2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar

General

Target
2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar
Size 4.0MB
Sample260721-v848jayydw
SHA256 045ec716f7c1a00979a3af2db3e1f936599fc1134b6e0da8dcc13774daa6c4df
MD5 18808eb9f234f82d3a55ae45a3aa86c2
SHA1 d76fc9d9d360363fee4df8d19468f1325dcda443
SHA512 c8f2304796a587751e680063e747794b2d600500d7129d25c62f71b820304ee059fb618a444549bf361a699cafb4a1a13e9214a9984017d1d6c946a536d18a0b
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/bpYqdYcLP:urRokqOgmhv7Sti26sYcLP
TLSH
T189164B217AB08435D073D67099B6E699D5327C609B7289CF23D13EAEBFB16D14932332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar

File Explorer

2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar

.exe 4.0MB

2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar

IMPHASH 4b28658f0faec3fceb2d96685cc1842a
SHA256 045ec716f7c1a00979a3af2db3e1f936599fc1134b6e0da8dcc13774daa6c4df
MD5 18808eb9f234f82d3a55ae45a3aa86c2
SHA1 d76fc9d9d360363fee4df8d19468f1325dcda443
SHA512 c8f2304796a587751e680063e747794b2d600500d7129d25c62f71b820304ee059fb618a444549bf361a699cafb4a1a13e9214a9984017d1d6c946a536d18a0b
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/bpYqdYcLP:urRokqOgmhv7Sti26sYcLP
TLSH
T189164B217AB08435D073D67099B6E699D5327C609B7289CF23D13EAEBFB16D14932332
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

13648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\jabswitch\jabswitch.pdb

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

wsprintfW

msvcr100

strcpy_s vsprintf_s _CRT_RTC_INITW _amsg_exit __getmainargs __C_specific_handler _XcptFilter _exit _cexit exit strcat_s _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type __crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit wcscpy_s wcstok_s wcscat_s wcsstr _wcslwr_s wcslen ??2@YAPEAX_K@Z _dupenv_s printf perror free fopen_s fprintf fclose remove _errno rename strstr feof fgets _stricmp fputs strtok_s memset __initenv

kernel32

VirtualQuery GetProcessHeap HeapAlloc HeapFree FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter DecodePointer LoadLibraryW GetProcAddress lstrlenA MultiByteToWideChar WideCharToMultiByte RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess EncodePointer Sleep GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GetVersionExW

Name

.text

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

972B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

410B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_18808eb9f234f82d3a55ae45a3aa86c2_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_njrat_satacom_smoke-loader_stop_vidar

advapi32

version

user32

msvcr100

kernel32

generic