2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar
Size 102.0MB
Sample260809-t92ncssbje
SHA256 fb9b41850c4e97d3ade67534d5444f40da37099e47b1431ab9d8c7842c68f300
MD5 5d20b1c7318378719f47ccf1f1978c0e
SHA1 b59005e8c29eb7e9c1ad785e9debf6f5f8433140
SHA512 aa9831e0044a403437581454982ad2e490539ee05fb5a94c9a1c35bc3d72e4c3bc5415c8bf25183c7745972307fc663222f1fb8bb8c90006f281886b03170ee9
SSDEEP 1572864:X4JMHGXiOJM7jE7kHDZSQvfSCpOavEdo2RrnGa0TrugabM:IQnOJM7jE7cZSQvjO62tneTrug
TLSH
T1B1383311A7A540B1E6BF433658726E0AFB313C625B51FBCF0049F1A52DF73909E2A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

File Explorer

2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

.exe 102.0MB

2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

IMPHASH 5db527c30eeef7e9b4c45545dc29105b
SHA256 fb9b41850c4e97d3ade67534d5444f40da37099e47b1431ab9d8c7842c68f300
MD5 5d20b1c7318378719f47ccf1f1978c0e
SHA1 b59005e8c29eb7e9c1ad785e9debf6f5f8433140
SHA512 aa9831e0044a403437581454982ad2e490539ee05fb5a94c9a1c35bc3d72e4c3bc5415c8bf25183c7745972307fc663222f1fb8bb8c90006f281886b03170ee9
SSDEEP 1572864:X4JMHGXiOJM7jE7kHDZSQvfSCpOavEdo2RrnGa0TrugabM:IQnOJM7jE7cZSQvjO62tneTrug
TLSH
T1B1383311A7A540B1E6BF433658726E0AFB313C625B51FBCF0049F1A52DF73909E2A726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cb:df:c1:a9:14:f9:7f:79:f6:0f:c3:1d:1d:66:2e:1d:63:29:97:1f:8c:db:02:fc:95:ca:53:d5:f4:bc:d6:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1137746413507,CN=LLC CiTyAr GROUP,O=LLC CiTyAr GROUP,STREET=ul Litvina-Sedogo\, 2/13 / korpus v / stroyeniye 1 pomeshch 1ts,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 28, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

7c:c4:7a:19:b9:25:8f:9a:88:45:85:c5

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jun 5, 2025

Timespan

May 6, 2025 - May 7, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

105944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentProcessId GetCurrentThreadId GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleHandleW GetProcAddress SetFileAttributesA RaiseException Sleep CreateProcessA MoveFileA TerminateProcess GetCurrentProcess InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter SetLastError GetLastError WakeAllConditionVariable LoadLibraryExW LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WideCharToMultiByte SleepConditionVariableSRW QueryPerformanceFrequency RtlUnwindEx

shell32

SHGetFolderPathA

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

urlmon

URLDownloadToFileA

ucrtbase

_local_unwind _unlock_file __stdio_common_vsprintf_s frexp localeconv _dclass _ldclass atan exp log sqrt tan _lock_locales _unlock_locales malloc setlocale __pctype_func isupper ___lc_locale_name_func ___lc_codepage_func _wcsdup ___mb_cur_max_func islower _fsopen fseek rand_s __acrt_iob_func abort __strncnt fflush setvbuf _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _initterm _initterm_e _callnewh _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode terminate __TypeMatch __DestructExceptionObject __FrameUnwindFilter __AdjustPointer __std_type_info_compare __processing_throw _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _CreateFrameInfo fclose __current_exception_context __current_exception memcpy memmove __C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy _purecall memset memcmp _get_stream_buffer_pointers system remove fwrite _fseeki64 fsetpos fread fputc fgetpos ungetc rand free fgetc calloc strcspn _invalid_parameter_noinfo_noreturn __NLG_Dispatch2 __NLG_Return2 _lock_file

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_5d20b1c7318378719f47ccf1f1978c0e_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar

PE Signature issue

kernel32

shell32

wininet

urlmon

ucrtbase

generic