2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar

General

Target
2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar
Size 4.3MB
Sample260808-bbqjbsah79
SHA256 9f3d8c819e0178d140d58b015c041878b2797c5ea1fcdeaafbaf0fabc169c7d5
MD5 914dd8ff15b40e333290ca6446f2e217
SHA1 c8ce514b933530e7186117b76d59ca266751cbfe
SHA512 0df1a8d79913423f46f5b7e53eadff84a080bf0abe90e90f8415f5766cbf72f579e219a897333553c7a7367f1902899dee7631d36c455cc96b4dbec486961238
SSDEEP 49152:82mSdbDUAsHpD+bsxctZE+OXj9LxcO4Q5Y3HWc4GK/HbKLLfU/I8boQhfD6UDvxF:8UbYnjBxcO4EYXWchKvxDP
TLSH
T144266B16B7A444F5C17A817886569737EBB17C150B3097CF43A0DA6A6F33AE09E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar

File Explorer

2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar

.exe 4.3MB

2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar

SHA256 9f3d8c819e0178d140d58b015c041878b2797c5ea1fcdeaafbaf0fabc169c7d5
MD5 914dd8ff15b40e333290ca6446f2e217
SHA1 c8ce514b933530e7186117b76d59ca266751cbfe
SHA512 0df1a8d79913423f46f5b7e53eadff84a080bf0abe90e90f8415f5766cbf72f579e219a897333553c7a7367f1902899dee7631d36c455cc96b4dbec486961238
SSDEEP 49152:82mSdbDUAsHpD+bsxctZE+OXj9LxcO4Q5Y3HWc4GK/HbKLLfU/I8boQhfD6UDvxF:8UbYnjBxcO4EYXWchKvxDP
TLSH
T144266B16B7A444F5C17A817886569737EBB17C150B3097CF43A0DA6A6F33AE09E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

2156352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

280KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=241, version=40116,

count=170, id=243, version=40116,

count=28, id=242, version=40116,

count=9, id=259, version=25305,

count=41, id=260, version=25305,

count=124, id=261, version=25305,

count=8, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=1, id=259, version=25203,

count=1, id=263, version=25203,

count=11, id=260, version=25203,

count=1, id=262, version=25203,

count=21, id=257, version=25203,

count=631, id=1, productName=Unmarked objects,

count=15, id=260, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=259, productName=VS2017 v15.3 build 25506, version=25506,

count=1132, id=261, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_914dd8ff15b40e333290ca6446f2e217_amadey_cobalt-strike_fabookie_glassworm_icedid_luca-stealer_njrat_remcos_satacom_vidar

generic