2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat
Size 6.2MB
Sample261110-xfla3aaa35
SHA256 9b892a1679eeafd70e466cf6b74d199ba48972cf756498a2f56b697adbcc9bff
MD5 5b159f77323c1efbef57f2e38b401ca8
SHA1 e2609d68ac4ce5e2c2c4cac592de9062ee4f62ed
SHA512 4d63e7f76982d30ee02698d10284dbca6643b86168aa2c1c39087c62a78b99e4a9bf2518e59cd64d8bb7fea59e6dda05f0a15bcdd8adaacff3f1f46089e8f96b
SSDEEP 196608:SyS89cgegg/gPgh9ggErgWegggXgmEzgPsbgWjeM:SyS89cgegg/gPgh9gg8gWegggXgmEzgr
TLSH
T199668D2A62AC51D8E07BD1BDCADB8A07EB72341413315BCB059157CE1E2BEED4D7E221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat

File Explorer

2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat

.exe 6.2MB

2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat

IMPHASH 259217d5a9b2410db2c2b1979f716814
SHA256 9b892a1679eeafd70e466cf6b74d199ba48972cf756498a2f56b697adbcc9bff
MD5 5b159f77323c1efbef57f2e38b401ca8
SHA1 e2609d68ac4ce5e2c2c4cac592de9062ee4f62ed
SHA512 4d63e7f76982d30ee02698d10284dbca6643b86168aa2c1c39087c62a78b99e4a9bf2518e59cd64d8bb7fea59e6dda05f0a15bcdd8adaacff3f1f46089e8f96b
SSDEEP 196608:SyS89cgegg/gPgh9ggErgWegggXgmEzgPsbgWjeM:SyS89cgegg/gPgh9gg8gWegggXgmEzgr
TLSH
T199668D2A62AC51D8E07BD1BDCADB8A07EB72341413315BCB059157CE1E2BEED4D7E221
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13946

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MoHamed0\Desktop\KUVLR\build\x64-recovery\bin\kuvlr.pdb

dbghelp

SymGetLineFromAddr64 MiniDumpReadDumpStream SymFromAddr SymLoadModuleEx SymInitialize MiniDumpWriteDump SymGetModuleInfo64 SymCleanup SymSetOptions

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

SetFileTime HeapSize OutputDebugStringW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc DeleteFileW SetEnvironmentVariableW ReadConsoleW SetFilePointerEx GetCurrentProcessId GetCurrentThreadId CreateFileA CloseHandle GetLastError GetCurrentProcess SetUnhandledExceptionFilter GetModuleFileNameA GetModuleHandleExA ReadFile WriteFile MultiByteToWideChar WideCharToMultiByte VirtualAlloc VirtualFree MapViewOfFile UnmapViewOfFile CreateFileMappingA WriteConsoleW FlushFileBuffers Sleep GetDynamicTimeZoneInformation GetStdHandle GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute QueryPerformanceCounter WaitForSingleObject SetWaitableTimer CreateWaitableTimerA AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetSystemTime SystemTimeToFileTime GetSystemInfo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection OpenThread LocalFree FormatMessageA QueryPerformanceFrequency GetLogicalProcessorInformation VirtualProtect GetFileSizeEx GetConsoleOutputCP SetConsoleCtrlHandler GetTimeZoneInformation GetCurrentThread EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW IsThreadAFiber HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW CreateFileW GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetEndOfFile GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetLogicalProcessorInformationEx RtlPcToFileHeader RaiseException InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter TerminateProcess CreateThread ExitThread ResumeThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW SetStdHandle GetFileType

ws2_32

accept closesocket socket bind htons listen recv send WSAGetLastError WSAStartup setsockopt htonl

winhvplatform

WHvCreatePartition WHvSetupPartition WHvSetVirtualProcessorRegisters WHvDeletePartition WHvSetPartitionProperty WHvGetCapability WHvCreateVirtualProcessor WHvDeleteVirtualProcessor WHvRunVirtualProcessor WHvGetVirtualProcessorRegisters WHvMapGpaRange

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1017KB

Virtual Size

1016KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

237KB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

234KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_5b159f77323c1efbef57f2e38b401ca8_akira_cobalt-strike_coinminer_icedid_njrat

dbghelp

version

kernel32

ws2_32

winhvplatform

generic