2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz

General

Target
2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz
Size 115.8MB
Sample260707-jdlbdscw7t
SHA256 f590edfde8f622893d9fef39bfc1338daf76e9a4875b62209d3f9d02e1c738ca
MD5 8cf7cbfacb2e8da2ac0ba4a0b17b5d65
SHA1 274d87380b0f26eaad37ca2d8e77f620aaa8ceac
SHA512 65bf8ab6ae5c3772a5c1aa54ef2eb3b50a8df3a8998e1d4e6bad81008ae8428049cffdfe8f91b13033b48048dbbebfec6ad1d68fff012a3c2a2b09319c82f567
SSDEEP 786432:/lr8ZpZF/aViPoidWzPmplKe1im69LH7jwIQZ3nbVZWjtZrkDNNztzh4BdXu2Oqf:CLrGe0KE9LHvwZ9ooFyBdXULM
TLSH
T102489D0273F98165F1F3977069BA57628B3A7C655B30C7CF1280696E1E32AD18E35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz

File Explorer

2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz

.exe 115.8MB

2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz

IMPHASH da9d0b8b1b65807fc29a8f6c7f6cee37
SHA256 f590edfde8f622893d9fef39bfc1338daf76e9a4875b62209d3f9d02e1c738ca
MD5 8cf7cbfacb2e8da2ac0ba4a0b17b5d65
SHA1 274d87380b0f26eaad37ca2d8e77f620aaa8ceac
SHA512 65bf8ab6ae5c3772a5c1aa54ef2eb3b50a8df3a8998e1d4e6bad81008ae8428049cffdfe8f91b13033b48048dbbebfec6ad1d68fff012a3c2a2b09319c82f567
SSDEEP 786432:/lr8ZpZF/aViPoidWzPmplKe1im69LH7jwIQZ3nbVZWjtZrkDNNztzh4BdXu2Oqf:CLrGe0KE9LHvwZ9ooFyBdXULM
TLSH
T102489D0273F98165F1F3977069BA57628B3A7C655B30C7CF1280696E1E32AD18E35B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-21059475\vos3\thinstall\modules\boot_loader64.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess NtQueryInformationProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtProtectVirtualMemory NtCreateEvent LdrUnloadDll LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError NtClearEvent RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellokitty_hijackloader_icedid_luca-stealer_magniber_njrat_plugx_remcos_rhadamanthys_smoke-loader_stealc_vidar_win-beast_zxxz

kernel32

user32

ntdll

generic