amadey | 2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 17.5MB
Sample260702-vs6fnaaw41
SHA256 fd13436c44fd904a27296138c0b81db54d2ac68cb9803313f5a302b5a40c97b7
MD5 7e0fee1fe88f0be437d41b2f05200772
SHA1 ce66a329ffd78d33fa1727d2b16277ba960b954b
SHA512 396dabd85769f359638fc9aeda7b8cb687e7cb950bee865fd2da5f0176b50b1a21dad151f69c53ab6efbd83e7a65d0cfed6185d2c2eec4347b08c9e88525b1ec
SSDEEP 196608:aO4D5mxCN3BH2ZV5Q8tZT4KOreJXgpjMWMDowjyrTQh1PRolfsucWx:949m8SZU8DKreJxWM4Ti1PaBBx
TLSH
T15607F116B29951B9E0BB8638C962C571D7337C115B21CB9F03E06D6B7F332A16E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer trojan amadey

Malware Config

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Custom signature

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 17.5MB

2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8002ceb4a059a73af18dd022e288c062
SHA256 fd13436c44fd904a27296138c0b81db54d2ac68cb9803313f5a302b5a40c97b7
MD5 7e0fee1fe88f0be437d41b2f05200772
SHA1 ce66a329ffd78d33fa1727d2b16277ba960b954b
SHA512 396dabd85769f359638fc9aeda7b8cb687e7cb950bee865fd2da5f0176b50b1a21dad151f69c53ab6efbd83e7a65d0cfed6185d2c2eec4347b08c9e88525b1ec
SSDEEP 196608:aO4D5mxCN3BH2ZV5Q8tZT4KOreJXgpjMWMDowjyrTQh1PRolfsucWx:949m8SZU8DKreJxWM4Ti1PaBBx
TLSH
T15607F116B29951B9E0BB8638C962C571D7337C115B21CB9F03E06D6B7F332A16E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Reflective DLL injection artifacts
Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

0

Major OS version

6

Entry point

6144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW ShellExecuteW

kernel32

WriteConsoleW GetCurrentDirectoryW CreateFileW SetFileAttributesW WriteFile CloseHandle Sleep CreateProcessW GetTickCount lstrcpyW lstrcatW lstrlenW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17.4MB

Virtual Size

17.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_7e0fee1fe88f0be437d41b2f05200772_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

shell32

kernel32

generic