2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar
Size 13.0MB
Sample260822-es9kbaeb49
SHA256 de5b41b22d7262671a9ff63a74a0bb8dce72ee1b96f19bc99e07135154af4ae3
MD5 5f9a109014e75db82854818e533686cc
SHA1 bc19326706ad8b517755d8b1533c9162270872df
SHA512 1af1e325e349082f8aa3a1ba1c75da63080b07b36e653442ab21834fe42cda12657ac766630d4496ce261b5bde411f170f9941b179299874e1cfad371fef11a7
SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44QfR:Hk0+yNSJa0rW46AinMmtC34
TLSH
T1BDD6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

File Explorer

2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

.exe 13.0MB

2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

IMPHASH 1bc97a9f24f079ea56988f14e0ec2525
SHA256 de5b41b22d7262671a9ff63a74a0bb8dce72ee1b96f19bc99e07135154af4ae3
MD5 5f9a109014e75db82854818e533686cc
SHA1 bc19326706ad8b517755d8b1533c9162270872df
SHA512 1af1e325e349082f8aa3a1ba1c75da63080b07b36e653442ab21834fe42cda12657ac766630d4496ce261b5bde411f170f9941b179299874e1cfad371fef11a7
SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44QfR:Hk0+yNSJa0rW46AinMmtC34
TLSH
T1BDD6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11382704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx DeleteCriticalSection HeapSize HeapReAlloc RaiseException DecodePointer SetLastError GetCurrentDirectoryA GetConsoleScreenBufferInfo SetConsoleTextAttribute WideCharToMultiByte MultiByteToWideChar MoveFileExA CopyFileA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetFirmwareEnvironmentVariableW QueryFullProcessImageNameW CreateFileMappingA LocalFree LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile VirtualProtect GetTickCount CreateProcessA GetCurrentThreadId GetCurrentProcess Sleep WaitForSingleObject GetLastError CloseHandle GetTempPathW SetFileAttributesW GetLogicalDrives GetFileAttributesA FindNextFileW FindFirstFileW FindClose DeleteFileW DeleteFileA CreateFileW CreateDirectoryA GetStdHandle GetProcessHeap WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileSizeEx FlushFileBuffers GetConsoleMode GetConsoleOutputCP SetStdHandle HeapFree HeapAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeLibraryAndExitThread ResumeThread ExitThread GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW SetEnvironmentVariableW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetExitCodeProcess FreeLibrary CreateProcessW CreateThread LocalAlloc GetCurrentThread GetCurrentProcessId SetUnhandledExceptionFilter DeviceIoControl UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FormatMessageA QueryPerformanceFrequency SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW GetCPInfo ReadFile GetVolumeInformationA CreatePipe InitializeCriticalSection RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

wsprintfW MessageBoxA CharUpperBuffW

advapi32

SetSecurityDescriptorGroup OpenThreadToken InitializeSecurityDescriptor IsValidSecurityDescriptor ImpersonateSelf SetSecurityDescriptorOwner SetSecurityDescriptorDacl SetSecurityInfo SetNamedSecurityInfoW SetEntriesInAclW StartServiceW OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle RegCopyTreeW RegSetKeyValueW RegSetKeyValueA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCreateKeyW RegCreateKeyA LookupPrivilegeValueW IsValidSid InitializeAcl GetTokenInformation GetLengthSid FreeSid AdjustTokenPrivileges AddAccessAllowedAce OpenProcessToken RegCloseKey RevertToSelf AllocateAndInitializeSid AccessCheck

shell32

SHGetFolderPathW SHFileOperationW

ole32

CoInitialize StringFromGUID2 CoCreateInstance CoUninitialize

ws2_32

inet_addr gethostbyname setsockopt WSAStartup socket send recv htons connect closesocket shutdown inet_ntoa

iphlpapi

GetAdaptersInfo

shlwapi

StrStrW PathFileExistsW PathRemoveFileSpecA SHDeleteKeyW SHDeleteValueW

urlmon

URLDownloadToFileA

ntdll

RtlGetVersion RtlNtStatusToDosError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQuerySystemInformation NtClose NtOpenProcessToken NtAdjustPrivilegesToken RtlSetLastWin32Error

wininet

InternetGetConnectedState

��m��v<�#�[g�g��v¹�\~fF'��3��=P�|l)�C��W�aq��l�㏅2PT�>�[��E�c��mg��W�&��Ǭ"�6_��YN4L��El�d�Vh,�ӸJ�k^'.�v��{�CM�y,xݣ.�O�}`[�ݸC��UH��l�ٖ�S�K��HC��Q��z��"��w\��ڀ��3g _E��j�I�ō��*Ԡ�˿pX �K�/w#k�2��Եp�� {@t�UN�3&�[�"WN��'#��mc��ӧ��5�Z��D��e1#�B�1�C�� KS�e�.!��ifL'Jr\#:{K��T�c@��|�˴q�3Z9�Fgb{X�F�f��iE��H�{+|��+�gz��D��r"�8!I��!��8��.m��ۄݓ8�~*��KdPI�%~��o�J� S��L�x<��b>lՍQ�X�N�[c��'Z�eo)ۨE��M�*��j��u )�y�a7K�ڮn��is�}oh��%�ϔ>�\kl1Y��lo�|�g�⽩�P�9� ��lźs%J�+��/�}?�m��p�/63j��k��ӵ�,�=��0�6��T�>Ȓ�L��sy�k��Sk��,�V��g��Ƙ�t9q��1;ε=�4��W��ϻu�G\��`�bz��S-N7��~s��4�5X��k��Ϥ� ��f��`;�Ϸ��2�sD��|��T/աH��!�8>S �w��g��hH�w8�&��8�� v��j�!ޫ��U��<<Ȭ�M��3�w��sU��F�j��nξۗY{��ӃwL0_Ur,taC�M��o<֘�9��{�]��{Ы��] ��Aw+�n��u��%:�˟��s�|�Zj� �\T�'o͖1��Zɖj�ɼ��)�R�B�{�Fi��I=�ڮaWF��24j�Y�(�6<�eF�M5a(V��R�o��~�ZӢpik��{1��a�8�.�К��O:d�4��^��GZ�5%��jE��ɩ�V�[~:�m 4rTq��;N{��F��Sʹ-b�� ^(�霦nʧ��F�0��P/" ��Ӻ#�J1�2Ǘ��82��e�Ot��sn��}�7i�G.(�Kw��G�2��I(�>��J*j�EM��f��0�C��|)c��xċn�̺��~,*xL�r|G;��,��U{r�^S�}�9ʔU�}��&X=R�!��e�W�-��EY��$h:��Je��[D��T�`�03c}��:�T�'*��SP3��9w��QR��H��Ɨ-4��V| ��o�Z��4��"Su\�Ya*�&��4��Ê�F�8�t�$��r�o#�[H*Y"m�[��lZD�֭nc�jb5x�� (��F)��Xy2Qo�� KU��ܨ�vD��$Vqr�� L��S��|��I�V3 ��V�r��1õ�^�(�T��Z�,u��]��p��1�7$D�2��8*f]�iZ��`�8�T�:/�U�-*\��)ͳ�K�at=��K�l^�4��/d�j��M��[��@R��d�d�`i�@��E�⚋a�m��x0�~��zB�e�͆K6�w!�$��a�[�h]�hpV��1�7�Ed 5��\�I$#��Si�"](��UP7VlI�lx��/�W��V�7O��H�>�b�p��յ��\��7Uچ��8s�(WYp,��#s�z��4rSE�1'ӯ�m��HĖ�G5u�;�#�M;=��%bKh��*��!�$ S��^;KM�G�O�u�ԑ�-�U�A�f��ÊH�6E�;��B�_�l�9��{�~ا�� ;��S+��)�ȳ�̼hc��g�;fD D�.��%*1��]��ר��)��L[Z�-�!�;P�Tkb��$��붥ܱ!�ue�Og��~»�W��/H�C7e��oc�qF�HQտ>BS��\)��J��-� �y��6�9�x��2�8�ׁ��CJ� J\��_�s�ibr�q��"HV�U �/'}�x\��4��G��E5.�D U*��~�4�� 6O�ٔ�W��k`�e�M9�(��7G��@A��`Uk��P%ݗj.��W#�o=SD|v�y>t�w-̽�D'Oĳe�mE�1�$��:S�mX�DC$��l�Ɓ�X~�%�m�L��f�Zf��$��c��e��O��\�̡2�(��m�`��y��;3��?�O��:��G*&�r5eŊ��ۉ�3r�RI�';Y1��پ�I�D��v�Ц!V7��0��*e�K��a�ˆ��+J��I�On�c&4t�A��+5cl��x��*�ט�U4�=�n�NM�>��J�_��_�`��W��T~�}Dt69��jȠ�`詖��j�k\��l�(��?uso��81�X|w�M�`H\�~!�{Hܞ¤��Z,��W��'��,�6�yt��"�P�(�Q9�3X��q)��񓕕��S��E��o�/e�ߕ�j��9��䚡cd��h��(�B��3K�+ޛ�郜z�i��y��$��o �g�a��J;��;��l}��{��|etK�AfdSx��O�l��V��t�7��9��_�V��vt,&�&��<��D��]��ʩ]��Dv�o?�B?A�I�4Է�qR��_��Fb+�0fCXI��:g�h[,��0�� K: l� Oop=B��x�}�UJ�r�4��GL��/P�/��b6<\�ν̆(M%ۅ8��#l��c�fYE`,԰u� ��J�4Y��U��`��6�Yq�6��ze�v �I ��.��8ҭ��3_sK!q�6�m��{��JW\{�f�܀��F, ��/�;��

Name

.text

Size

394KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.W,|

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.*.n

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.4`@

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_5f9a109014e75db82854818e533686cc_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

ws2_32

iphlpapi

shlwapi

urlmon

ntdll

wininet

generic