2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar
Size 14.4MB
Sample260804-pwr5jseq6x
SHA256 0a58866047f582cc139648e52216a09559b1310fd91360af80b525d5726388c2
MD5 29f37df4a3a6a35f368394cfa6840e6b
SHA1 57c16017c380e5b2cff7beb8b0fb0a4a40590692
SHA512 8c6b169920e37b625ba509b0d953ab135b7b3a2cc98439f7fea3a32c0c71a80ba0eb08db365fe4da5638c120792808970ce3704c143a96a8f9c2f2e96338bb1a
SSDEEP 196608:N7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou:NahvQHrc8u3xXJ/f4uUWH
TLSH
T1A0E69E13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Yano

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar

File Explorer

2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar

.exe 14.4MB

2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar

IMPHASH de3ca1063f296a07162a7f96227c6216
SHA256 0a58866047f582cc139648e52216a09559b1310fd91360af80b525d5726388c2
MD5 29f37df4a3a6a35f368394cfa6840e6b
SHA1 57c16017c380e5b2cff7beb8b0fb0a4a40590692
SHA512 8c6b169920e37b625ba509b0d953ab135b7b3a2cc98439f7fea3a32c0c71a80ba0eb08db365fe4da5638c120792808970ce3704c143a96a8f9c2f2e96338bb1a
SSDEEP 196608:N7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou:NahvQHrc8u3xXJ/f4uUWH
TLSH
T1A0E69E13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables packed with Dotfuscator
Detects executables packed with SmartAssembly
Detects executables packed with Yano Obfuscator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15163520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\b\s\w\ir\cache\builder\src\out\Release_x64\software_reporter_tool.exe.pdb

advapi32

AccessCheck AddMandatoryAce AdjustTokenPrivileges BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWrite FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid LookupAccountSidW LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegDisablePredefinedCache RegEnumKeyExW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

oleaut32

SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString VariantClear

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetProcessWindowStation GetQueueStatus GetThreadDesktop GetUserObjectInformationW GetWindowLongPtrW KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW SetProcessWindowStation SetTimer SetWindowLongPtrW TranslateMessage UnregisterClassW

wininet

InternetCheckConnectionW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CallbackMayRunLong CancelIo CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateThreadpool CreateThreadpoolWork DebugBreak DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProcessId GetProcessIoCounters GetProcessTimes GetProcessWorkingSetSizeEx GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetUserPreferredUILanguages GetVersionExW GetVolumeInformationW GetVolumePathNameW GetWindowsDirectoryW GlobalFree HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryDosDeviceW QueryFullProcessImageNameW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessShutdownParameters SetProcessWorkingSetSizeEx SetStdHandle SetThreadAffinityMask SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SubmitThreadpoolWork SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenW

ole32

CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

secur32

GetUserNameExW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpWriteData

iphlpapi

CancelIPChangeNotify NotifyAddrChange

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ntdll

RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind VerSetConditionMask

shlwapi

PathMatchSpecW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

495KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

69KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

108B

Characteristics

Name

.tls

Size

512B

Virtual Size

393B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

68B

Characteristics

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.prot

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_29f37df4a3a6a35f368394cfa6840e6b_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar

advapi32

dbghelp

oleaut32

shell32

user32

wininet

kernel32

ole32

secur32

winhttp

iphlpapi

version

ntdll

shlwapi

winmm

generic