2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar
Size 13.0MB
Sample260702-cplmzaa18x
SHA256 9cc3093c609f8e9cd414a36721fb762395ec053c977cf6ffa94156c8bcd41711
MD5 20e918c140290634b8c2c29ec1e9bdf4
SHA1 69f195c597deec2270f9801aed8316472951257e
SHA512 edbcf07383a1339a2284ac58fdc32234105354fe6819ca899cd88abd31359461ebef1bbc00f11d72389ddbee4409f9321e67b58bb748595cdba3e9547a2c25b5
SSDEEP 196608:zx5agcVBJNwGYjARtBDghwrU7EDs+W4BJF:bkVe88bS
TLSH
T125D6BE2562D4131DF1A39530DAB2C216E6737CD65B708B8F19DAA7036FB3AD19833329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

File Explorer

2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

.exe 13.0MB

2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

IMPHASH 1bc97a9f24f079ea56988f14e0ec2525
SHA256 9cc3093c609f8e9cd414a36721fb762395ec053c977cf6ffa94156c8bcd41711
MD5 20e918c140290634b8c2c29ec1e9bdf4
SHA1 69f195c597deec2270f9801aed8316472951257e
SHA512 edbcf07383a1339a2284ac58fdc32234105354fe6819ca899cd88abd31359461ebef1bbc00f11d72389ddbee4409f9321e67b58bb748595cdba3e9547a2c25b5
SSDEEP 196608:zx5agcVBJNwGYjARtBDghwrU7EDs+W4BJF:bkVe88bS
TLSH
T125D6BE2562D4131DF1A39530DAB2C216E6737CD65B708B8F19DAA7036FB3AD19833329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11350203

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx DeleteCriticalSection HeapSize HeapReAlloc RaiseException DecodePointer SetLastError GetCurrentDirectoryA GetConsoleScreenBufferInfo SetConsoleTextAttribute WideCharToMultiByte MultiByteToWideChar MoveFileExA CopyFileA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetFirmwareEnvironmentVariableW QueryFullProcessImageNameW CreateFileMappingA LocalFree LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile VirtualProtect GetTickCount CreateProcessA GetCurrentThreadId GetCurrentProcess Sleep WaitForSingleObject GetLastError CloseHandle GetTempPathW SetFileAttributesW GetLogicalDrives GetFileAttributesA FindNextFileW FindFirstFileW FindClose DeleteFileW DeleteFileA CreateFileW CreateDirectoryA GetStdHandle GetProcessHeap WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileSizeEx FlushFileBuffers GetConsoleMode GetConsoleOutputCP SetStdHandle HeapFree HeapAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeLibraryAndExitThread ResumeThread ExitThread GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW SetEnvironmentVariableW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetExitCodeProcess FreeLibrary CreateProcessW CreateThread LocalAlloc GetCurrentThread GetCurrentProcessId SetUnhandledExceptionFilter DeviceIoControl UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FormatMessageA QueryPerformanceFrequency SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW GetCPInfo ReadFile GetVolumeInformationA CreatePipe InitializeCriticalSection RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

wsprintfW MessageBoxA CharUpperBuffW

advapi32

SetSecurityDescriptorGroup OpenThreadToken InitializeSecurityDescriptor IsValidSecurityDescriptor ImpersonateSelf SetSecurityDescriptorOwner SetSecurityDescriptorDacl SetSecurityInfo SetNamedSecurityInfoW SetEntriesInAclW StartServiceW OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle RegCopyTreeW RegSetKeyValueW RegSetKeyValueA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCreateKeyW RegCreateKeyA LookupPrivilegeValueW IsValidSid InitializeAcl GetTokenInformation GetLengthSid FreeSid AdjustTokenPrivileges AddAccessAllowedAce OpenProcessToken RegCloseKey RevertToSelf AllocateAndInitializeSid AccessCheck

shell32

SHGetFolderPathW SHFileOperationW

ole32

CoInitialize StringFromGUID2 CoCreateInstance CoUninitialize

ws2_32

inet_addr gethostbyname setsockopt WSAStartup socket send recv htons connect closesocket shutdown inet_ntoa

iphlpapi

GetAdaptersInfo

shlwapi

StrStrW PathFileExistsW PathRemoveFileSpecA SHDeleteKeyW SHDeleteValueW

urlmon

URLDownloadToFileA

ntdll

RtlGetVersion RtlNtStatusToDosError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQuerySystemInformation NtClose NtOpenProcessToken NtAdjustPrivilegesToken RtlSetLastWin32Error

