2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 15.1MB
Sample261102-mjgryabs4m
SHA256 61da3b7489ba289442e96fd679ed8c35f35225696e785fa6d72a41f88c10bd7e
MD5 ba45dfc741a513771f64e4a20a384620
SHA1 32ef3e040a30f8de7bfe71c756328c91563d3b25
SHA512 d78e30042e4b1ccbfa3d9c19c538f848950524706c4c163642f5006ff9f20b8c55d1a124274f1cc461f7c42ba322fda088a9c45bd9f225bed064702eeed32e9c
SSDEEP 98304:5C+jVE0MGelOtE6pyjyQq3AE3fsCSzi/Z6VZZuyPc3oBb31T5tCOXcchwqmRGCXC:k5OtN+8STZHPmoBz1NtCOsQw93duDu
TLSH
T1B1F66C26769A58EDC06AC474834A4B639A7274CB0B35BAEF41D486753F6ABF01F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 15.1MB

2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH b52211c51978683df8d5a1d1e244b7b9
SHA256 61da3b7489ba289442e96fd679ed8c35f35225696e785fa6d72a41f88c10bd7e
MD5 ba45dfc741a513771f64e4a20a384620
SHA1 32ef3e040a30f8de7bfe71c756328c91563d3b25
SHA512 d78e30042e4b1ccbfa3d9c19c538f848950524706c4c163642f5006ff9f20b8c55d1a124274f1cc461f7c42ba322fda088a9c45bd9f225bed064702eeed32e9c
SSDEEP 98304:5C+jVE0MGelOtE6pyjyQq3AE3fsCSzi/Z6VZZuyPc3oBb31T5tCOXcchwqmRGCXC:k5OtN+8STZHPmoBz1NtCOsQw93duDu
TLSH
T1B1F66C26769A58EDC06AC474834A4B639A7274CB0B35BAEF41D486753F6ABF01F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10562316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

listary_core.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte GetTimeZoneInformationForYear CreateWaitableTimerExW Sleep SetWaitableTimer WaitForSingleObject QueryPerformanceCounter GetSystemInfo SwitchToThread GetSystemTimePreciseAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage DeviceIoControl SetFilePointer ReadFile DuplicateHandle TerminateProcess FindClose CreateSemaphoreW CreateFileW CreateEventW GetFileInformationByHandle SetEvent ReleaseSemaphore QueryPerformanceFrequency GetFileInformationByHandleEx DeleteFileW FindFirstVolumeW GetDriveTypeW GetVolumeInformationW FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW OpenProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCommandLineW ReadConsoleW PostQueuedCompletionStatus GetFileSizeEx GetConsoleOutputCP GetQueuedCompletionStatusEx EnumSystemLocalesW GetUserDefaultLCID CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIo ReadDirectoryChangesW GetModuleHandleA GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree SetConsoleTextAttribute GetConsoleScreenBufferInfo GetLastError SetConsoleMode GetConsoleMode GetStdHandle HeapReAlloc SetEnvironmentVariableW SetStdHandle CloseHandle FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetComputerNameExW HeapSize GetNativeSystemInfo GetCommandLineA GetModuleHandleExW LoadLibraryExW VirtualQuery FreeLibrary FreeLibraryAndExitThread MultiByteToWideChar WriteConsoleW GetModuleHandleW FormatMessageW GetCurrentDirectoryW GetEnvironmentVariableW GetModuleFileNameW SetFileInformationByHandle GetFullPathNameW FindNextFileW CreateDirectoryW FindFirstFileW ExitThread TlsFree InitializeCriticalSectionAndSpinCount CreateThread ExitProcess HeapAlloc GetProcessHeap GetFileType SetHandleInformation RtlUnwindEx GetCPInfo CompareStringEx GetStringTypeW LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FindFirstFileExW GetCurrentProcessorNumber CreateFileA GetDiskFreeSpaceExW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx SetFileTime GetCurrentThreadId GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFileEx MoveFileExW CreateHardLinkW GetComputerNameA TlsAlloc TlsGetValue TlsSetValue GetThreadId MapViewOfFile UnmapViewOfFile CreateFileMappingA FlushFileBuffers WriteFile FlushViewOfFile LocalFree FormatMessageA HeapFree GetCurrentProcess LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable RtlPcToFileHeader RaiseException GetTickCount64 GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind

ws2_32

WSACleanup getsockname getpeername recv WSAStartup connect send WSASend getaddrinfo getsockopt freeaddrinfo socket shutdown listen bind WSAIoctl setsockopt ioctlsocket WSASocketW WSAGetLastError accept closesocket

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtCreateFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertOpenStore CertCloseStore CertFreeCertificateContext CertDuplicateStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertEnumCertificatesInStore

secur32

EncryptMessage ApplyControlToken DeleteSecurityContext AcceptSecurityContext InitializeSecurityContextW DecryptMessage FreeCredentialsHandle FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleA

user32

GetSystemMetrics

psapi

GetModuleInformation GetModuleFileNameExW EnumProcessModules

rpcrt4

UuidCreateSequential RpcStringFreeA UuidToStringA

shlwapi

PathIsDirectoryW PathIsRelativeW

Name

.text

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

652KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

oleaut32

ntdll

bcrypt

advapi32

crypt32

secur32

user32

psapi

rpcrt4

shlwapi

generic