General

  • Target
    2026-05-31_5b8807e187efe1a29f30bc7aa33f90ef_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_vidar
  • Size 3.6MB
  • Sample260531-mf5plaew91
  • SHA256 bb7cd9b4754e66512c7c6e1b30214ecf1de3998bdfdb2174b42e1eaf91d8e646
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Custom signature
    Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • 2026-05-31_5b8807e187efe1a29f30bc7aa33f90ef_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_vidar
    .exe 3.6MB

2026-05-31_5b8807e187efe1a29f30bc7aa33f90ef_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_vidar

  • IMPHASH abd337557ee12f0d04a61a058d3fd18d
  • SHA256 bb7cd9b4754e66512c7c6e1b30214ecf1de3998bdfdb2174b42e1eaf91d8e646
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • UPX dump on OEP (original entry point)

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
59:77:cd:88:3b:f6:33:21:31:33:b3:30:a8:43:7d:a9:0b:a4:97:6d:c8:81:2d:61:72:fe:f2:d5:d5:4d:12:d7
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Minor OS version
0
Major OS version
10
Entry point
88736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
dismhost.pdb