Extracted

Extracted

• • Target
    2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 17.5MB
  • SHA256 fd13436c44fd904a27296138c0b81db54d2ac68cb9803313f5a302b5a40c97b7
  • MD5 7e0fee1fe88f0be437d41b2f05200772
  • SHA1 ce66a329ffd78d33fa1727d2b16277ba960b954b
  • SHA512 396dabd85769f359638fc9aeda7b8cb687e7cb950bee865fd2da5f0176b50b1a21dad151f69c53ab6efbd83e7a65d0cfed6185d2c2eec4347b08c9e88525b1ec
  • SSDEEP 196608:aO4D5mxCN3BH2ZV5Q8tZT4KOreJXgpjMWMDowjyrTQh1PRolfsucWx:949m8SZU8DKreJxWM4Ti1PaBBx
  • TLSH
    T15607F116B29951B9E0BB8638C962C571D7337C115B21CB9F03E06D6B7F332A16E3A712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  11x06x2026282234discoveryamadeystealcinstallerpersistenceransomwarestealertrojanadwarespyware

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Custom signature

    Detects Reflective DLL injection artifacts

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2