2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 1.3MB
Sample260714-e5wh8aet3p
SHA256 2ebb1e7f04b104a27e23e3059e4c6dc0aefd3a5943881c67a1da8fb1a18c27a4
MD5 11c9307f15c10d617f656f439303bb87
SHA1 20362358c33a61d5e9f0878b6c8ce50d85e82301
SHA512 724da169bac3e5bacdddae353838571634379ce8ec037be7b57e76d61af7479dbebc0b43baa307448a802d394d7190977b612b50e0c938a32379ec82fe552d13
SSDEEP 24576:OmrrRE+i+2k6TfeaaiTMWWyyC3VGlpioEV7NoE5M:9Rwlk6TzaiIWeCUpioEV7/5M
TLSH
T19A55AE11BC01D2F6E83DC835E842499BF66960690314B6FB57D4C732198FBEA993DE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.3MB

2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 9f2c0ae4d12c30e66790dcee98097c8d
SHA256 2ebb1e7f04b104a27e23e3059e4c6dc0aefd3a5943881c67a1da8fb1a18c27a4
MD5 11c9307f15c10d617f656f439303bb87
SHA1 20362358c33a61d5e9f0878b6c8ce50d85e82301
SHA512 724da169bac3e5bacdddae353838571634379ce8ec037be7b57e76d61af7479dbebc0b43baa307448a802d394d7190977b612b50e0c938a32379ec82fe552d13
SSDEEP 24576:OmrrRE+i+2k6TfeaaiTMWWyyC3VGlpioEV7NoE5M:9Rwlk6TzaiIWeCUpioEV7/5M
TLSH
T19A55AE11BC01D2F6E83DC835E842499BF66960690314B6FB57D4C732198FBEA993DE0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle FindClose MultiByteToWideChar GetLastError GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW GetModuleHandleW WideCharToMultiByte VirtualQuery HeapFree HeapReAlloc HeapAlloc GetProcessHeap SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime lstrcpynW WriteConsoleW HeapSize FlushFileBuffers GetTickCount SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx DeleteCriticalSection FindResourceW LoadResource LockResource FreeResource GetCurrentThreadId InitializeCriticalSection CreateFileW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection GetProcessHandleCount TerminateProcess OpenProcess GetCurrentProcessId WriteFile IsDebuggerPresent CreateEventW GetModuleFileNameW InitializeCriticalSectionAndSpinCount ExitProcess Sleep CloseHandle GetStringTypeW

user32

DispatchMessageW TranslateMessage ReleaseDC MessageBoxW GetMessageW GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW GetWindowLongPtrW SendMessageW GetWindowThreadProcessId MonitorFromWindow WaitForInputIdle EnumWindows

gdi32

SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GetDeviceCaps DeleteDC GetObjectW DeleteObject

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

gdiplus

GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile

ws2_32

WSACleanup

Name

.text

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_11c9307f15c10d617f656f439303bb87_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

gdiplus

ws2_32

generic