2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc
Size 15.8MB
Sample261102-3yd8cszz5j
SHA256 a6242c7f76feade29bbc828158d65e1ba23cf54b6921be9083ff11796ec7f9f3
MD5 bf09e8667d3077414b544a6529f9f0bd
SHA1 47d20ef43f0c5ac47ffef8178865e47842381284
SHA512 9bebaecaa7f56835410c8897f80c1a88589123d7f13a7964ace332e0c6087b12fe6648bfeba41eeba7114c2d1474d42964756e7c093995ccf42d6588ec06f5aa
SSDEEP 393216:SWItHy/kuerhN91gGStaAOmuTG6iEtOyxnCf4K/:m+GvgQxAj/
TLSH
T11BF64869636800EBD06781B882474617F6F177450F7376CB1AB487AE1F23EEC5A7A603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc

File Explorer

2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc

.exe 15.8MB

2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc

IMPHASH 149037f65ad2cac399f4743fc23e71b6
SHA256 a6242c7f76feade29bbc828158d65e1ba23cf54b6921be9083ff11796ec7f9f3
MD5 bf09e8667d3077414b544a6529f9f0bd
SHA1 47d20ef43f0c5ac47ffef8178865e47842381284
SHA512 9bebaecaa7f56835410c8897f80c1a88589123d7f13a7964ace332e0c6087b12fe6648bfeba41eeba7114c2d1474d42964756e7c093995ccf42d6588ec06f5aa
SSDEEP 393216:SWItHy/kuerhN91gGStaAOmuTG6iEtOyxnCf4K/:m+GvgQxAj/
TLSH
T11BF64869636800EBD06781B882474617F6F177450F7376CB1AB487AE1F23EEC5A7A603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

29:0d:dd:21:74:c4:23:50:0e:87:aa:0f:8a:53:a7:58:e3:c2:7f:59:24:33:65:e5:9e:d7:48:31:c4:15:c9:8d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Yongquan Fu,O=Yongquan Fu,L=Foshan,ST=Guangdong,C=CN

Chains

Oct 26, 2026

CN=Yongquan Fu,O=Yongquan Fu,L=Foshan,ST=Guangdong,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

PE Signature issue

Digest

72:ed:c5:5e:19:ea:c0:39:2c:ed:99:c0:26:b4:38:01:ea:f2:97:3f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Yongquan Fu,O=Yongquan Fu,L=Foshan,ST=Guangdong,C=CN

Chains

Oct 26, 2026

CN=Yongquan Fu,O=Yongquan Fu,L=Foshan,ST=Guangdong,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Minor OS version

Major OS version

Entry point

8756928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect socket WSAStartup getaddrinfo closesocket WSACleanup inet_pton getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr shutdown WSASocketA inet_ntop gethostname ioctlsocket sendto recvfrom listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv ntohs htons getsockname getpeername bind accept WSAGetLastError WSAWaitForMultipleEvents freeaddrinfo

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFindExtension CertAddCertificateContextToStore CertOpenSystemStoreW CertGetCertificateContextProperty CertFreeCertificateContext CryptQueryObject CertCloseStore CertFindCertificateInStore CertGetNameStringW CertOpenStore CertEnumCertificatesInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertDuplicateCertificateContext

