2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar
Size 13.0MB
Sample260531-bfa97sfx4x
SHA256 35be959667072e58196cfb92a8c6dc12be17f582ea4f6a1d4b7bd370bb7f66ee
MD5 0333cba0783a978af39a112e2fdfd164
SHA1 1c9bfe56560b658cdb9780705e82b71decd21d5e
SHA512 d39ee2cd0aa6d4512e7ad9909152adb0e03b5c52ffb96c63de038d73321a83230a71ac6fb7ee9c8af8f97b0d697c5eed92bbc58d442a3afdd4309899229a8419
SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qfo:Hk0+yNSJa0rW46AinMmtC3j
TLSH
T112D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

File Explorer

2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

.exe 13.0MB

2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

IMPHASH 1bc97a9f24f079ea56988f14e0ec2525
SHA256 35be959667072e58196cfb92a8c6dc12be17f582ea4f6a1d4b7bd370bb7f66ee
MD5 0333cba0783a978af39a112e2fdfd164
SHA1 1c9bfe56560b658cdb9780705e82b71decd21d5e
SHA512 d39ee2cd0aa6d4512e7ad9909152adb0e03b5c52ffb96c63de038d73321a83230a71ac6fb7ee9c8af8f97b0d697c5eed92bbc58d442a3afdd4309899229a8419
SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qfo:Hk0+yNSJa0rW46AinMmtC3j
TLSH
T112D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11382704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx DeleteCriticalSection HeapSize HeapReAlloc RaiseException DecodePointer SetLastError GetCurrentDirectoryA GetConsoleScreenBufferInfo SetConsoleTextAttribute WideCharToMultiByte MultiByteToWideChar MoveFileExA CopyFileA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetFirmwareEnvironmentVariableW QueryFullProcessImageNameW CreateFileMappingA LocalFree LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile VirtualProtect GetTickCount CreateProcessA GetCurrentThreadId GetCurrentProcess Sleep WaitForSingleObject GetLastError CloseHandle GetTempPathW SetFileAttributesW GetLogicalDrives GetFileAttributesA FindNextFileW FindFirstFileW FindClose DeleteFileW DeleteFileA CreateFileW CreateDirectoryA GetStdHandle GetProcessHeap WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileSizeEx FlushFileBuffers GetConsoleMode GetConsoleOutputCP SetStdHandle HeapFree HeapAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeLibraryAndExitThread ResumeThread ExitThread GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW SetEnvironmentVariableW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetExitCodeProcess FreeLibrary CreateProcessW CreateThread LocalAlloc GetCurrentThread GetCurrentProcessId SetUnhandledExceptionFilter DeviceIoControl UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FormatMessageA QueryPerformanceFrequency SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW GetCPInfo ReadFile GetVolumeInformationA CreatePipe InitializeCriticalSection RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

wsprintfW MessageBoxA CharUpperBuffW

advapi32

SetSecurityDescriptorGroup OpenThreadToken InitializeSecurityDescriptor IsValidSecurityDescriptor ImpersonateSelf SetSecurityDescriptorOwner SetSecurityDescriptorDacl SetSecurityInfo SetNamedSecurityInfoW SetEntriesInAclW StartServiceW OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle RegCopyTreeW RegSetKeyValueW RegSetKeyValueA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCreateKeyW RegCreateKeyA LookupPrivilegeValueW IsValidSid InitializeAcl GetTokenInformation GetLengthSid FreeSid AdjustTokenPrivileges AddAccessAllowedAce OpenProcessToken RegCloseKey RevertToSelf AllocateAndInitializeSid AccessCheck

shell32

SHGetFolderPathW SHFileOperationW

ole32

CoInitialize StringFromGUID2 CoCreateInstance CoUninitialize

ws2_32

inet_addr gethostbyname setsockopt WSAStartup socket send recv htons connect closesocket shutdown inet_ntoa

iphlpapi

GetAdaptersInfo

shlwapi

StrStrW PathFileExistsW PathRemoveFileSpecA SHDeleteKeyW SHDeleteValueW

urlmon

URLDownloadToFileA

ntdll

RtlGetVersion RtlNtStatusToDosError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQuerySystemInformation NtClose NtOpenProcessToken NtAdjustPrivilegesToken RtlSetLastWin32Error

