2026-05-16_7046a29baadc80537f6ca6466a1cd915_amadey_cobalt-strike_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_smoke-loader
- SHA256 b52a68d5e172100cc9a24688846e60c2dbd3271cd83bbabd3b8d8078cda0ebda
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables embedding anti-forensic artifacts of deleting shim cache
Digest
21:91:ba:f1:54:67:29:59:e0:c5:09:46:4a:27:ca:69:3c:95:8a:16:86:bf:bc:e3:75:84:51:49:27:02:4c:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Goversoft LLC,O=Goversoft LLC,ST=Delaware,C=US
Digest
53:7b:30:33:66:52:b2:e0:48:15:59:13:12:79:c1:85:63:36:c7:58
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Goversoft LLC,O=Goversoft LLC,ST=Delaware,C=US
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Goversoft LLC,O=Goversoft LLC,ST=Delaware,C=US
Serial Number
9c:91:d8:d9:91:c5:63:42:f0:31:b8:2d:a3:30:cc:af
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2023 - Jul 12, 2026
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
6670808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
198KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
79B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
597B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
342KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26.5MB
Virtual Size
26.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