMapStringEx WaitForSingleObjectEx CreateEventA GetStartupInfoA GetCommandLineA ExitProcess Process32First Process32Next VerSetConditionMask GetUserDefaultUILanguage WriteConsoleA SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle GetConsoleMode GetTimeZoneInformation DeleteFileA GetTempPathA GetTempFileNameA GetFileType GetSystemInfo VerifyVersionInfoW VirtualAlloc VirtualFree MapViewOfFileEx VirtualProtect CreateFileMappingW GetFileSize TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualQuery InitializeCriticalSection DeleteCriticalSection TryEnterCriticalSection AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockShared QueryThreadCycleTime GetThreadPriority SetThreadPriority RtlAddFunctionTable RtlDeleteFunctionTable RtlCaptureStackBackTrace GetNativeSystemInfo InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW DuplicateHandle SuspendThread GetThreadContext ResumeThread CreateSemaphoreA ReleaseSemaphore RemoveVectoredExceptionHandler GetLocaleInfoEx CreateFileA GetDynamicTimeZoneInformation GetUserGeoID GetGeoInfoW InitOnceExecuteOnce ResolveLocaleName GetCurrencyFormatEx GetNumberFormatEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDateFormatEx GetTimeFormatEx FlsGetValue FlsAlloc InterlockedPushEntrySList CreateDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidCodePage IsValidLocale GetFileInformationByHandle RtlUnwindEx CancelSynchronousIo GetLocaleInfoW GetSystemCpuSetInformation RtlLookupFunctionEntry

user32

UnhookWindowsHookEx CallNextHookEx GetAncestor WindowFromPoint GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow ToUnicodeEx mouse_event MapVirtualKeyW FindWindowW GetDesktopWindow GetWindowLongPtrW EnumDisplaySettingsW MoveWindow SetProcessDPIAware LoadCursorA SetWindowLongPtrW ShowWindow UpdateWindow UnregisterClassW PeekMessageW DispatchMessageW GetWindowLongW SetWindowLongW AttachThreadInput SetForegroundWindow SetActiveWindow SetFocus SetWindowDisplayAffinity PostThreadMessageA SetCursorPos RegisterClassExW DispatchMessageA TranslateMessage GetRawInputData PeekMessageA MsgWaitForMultipleObjects ClientToScreen GetClientRect GetWindowRect SetThreadDpiAwarenessContext DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes MonitorFromWindow GetMonitorInfoW GetAsyncKeyState SendInput MessageBoxA IsWindow DefWindowProcW GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode SetCursor GetCursorPos ScreenToClient GetMessageA GetCursorInfo GetClipCursor SetWindowsHookExA GetMessageExtraInfo TrackMouseEvent DestroyWindow RegisterRawInputDevices PostQuitMessage GetPhysicalCursorPos CreateWindowExW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard

gdi32

D3DKMTSetProcessSchedulingPriorityClass

advapi32

RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueExA BuildSecurityDescriptorW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserA GetTokenInformation SetThreadToken DuplicateTokenEx SetTokenInformation RevertToSelf RegOpenKeyExW LookupPrivilegeValueA PrivilegeCheck EventRegister EventSetInformation EventUnregister EventWriteTransfer BuildExplicitAccessWithNameW

shell32

ShellExecuteW SHQueryUserNotificationState

api-ms-win-mm-time-l1-1-0

timeGetTime timeBeginPeriod timeEndPeriod

winhttp

WinHttpReadData WinHttpCloseHandle WinHttpCrackUrl WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSendRequest WinHttpOpenRequest WinHttpConnect

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler WriteConsoleW ReadConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-localization-l1-2-0

GetCPInfo GetLocaleInfoA

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA SetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

LockFile LockFileEx SetFilePointer UnlockFile FindNextFileA GetFileAttributesExW FindClose GetFullPathNameW FindFirstFileW FindNextFileW GetFileTime FindFirstFileExW GetShortPathNameW GetLongPathNameW FindFirstFileA UnlockFileEx

api-ms-win-core-handle-l1-1-0

SetHandleInformation

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait CreateFileMappingA RegisterWaitForSingleObject

api-ms-win-core-namedpipe-l1-1-0

SetNamedPipeHandleState ConnectNamedPipe PeekNamedPipe WaitNamedPipeW TransactNamedPipe CreateNamedPipeW

api-ms-win-core-io-l1-1-0

DeviceIoControl GetQueuedCompletionStatusEx GetOverlappedResult

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx QueueUserWorkItem

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor SetSecurityDescriptorDacl

api-ms-win-core-namedpipe-ansi-l1-1-0

GetNamedPipeHandleStateA

api-ms-win-core-console-l2-1-0

SetConsoleCursorPosition WriteConsoleInputW

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread CreateProcessW GetExitCodeProcess GetStartupInfoW

api-ms-win-core-file-l2-1-0

CreateHardLinkW ReadDirectoryChangesW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS WakeByAddressAll InitOnceComplete InitOnceBeginInitialize WaitOnAddress

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

api-ms-win-core-memory-l1-1-0

FlushViewOfFile

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA LoadLibraryExA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx CreateMutexA

api-ms-win-core-sysinfo-l1-1-0

GetVersion GetLogicalProcessorInformation

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext CryptAcquireContextA CryptGenRandom

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

winmm

PlaySoundA waveOutSetVolume

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

pdh

PdhOpenQueryW PdhGetFormattedCounterArrayW PdhCollectQueryData PdhAddEnglishCounterW PdhCloseQuery

dcomp

DCompositionCreateDevice

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

36.6MB

Virtual Size

36.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_9eefe4f43d28f8878a724632bfddc5ba_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc

d3d12

d3d11

d3dcompiler_47

dxgi

ws2_32

crypt32

iphlpapi

wininet

bcrypt

dbghelp

cfgmgr32

tbs

wlanapi

ole32

kernel32

user32

gdi32

advapi32

shell32

api-ms-win-mm-time-l1-1-0

winhttp

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-namedpipe-ansi-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

winmm

dwmapi

pdh

dcomp

imm32

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic