2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 45.2MB
Sample261102-mecmesbs2l
SHA256 af052dd033ffe75ed2ad09bc6434bbd65acd18a9b24d7ca0a2c4a96182444390
MD5 bb439a61679caf55f4b2044be4a1a0c9
SHA1 ef07c36c5144fa21fa925706e10cb763dbbc2d40
SHA512 c4050ef94025140c7e0e22f4a4671e1cff7255af98494802daa2ba9dea7a44c36bb9808f32dd78814722dbb656a18a777544bcb29192c3321598d5e096520383
SSDEEP 393216:NO+LA1O1UucDVyfCwdfgjVOtsLIt28MTtjOGtVH08QowwgFBh6LKICXKHo:Nf71FPjMTtayH08Qo5gFTkKICXKI
TLSH
T133A72B115B4D8785D2267D3CD0874601D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 45.2MB

2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH cd4617bde3fb8bdcdbf4352235e5f0d4
SHA256 af052dd033ffe75ed2ad09bc6434bbd65acd18a9b24d7ca0a2c4a96182444390
MD5 bb439a61679caf55f4b2044be4a1a0c9
SHA1 ef07c36c5144fa21fa925706e10cb763dbbc2d40
SHA512 c4050ef94025140c7e0e22f4a4671e1cff7255af98494802daa2ba9dea7a44c36bb9808f32dd78814722dbb656a18a777544bcb29192c3321598d5e096520383
SSDEEP 393216:NO+LA1O1UucDVyfCwdfgjVOtsLIt28MTtjOGtVH08QowwgFBh6LKICXKHo:Nf71FPjMTtayH08Qo5gFTkKICXKI
TLSH
T133A72B115B4D8785D2267D3CD0874601D3F4BF88C32E8F1B9BE09CA9669BA427A1EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40951591

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

freeaddrinfo WSASetLastError listen inet_ntop WSAStartup getaddrinfo WSACleanup WSAGetLastError setsockopt ioctlsocket htons htonl getsockopt ntohl select gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSARecv WSAAddressToStringW connect ntohs getsockname getpeername WSASend closesocket gethostname WSAResetEvent WSAWaitForMultipleEvents inet_pton __WSAFDIsSet accept bind WSAIoctl WSASocketW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses GetNetworkParams

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitialize CoCreateInstance CoUninitialize

kernel32

GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx ResumeThread GetThreadContext GetThreadId SetThreadContext GetCommandLineA ExitProcess ReadFile WaitNamedPipeA SetWaitableTimer SetLastError GetUserDefaultLocaleName InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateMutexA CreateEventW GetTimeZoneInformation GetTickCount64 CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetExitCodeThread GetProcessId Module32Next IsWow64Process GetSystemInfo VirtualAllocEx VirtualFreeEx WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread VirtualQueryEx LoadLibraryW SuspendThread GetThreadTimes OpenThread SetUnhandledExceptionFilter GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo TerminateThread EncodePointer GetStringTypeW RaiseException WakeConditionVariable TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW AreFileApisANSI SetFileInformationByHandle SetEvent FormatMessageW PostQueuedCompletionStatus WaitForSingleObject TerminateProcess Process32First FormatMessageA GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateDirectoryA WriteConsoleW DeleteCriticalSection LocalFree DecodePointer GetFileAttributesA GetLastError GetTempPathA GetCurrentThreadId InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFullPathNameW WaitNamedPipeW GetFileType InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive LeaveCriticalSection WaitForMultipleObjects EnterCriticalSection GetSystemTime GetModuleHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW PeekNamedPipe GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetSystemDirectoryA CloseHandle Process32Next HeapReAlloc HeapSize HeapQueryInformation SetEndOfFile IsValidCodePage QueueUserAPC CreateToolhelp32Snapshot LCMapStringEx Module32First GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ReleaseSemaphore CreateSemaphoreW SetNamedPipeHandleState OpenProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared TransactNamedPipe

user32

DispatchMessageA GetDpiForSystem UpdateWindow PostQuitMessage DefWindowProcA GetMonitorInfoA SetWindowLongA GetUserObjectInformationW GetProcessWindowStation RegisterClassExW UnregisterClassW GetSystemMetrics SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos MoveWindow ReleaseCapture PeekMessageA SetProcessDPIAware GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxW SetCursorPos TranslateMessage EnumDisplayDevicesW GetWindowRect CreateWindowExW SetWindowPos IsWindowUnicode ShowWindow DestroyWindow wsprintfW MessageBoxA PostMessageA

gdi32

CreateRectRgn DeleteObject

advapi32

RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteKeyA RegCloseKey RegDeleteTreeA OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus LookupPrivilegeValueA AdjustTokenPrivileges RegDeleteValueA RegEnumValueA GetUserNameW ConvertSidToStringSidW CreateProcessAsUserA SetThreadToken SetTokenInformation LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW OpenSCManagerW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority ConvertStringSecurityDescriptorToSecurityDescriptorA ControlService FreeSid CheckTokenMembership OpenServiceW RevertToSelf PrivilegeCheck RegOpenKeyExA

oleaut32

VariantClear SysFreeString

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

shlwapi

SHDeleteKeyW

ntdll

RtlInitAnsiString RtlNtStatusToDosError RtlFreeUnicodeString RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlAnsiStringToUnicodeString

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetConnectW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

26.7MB

Virtual Size

26.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text2

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

403KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bb439a61679caf55f4b2044be4a1a0c9_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

oleaut32

imm32

dwmapi

shlwapi

ntdll

bcrypt

crypt32

wininet

generic