2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

General

Target
2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry
Size 4.6MB
Sample260601-xeef5adv3w
SHA256 3e7457f862ef940b544748a341d6416e1f95e6a45102a1ebae15bd1cb97ae173
MD5 cc520d70146dd17ec1ac8b2193d5fd33
SHA1 13c7c92b2c382ab31f926e29272e96db4a837556
SHA512 7b67e63d3267e28e3a1630c0159890423920bd354e8fbef9805dad1591c12e1f50658dd6e5bd35b8040b6ebf4c7fdcbf96351c7935f7c66fe6c88863b0c153eb
SSDEEP 98304:RllR0llRbn7OQYtllR0llRbn7OQY7+4jMT:P/C/bnSQYb/C/bnSQYjjMT
TLSH
T102265A117AE44872E1B719305A70951D0A36BD65CB279ECB22942ECEFFF27C04E26772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

File Explorer

2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

.exe 4.6MB

2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

IMPHASH bd0209159477d5bdde0d128d71f399eb
SHA256 3e7457f862ef940b544748a341d6416e1f95e6a45102a1ebae15bd1cb97ae173
MD5 cc520d70146dd17ec1ac8b2193d5fd33
SHA1 13c7c92b2c382ab31f926e29272e96db4a837556
SHA512 7b67e63d3267e28e3a1630c0159890423920bd354e8fbef9805dad1591c12e1f50658dd6e5bd35b8040b6ebf4c7fdcbf96351c7935f7c66fe6c88863b0c153eb
SSDEEP 98304:RllR0llRbn7OQYtllR0llRbn7OQY7+4jMT:P/C/bnSQYb/C/bnSQYjjMT
TLSH
T102265A117AE44872E1B719305A70951D0A36BD65CB279ECB22942ECEFFF27C04E26772
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

01:c3:f7:bb:76:59:ef:3d:87:18:91:13:8b:d0:6e:7b:79:66:2e:7c:de:21:d2:28:5b:6a:5c:71:b1:f7:fc:3e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 23, 2020

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2020 - Mar 3, 2021

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:2a:e8:17:96:f8:86:a7:ef:a3:00:00:00:00:01:2a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 19, 2019 - Mar 17, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

10

Entry point

4960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsMpEngCP.pdb

2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

PE Signature issue

kernel32

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_cc520d70146dd17ec1ac8b2193d5fd33_amadey_cobalt-strike_coinminer_darkgate_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry

PE Signature issue

kernel32

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic