Static

static

10

Resubmissions

13/08/2026, 02:02

260813-cgd8xsx1bw10

10/08/2026, 15:24

260810-stg4cacj7w

31/07/2026, 11:57

260731-n432cafm3v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-31_4c564c9f835c6ae1d00613cd205a5997_blankgrabber_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_redline-stealer_satacom_stealc_vidar
  • Size 84.3MB
  • Sample260810-stg4cacj7w
  • SHA256 9d712692a206c186c65e1748c23cb0613e54fdf8edde37b40ee2eb4145f5782f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
installertrojanamadeystealerdownloadersvcstealerstealc

Malware Config

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Detects Stealc stealer Version 2 1 IoCs
  • Detects SvcStealer aka Diamotrix Clipper Payload 1 IoCs

    SvcStealer or Diamotrix Clipper swaps clipboard crypto wallet addresses with the attacker's.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

  • Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

    Inno Setup installer

    installer

File Explorer

  • 2026-07-31_4c564c9f835c6ae1d00613cd205a5997_blankgrabber_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_redline-stealer_satacom_stealc_vidar
    .exe 84.3MB
  • zx.pyc
    3KB

2026-07-31_4c564c9f835c6ae1d00613cd205a5997_blankgrabber_cobalt-strike_darkgate_gcleaner_glassworm_icedid_luca-stealer_njrat_redline-stealer_satacom_stealc_vidar

  • IMPHASH 4029dc5ee830151a426fff64189bae0e
  • SHA256 9d712692a206c186c65e1748c23cb0613e54fdf8edde37b40ee2eb4145f5782f
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx64arch:x64

  • Detects Stealc stealer Version 2

  • Unsigned PE

    Checks for missing Authenticode signature.

  • Inno Setup is an open-source installation builder for Windows applications.

    Inno Setup installer

    installer
Minor OS version
0
Major OS version
6
Entry point
5676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths