2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc
Size 7.2MB
Sample260522-3wrexabs3s
SHA256 97563b9961dc7c692e1cb47550e26a19a4a4ae11ac65dbb7685f82e3d71182e3
MD5 23d9b33ea238a92bc55e2a52c2c8be53
SHA1 fb5217d965b6101fbf7abaf0c2adc6a114321ec6
SHA512 a8125fc6f711c95fcee1a8d562c666fe5cce4d57cf1b2c2dd9dab86d3f7ba808992cb3bc8cca1dc18c9b13077f7d67ef3a441a0ad686b617d1f30256d46acb4f
SSDEEP 98304:WQrxiMaBjGKBT1DMzZnlJPiIhxzoX2MgUrmWKjKWQckVgtev5mnlNL3:DpaQaRDMzJ3JTHMRrm7KWQc0gEYnvL3
TLSH
T1D776D11AB7A500F8C1E7D9B8CA165D13EAB2781513329ADB17E0D9591F23AF05F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc

File Explorer

2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc

.exe 7.2MB

2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc

IMPHASH 0239ac33baf6319c17ac0cf8a3ee6d6d
SHA256 97563b9961dc7c692e1cb47550e26a19a4a4ae11ac65dbb7685f82e3d71182e3
MD5 23d9b33ea238a92bc55e2a52c2c8be53
SHA1 fb5217d965b6101fbf7abaf0c2adc6a114321ec6
SHA512 a8125fc6f711c95fcee1a8d562c666fe5cce4d57cf1b2c2dd9dab86d3f7ba808992cb3bc8cca1dc18c9b13077f7d67ef3a441a0ad686b617d1f30256d46acb4f
SSDEEP 98304:WQrxiMaBjGKBT1DMzZnlJPiIhxzoX2MgUrmWKjKWQckVgtev5mnlNL3:DpaQaRDMzJ3JTHMRrm7KWQc0gEYnvL3
TLSH
T1D776D11AB7A500F8C1E7D9B8CA165D13EAB2781513329ADB17E0D9591F23AF05F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1839160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpOpen WinHttpWebSocketSend WinHttpConnect WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSetTimeouts WinHttpWebSocketReceive WinHttpSendRequest WinHttpQueryDataAvailable

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash

gdiplus

GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetPixelOffsetMode GdipSetInterpolationMode GdipSaveImageToStream GdipFree GdipSetCompositingQuality GdipDisposeImage GdipDrawImageRectI GdipGetImageEncodersSize

kernel32

GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue RtlCaptureContext FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry FlsGetValue RtlVirtualUnwind IsDebuggerPresent GetLastError ExitProcess MultiByteToWideChar SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile WriteFile CreateNamedPipeW PeekNamedPipe GetTempPathW GetCurrentThreadId GetCurrentProcessId CreateProcessW GetTickCount ConnectNamedPipe FlushFileBuffers GetVolumeInformationW FindFirstFileW GetFileSizeEx FindNextFileW UnhandledExceptionFilter FindClose CreateFileW DeleteFileW MoveFileExW GlobalMemoryStatusEx GetFileAttributesExW GetSystemTime CreateMutexW GetVersionExW ExitThread GetTickCount64 GetFileSize SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW GetCurrentProcess RemoveDirectoryW GetEnvironmentVariableW WaitForSingleObject TerminateThread CreateThread GetLocalTime CopyFileW GetFileAttributesW LoadLibraryW GetProcAddress SetDllDirectoryW GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode FileTimeToSystemTime SetFilePointerEx CreateProcessA GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy RtlUnwind CreateFileMappingA LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW IsValidCodePage GetConsoleOutputCP GetConsoleMode VirtualProtect CompareStringW GetComputerNameW GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetFilePointer UnlockFile

user32

EnumDisplayMonitors GetMonitorInfoW ReleaseDC SendInput GetSystemMetrics EnumDisplayDevicesW GetDC

gdi32

CreateCompatibleBitmap DeleteObject GetDeviceCaps BitBlt CreateCompatibleDC SelectObject DeleteDC

advapi32

OpenProcessToken RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegEnumKeyExW RegQueryValueExA RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW GetUserNameW RegSetValueExW CryptAcquireContextA RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoTaskMemFree

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceRegistryPropertyW SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiOpenDevRegKey

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive InitializeCriticalSectionEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW SetFileInformationByHandle FindFirstFileExW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtRender EvtClose EvtQuery EvtNext EvtCreateRenderContext

shlwapi

PathFileExistsW

ntdll

RtlInitUnicodeString

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_23d9b33ea238a92bc55e2a52c2c8be53_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc

winhttp

crypt32

bcrypt

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

shlwapi

ntdll

d3d11

dxgi

mf

mfplat

mfreadwrite

generic