2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar
Size 1.6MB
Sample260527-r7nydaaw21
SHA256 466017df13ccc6a2945e831f16749a02d44a2ab8edf12f19acec611bd4fb358d
MD5 eac38a2936b835cf8d190aa900a11369
SHA1 ad18a8efe7ac3f39b8e5a7522b77830e6c42a2ba
SHA512 a13a64136a11bbb82450750dd5b3a50e7d0c19dce0823b949e0569885615d5d65bfecccfb0a29944dc816f9733faa4f82a99cee94d744f19021285be7a517cd2
SSDEEP 24576:QmYBMFNNXAyYTqMi8CtBd2QHCHmTBW53Om3FolSjyb:ZYBMF/XoqJtb2Isneb
TLSH
T1C275C611A5604A31D462C2758591EE9DA6333D45EB334E8F22C77EEEFFF27824926231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar

File Explorer

2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar

.exe 1.6MB

2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar

IMPHASH c5a9eb946f840692055273156d5ecf7b
SHA256 466017df13ccc6a2945e831f16749a02d44a2ab8edf12f19acec611bd4fb358d
MD5 eac38a2936b835cf8d190aa900a11369
SHA1 ad18a8efe7ac3f39b8e5a7522b77830e6c42a2ba
SHA512 a13a64136a11bbb82450750dd5b3a50e7d0c19dce0823b949e0569885615d5d65bfecccfb0a29944dc816f9733faa4f82a99cee94d744f19021285be7a517cd2
SSDEEP 24576:QmYBMFNNXAyYTqMi8CtBd2QHCHmTBW53Om3FolSjyb:ZYBMF/XoqJtb2Isneb
TLSH
T1C275C611A5604A31D462C2758591EE9DA6333D45EB334E8F22C77EEEFFF27824926231
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ac:1d:23:15:db:d4:11:5e:44:ed:dd:27:87:01:28:e7:26:55:34:a5:59:16:83:ec:c0:e3:ec:d3:03:91:7b:bf

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 20, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

12384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\AcrobatInfo.pdb

kernel32

HeapSetInformation FreeLibrary GetModuleFileNameW GetModuleHandleW LoadLibraryW GetProcessHeap CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW IsDebuggerPresent SetLastError GetLastError SetUnhandledExceptionFilter OutputDebugStringA VerSetConditionMask GetCurrentProcess GetProcAddress VerifyVersionInfoW GetModuleHandleExW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStartupInfoW

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memset memcpy wcsrchr wcsstr __C_specific_handler __std_terminate __current_exception __current_exception_context _CxxThrowException __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _c_exit terminate _initialize_wide_environment _configure_wide_argv _get_wide_winmain_command_line _initterm _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _initterm_e _exit _crt_atexit _invalid_parameter_noinfo_noreturn exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

wcscmp wcsncat_s wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _get_heap_handle _callnewh free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_eac38a2936b835cf8d190aa900a11369_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_smoke-loader_vidar

PE Signature issue

kernel32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic