2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

General

Target
2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar
Size 11.1MB
Sample260630-r81csshv2x
SHA256 425baff538755a76c1655b564474805093d6c11d24a332f7e0bd9ad2a0cb2ffb
MD5 8f76c0e89debbb2c7a588f18c4f5f744
SHA1 6f2f19027c918aa71a31cd0378e7839dba20ae76
SHA512 27af874f816a521571f7c13a01a784814f6efad435243dbc5e17700f712618ffc111cee7ff3445fc45bece8985998af6e7bc9a5825568554f2789c989acb9bcd
SSDEEP 196608:lRO3j3Ld/5Mo9/vEvt2teC35tTdnXo9076gZCN3R93VQBWG:lROT7d/6o9XEvt2teC3p42YOB
TLSH
T1E2C69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

File Explorer

2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

.exe 11.1MB

2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

IMPHASH cc90580673da744f0d3b386314211745
SHA256 425baff538755a76c1655b564474805093d6c11d24a332f7e0bd9ad2a0cb2ffb
MD5 8f76c0e89debbb2c7a588f18c4f5f744
SHA1 6f2f19027c918aa71a31cd0378e7839dba20ae76
SHA512 27af874f816a521571f7c13a01a784814f6efad435243dbc5e17700f712618ffc111cee7ff3445fc45bece8985998af6e7bc9a5825568554f2789c989acb9bcd
SSDEEP 196608:lRO3j3Ld/5Mo9/vEvt2teC35tTdnXo9076gZCN3R93VQBWG:lROT7d/6o9XEvt2teC3p42YOB
TLSH
T1E2C69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4341344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb

kernel32

CreateFileW Sleep CreateDirectoryW LocalFree GetTempPathW MoveFileExW OpenProcess TerminateProcess WaitForSingleObject LeaveCriticalSection EnterCriticalSection SwitchToThread GetExitCodeProcess ReadFile PeekNamedPipe ResumeThread UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW GetProcessTimes CreateProcessW DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetCurrentProcessId CreateNamedPipeW GetTickCount64 SetEndOfFile SetFilePointer GetWindowsDirectoryW GetEnvironmentVariableW RemoveDirectoryW DeleteFileW GetModuleHandleW GetModuleFileNameW HeapFree GetProcessHeap HeapAlloc FormatMessageW LocalAlloc CallNamedPipeW GetNamedPipeServerProcessId GetSystemDirectoryW LoadLibraryW GetProcAddress FreeLibrary CreateEventW SetEvent CreateThread DeviceIoControl MultiByteToWideChar FindFirstFileW FindNextFileW FindClose FindFirstFileExW CreateHardLinkW WriteFile WaitForMultipleObjects OpenEventW DebugBreak CreateRemoteThread VerifyVersionInfoW VerSetConditionMask GetLongPathNameW WideCharToMultiByte CopyFileW GetVersionExW GetSystemInfo IsWow64Process GetNativeSystemInfo SetLastError CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW GetLogicalDriveStringsW QueryDosDeviceW GetCurrentThread VirtualQueryEx FindResourceW SizeofResource LoadResource LockResource FlushFileBuffers GetFileSizeEx GetFileInformationByHandle DeleteCriticalSection GetFullPathNameW SetFileAttributesW GetFileInformationByHandleEx GetTickCount GlobalAlloc GlobalFree GetSystemFirmwareTable GetFileSize DuplicateHandle OpenThread SetThreadPriority GetCurrentThreadId SetFileInformationByHandle SetSearchPathMode FileTimeToSystemTime lstrcmpA ExpandEnvironmentStringsW GetFileAttributesExW GetDriveTypeW GetLogicalDrives GetFileAttributesW GetLocalTime GetSystemTime SystemTimeToFileTime GetTimeZoneInformation SetFileTime GetStdHandle GetModuleHandleA GetSystemWindowsDirectoryW OutputDebugStringW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW CreateFileA FindResourceExW GetVersionExA GetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSection InitOnceExecuteOnce SetFileCompletionNotificationModes GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetEnvironmentVariableW VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA LoadLibraryA FormatMessageA ReleaseSemaphore CreateSemaphoreA GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW DecodePointer InitializeCriticalSectionEx CloseHandle GetLastError GetCurrentProcess RaiseException VirtualQuery LoadLibraryExA GetStringTypeW GetLocaleInfoEx AreFileApisANSI EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SystemTimeToTzSpecificLocalTime SetFilePointerEx GetConsoleOutputCP SetConsoleCtrlHandler GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle HeapSize IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW RtlUnwind

authz

AuthzFreeContext AuthzAccessCheck AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

115KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

636KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_8f76c0e89debbb2c7a588f18c4f5f744_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

kernel32

authz

generic