wininet

InternetGetConnectedState

��m��v<�#�[g�g��v¹�\~fF'��3��=P�|l)�C��W�aq��l�㏅2PT�>�[��E�c��mg��W�&��Ǭ"�6_��YN4L��El�d�Vh,�ӸJ�k^'.�v��{�CM�y,xݣ.�O�}`[�ݸC��UH��l�ٖ�S�K��HC��Q��z��"��w\��ڀ��3g _E��j�I�ō��*Ԡ�˿pX �K�/w#k�2��Եp�� {@t�UN�3&�[�"WN��'#��mc��ӧ��5�Z��D��e1#�B�1�C�� KS�e�.!��ifL'Jr\#:{K��T�c@��|�˴q�3Z9�Fgb{X�F�f��iE��H�{+|��+�gz��D��r"�8!I��!��8��.m��ۄݓ8�~*��KdPI�%~��o�J� S��L�x<��b>lՍQ�X�N�[c��'Z�eo)ۨE��M�*��j��u )�y�a7K�ڮn��is�}oh��%�ϔ>�\kl1Y��lo�|�g�⽩�P�9� ��lźs%J�+��/�}?�m��p�/63j��k��ӵ�,�=��0�6��T�>Ȓ�L��sy�k��Sk��,�V��g��Ƙ�t9q��1;ε=�4��W��ϻu�G\��`�bz��S-N7��~s��4�5X��k��Ϥ� ��f��`;�Ϸ��2�sD��|��T/աH��!�8>S �w��g��hH�w8�&��8�� v��j�!ޫ��U��<<Ȭ�M��3�w��sU��F�j��nξۗY{��ӃwL0_Ur,taC�M��o<֘�9��{�]��{Ы��] ��Aw+�n��u��%:�˟��s�|�Zj� �\T�'o͖1��Zɖj�ɼ��)�R�B�{�Fi��I=�ڮaWF��24j�Y�(�6<�eF�M5a(V��R�o��~�ZӢpik��{1��a�8�.�К��O:d�4��^��GZ�5%��jE��ɩ�V�[~:�m 4rTq��;N{��F��Sʹ-b�� ^(�霦nʧ��F�0��P/" ��Ӻ#�J1�2Ǘ��82��e�Ot��sn��}�7i�G.(�Kw��G�2��I(�>��J*j�EM��f��0�C��|)c��xċn�̺��~,*xL�r|G;��,��U{r�^S�}�9ʔU�}��&X=R�!��e�W�-��EY��$h:��Je��[D��T�`�03c}��:�T�'*��SP3��9w��QR��H��Ɨ-4��V| ��o�Z��4��"Su\�Ya*�&��4��Ê�F�8�t�$��r�o#�[H*Y"m�[��lZD�֭nc�jb5x�� (��F)��Xy2Qo�� KU��ܨ�vD��$Vqr�� L��S��|��I�V3 ��V�r��1õ�^�(�T��Z�,u��]��p��1�7$D�2��8*f]�iZ��`�8�T�:/�U�-*\��)ͳ�K�at=��K�l^�4��/d�j��M��[��@R��d�d�`i�@��E�⚋a�m��x0�~��zB�e�͆K6�w!�$��a�[�h]�hpV��1�7�Ed 5��\�I$#��Si�"](��UP7VlI�lx��/�W��V�7O��H�>�b�p��յ��\��7Uچ��8s�(WYp,��#s�z��4rSE�1'ӯ�m��HĖ�G5u�;�#�M;=��%bKh��*��!�$ S��^;KM�G�O�u�ԑ�-�U�A�f��ÊH�6E�;��B�_�l�9��{�~ا�� ;��S+��)�ȳ�̼hc��g�;fD D�.��%*1��]��ר��)��L[Z�-�!�;P�Tkb��$��붥ܱ!�ue�Og��~»�W��/H�C7e��oc�qF�HQտ>BS��\)��J��-� �y��6�9�x��2�8�ׁ��CJ� J\��_�s�ibr�q��"HV�U �/'}�x\��4��G��E5.�D U*��~�4�� 6O�ٔ�W��k`�e�M9�(��7G��@A��`Uk��P%ݗj.��W#�o=SD|v�y>t�w-̽�D'Oĳe�mE�1�$��:S�mX�DC$��l�Ɓ�X~�%�m�L��f�Zf��$��c��e��O��\�̡2�(��m�`��y��;3��?�O��:��G*&�r5eŊ��ۉ�3r�RI�';Y1��پ�I�D��v�Ц!V7��0��*e�K��a�ˆ��+J��I�On�c&4t�A��+5cl��x��*�ט�U4�=�n�NM�>��J�_��_�`��W��T~�}Dt69��jȠ�`詖��j�k\��l�(��?uso��81�X|w�M�`H\�~!�{Hܞ¤��Z,��W��'��,�6�yt��"�P�(�Q9�3X��q)��񓕕��S��E��o�/e�ߕ�j��9��䚡cd��h��(�B��3K�+ޛ�郜z�i��y��$��o �g�a��J;��;��l}��{��|etK�AfdSx��O�l��V��t�7��9��_�V��vt,&�&��<��D��]��ʩ]��Dv�o?�B?A�I�4Է�qR��_��Fb+�0fCXI��:g�h[,��0�� K: l� Oop=B��x�}�UJ�r�4��GL��/P�/��b6<\�ν̆(M%ۅ8��#l��c�fYE`,԰u� ��J�4Y��U��`��6�Yq�6��ze�v �I ��.��8ҭ��3_sK!q�6�m��{��JW\{�f�܀��F, ��/�;��

Name

.text

Size

394KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.W,|

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.*.n

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.4`@

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

ws2_32

iphlpapi

shlwapi

urlmon

ntdll

wininet

generic