gdi32

CreateSolidBrush GetDeviceCaps

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptGetProperty

urlmon

URLOpenBlockingStreamA

kernel32

GetStartupInfoW GetFileAttributesExA LoadLibraryExW RtlLookupFunctionEntry InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetStringTypeW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceBeginInitialize OutputDebugStringA CreateFileMappingA OpenFileMappingA MapViewOfFile GetCurrentThreadId Sleep GetCurrentProcessId SetLastError GetLastError LocalFree GetModuleFileNameA GetCurrentProcess InitializeCriticalSectionEx FindClose GetVolumeInformationA GetCurrentDirectoryA CreateToolhelp32Snapshot MultiByteToWideChar GetDiskFreeSpaceA GetFileAttributesA Process32NextW OutputDebugStringW DeleteFileA Process32FirstW CloseHandle GetSystemInfo WritePrivateProfileStringA SetFileAttributesA DecodePointer GetProcAddress RemoveDirectoryA DeleteCriticalSection GetModuleHandleW WideCharToMultiByte CreateProcessA GetDiskFreeSpaceExA GetSystemTime GetPrivateProfileStringA lstrcmpW GetComputerNameA ReadFile SetHandleInformation TerminateProcess CreatePipe PeekNamedPipe WaitForSingleObject CreateThread GetLocalTime GetExitCodeProcess OpenProcess CreateProcessW QueryFullProcessImageNameW GetTickCount OpenEventA GetModuleHandleA CopyFileA SetEvent ExitProcess WinExec GetCommandLineW SetDllDirectoryA CreateDirectoryA HeapFree HeapSize HeapReAlloc HeapAlloc HeapDestroy GetStartupInfoA GetProcessHeap WriteFile CreateFileA GetFileSize GetModuleFileNameW ExpandEnvironmentStringsA SetFilePointer CreateFileW SetCurrentDirectoryA GetCommandLineA EndUpdateResourceW UpdateResourceW BeginUpdateResourceW GetPrivateProfileIntA IsDebuggerPresent GetVersionExW LoadLibraryA K32GetModuleFileNameExW K32EnumProcesses DeviceIoControl SetWaitableTimer CreateWaitableTimerA MoveFileA GetNativeSystemInfo GetUserDefaultLocaleName SetInformationJobObject RtlUnwindEx AssignProcessToJobObject WaitForMultipleObjects CreateJobObjectW ResumeThread UnmapViewOfFile CreateEventW ResetEvent CreateFileMappingW CreateEventA GetShortPathNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA GetConsoleMode SetConsoleCP SetConsoleOutputCP FreeLibrary Module32FirstW Module32NextW CreateMutexA GetFileAttributesW ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx EnterCriticalSection LeaveCriticalSection FindFirstFileW GetFullPathNameW MoveFileExW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableA InitializeConditionVariable VerSetConditionMask VerifyVersionInfoW FindNextFileW GetFileType WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx FormatMessageA FlushFileBuffers GetSystemTimeAsFileTime SystemTimeToFileTime LockFileEx UnlockFile HeapCompact LoadLibraryW DeleteFileW FlushViewOfFile GetFileAttributesExW FormatMessageW GetTempPathA HeapValidate CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree GetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce GetTickCount64 SetFileCompletionNotificationModes GetModuleHandleExW RtlVirtualUnwind VirtualAlloc VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW RtlUnwind ConvertFiberToThread ConvertThreadToFiberEx SetConsoleMode ReadConsoleA ReadConsoleW RtlCaptureStackBackTrace SleepConditionVariableSRW InitOnceComplete WakeAllConditionVariable RtlPcToFileHeader GetLogicalProcessorInformationEx SwitchToThread GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx CopyFile2 CreateFile2 SetFileTime SetFileInformationByHandle SetFileAttributesW GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW CreateDirectoryW GetLocaleInfoEx LoadLibraryExA VirtualQuery WriteConsoleW SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread RtlCaptureContext UnhandledExceptionFilter IsProcessorFeaturePresent GetConsoleOutputCP SetFilePointerEx SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation SetStdHandle GetFileSizeEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetLogicalProcessorInformation GetACP

user32

LoadImageA TranslateMessage PeekMessageW DispatchMessageW MsgWaitForMultipleObjects GetWindowThreadProcessId LoadImageW FindWindowW FindWindowExW ReleaseCapture RegisterWindowMessageW KillTimer LookupIconIdFromDirectoryEx PostMessageW SetCapture ReleaseDC FindWindowA ChangeWindowMessageFilterEx LoadIconW SetTimer TrackPopupMenu RegisterClassExW SetClassLongPtrW MessageBoxW GetUserObjectInformationW GetProcessWindowStation DefWindowProcW UnhookWindowsHookEx MessageBoxA ShowWindow GetWindowLongPtrW CallNextHookEx SetWindowLongPtrW SetWindowPos CallWindowProcW GetWindowLongW SetWindowTextA OffsetRect ClientToScreen SendMessageW ScreenToClient AppendMenuW keybd_event EnumDisplaySettingsW GetDesktopWindow SetWindowsHookExW SetWindowLongW IsZoomed GetClientRect MoveWindow GetMonitorInfoW GetSystemMetrics MonitorFromWindow GetDC CreateIconFromResourceEx CreateWindowExW CreatePopupMenu GetCursorPos GetWindowRect CreateDesktopA SendMessageA EnumDesktopWindows GetWindowTextA CloseDesktop GetClassNameA PostMessageA IsWindowVisible SystemParametersInfoW GetParent UpdateWindow InvalidateRect GetAncestor GetWindow

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExA RegSetKeySecurity RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey RegCreateKeyA RegDeleteValueA RegOpenKeyExW RegSetKeyValueA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW CryptGenRandom RegOpenKeyExA

shell32

Shell_NotifyIconW SHGetSpecialFolderPathA ShellExecuteW SHGetFolderPathA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA ShellExecuteA

ole32

CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree CoSetProxyBlanket

oleaut32

SysAllocStringByteLen SafeArrayDestroy SafeArrayPutElement SysStringLen SysAllocStringLen SafeArrayCreateVector SysAllocString VariantInit VariantClear SysFreeString SysStringByteLen

secur32

DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesA DeleteSecurityContext CompleteAuthToken AcceptSecurityContext InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA InitSecurityInterfaceW

shlwapi

PathIsDirectoryA PathFileExistsA PathRemoveFileSpecA

wininet

InternetQueryOptionA

iphlpapi

if_nametoindex GetTcpTable

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

dbghelp

SymFromAddr

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

271KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp00

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_bf09e8667d3077414b544a6529f9f0bd_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc

PE Signature issue

PE Signature issue

ws2_32

crypt32

gdi32

bcrypt

urlmon

kernel32

user32

advapi32

shell32

ole32

oleaut32

secur32

shlwapi

wininet

iphlpapi

version

rpcrt4

dbghelp

generic