wininet

InternetGetConnectedState

R�u��{jt�&׊ ��}��Gp��0@~',pvHVѡ��O��ݰ+��@�'%JZV 7��?�>�J9� �u<�b��_Gn�!��hM�g�=�(��u�u��go�,��l��慣��G�fX�%M~;��=��n��FXzDk�<�o�=U��A�}�(V{L��R�|>l�'�;��q��mr#�/�̮�~�0X[��I�{�z0�rS'�:�KN�'Ld�z��A��b��Ȃ��ŅTU�[�)]��<�rU&�@PňS �8��n��dБ��@�G*rhVH��46�MW�NP��,K٥��9K��B$�!��y�j�w,��|ި?��f��c",��r��X �d�\D.��[ZcK��evk��2E��Wۚ��D�E��|��1jc�Ik.�_6�#�K�(�w��IM0/��>9d4�V�m�R��1��/_��"��=|��cߍ��?0�7Q�DX��ya�� {��9]=S��](Iq�Qb��d.��󑩾�HV��Z�1�f�F�rhO��襦��g��{�H�G;iA�x�LQ*J�.�=��!ԍ�ۡ'n3d��,D��1WN��@F��a�P�gl��,Nt��%�1[M3�=�D�X�9aW8w��ُp|\�$.��,S�ML8TaWL� !'��t1`��&y.#]��a4�A2md��JD��X�M�F�ܟ z��6S�'_�1��%-q��^]��c��*w�l� ��Y&4F��/��F��T�<$@�Ө�� /�+ՃG_Ms;o�VsL�f\�j��R��B(Y��xO��88OYJ'3�ߚ��|֝� ��y��iF�_��-J��S_�U$-�9`yÝ��o��]_��+�q�BO�+��AF�n�� %�g>tfM+.�L�/�Q�H`��z��WO�M�e��y@��r� ̵�g��Z��q�U�<L�T��2o ��k�+sz�$Sk�]<��c�ù��7'�!�I�X��:c�q gء�5ᒹ��'MMM{�k��c� 6d�I��"�3a5��3��%��=�e��M��c��C_�|Y�QT�U�^~��l뚹�usV��C��z��{=��\��/�h��(p<ƌG~M�8J��fx��z��]U=G�]H��$ۻ#�&�N?Ĥ� ~~��6�i�4�3)^01�g��xg��*��JBm^�Sַ��P3��6ԥ�_.�J�xf��Zf�9pxM�=5�P�~�)�o�]c��Y�}c�0`տ[!N+� �}�ۮ�@4��N̅��L��n�)0{(��A �� 3lJ�C��c HS��B^�q��$��c�y7�9��%�c��U��<7d��X�Lj_�_hi�v�Q��hζ��V��Dj��,�M��n0�U�n'z�L��T��u^>?��雗�ɆF��#��%5�rd'�DJ��3�y#�I�of��mw��k��:r�U {�cFJ�Kc�w�@�M��A5rN��>��mW�`��<��\�"�]ו�d"�� JW��V�N��a��|b�W�KX��``��@$��r��${�,'��.�(�Ը��M��ʥ3�ӐI�U�n_%�׭�|��* ��7��m$x�Q�7�V�>�`,:b4Lm[��O��M��揙��(� Ȍ[x�DT��G�;�t��R��sGD��Lm��(+��>Ap݉�7\�� (� ��Bs��Y�{ڥ�(�HS�/�+ht��l�"�@_�(�z��"1�� tu¢��[��y(�o]�p��G��7f��p(��Ҳ׌jo��%P��I�}�^�肝��(D�u⒝rz�t"�/��PZ)�]��OA�Oo�`芷oe�� 9�+�.��y�{S��ȉ�r��<�h�d��k�97m`��:��D/�!eG��.��RY�՘^��Z��ᭈ�4}z�~\wϧ��MA��d�R�qk��#��吟5C�� K�ʽF�k��Y�"Q�}��K�*��ۈ��xѢ�/X��(��OF��@6��[��'ToC��Qǈa�� j��o�pG�ĖG��X�c2��[V�@Hſ�q*0,��q|��=�;*>ݞ��=�K*�۝��9� A�ZSL��f�w�U!S�rU�WϏ@�_&��}Q��气�p��c��*��r��O��e~��'�I>� �9�,@Fd��&&�o1�ϵ��k4�>Ux�p�UɄh�S4�]d��3��^�<j:��'��lj�sk�M�RO�yHfD�sLp�ǵ&%�C�%��=,,��F. ,d��R�7/��r��xI"�}��97�6vx��0�ɺD僫S؇bq�U{�,�nE�w��`(]��"w��\q�$��q`��BqZ�<;�ò*a�w+3H�A��M��IQ-�G�yh}�� '�$]��9Om<��}h�� #��%pFj��v�K٥ ��(<��6/L�F��̖��`��iT a�Jx�V�Y�$X��0 ��KC{$��s�y��#��^��P��1�ؕ�G��߼kJrXL��v�� >��y��#�'n��T�+ �r!˔/��6?;��L�_v�ӂ�҂0�e��(��-�=��p"��A*e��Hw��O��;%��ΰ�Xtmז~��Y��6�Z�1;�k��Wi��H��g.}�w�dr�<�o��0�*��_�F��_��FMa�.�\q�;�E�q�X�{�ro�C ѻ9��B��y}o&��y��a��V23AK�֍��U]�J��0�� '4C�ƿ�<:oU��Q>׈�P|(#@m��^

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yE)

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.V,g

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.IkA

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

ws2_32

iphlpapi

shlwapi

urlmon

ntdll

wininet

generic