2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar
Size 8.1MB
Sample260912-m8bbfsad44
SHA256 824553bc956c33c0fdaaa4bd65f2e6153b03aa0e6bb29d289435eb7f0b8556b4
MD5 3db21f094cd4ad9f7ce6e2f452f1398d
SHA1 b56d5bf679463e467575a4cc1ef849a8c24ebc1b
SHA512 b9f820a7fca426f931d3a064512ecd251d8310439bcb038810bacd127db3dd8df20d964fc345d0e2fad9f134a0cc9b3ea5f72e531b208b454756e765ea02b835
SSDEEP 196608:HSfG77Vdd6GNXIXbD9cf3D8wYyNPEgFA6FGauQ9e:F7YCP9FA6saB9e
TLSH
T19C86630267FD0418F5F36B799B7A98518A3BBC660B34E5DF00581C5D0B73A829DB2B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar

File Explorer

2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar

.exe 8.1MB

2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar

IMPHASH 585f6f71377cdf184b4a45ba1f63fd55
SHA256 824553bc956c33c0fdaaa4bd65f2e6153b03aa0e6bb29d289435eb7f0b8556b4
MD5 3db21f094cd4ad9f7ce6e2f452f1398d
SHA1 b56d5bf679463e467575a4cc1ef849a8c24ebc1b
SHA512 b9f820a7fca426f931d3a064512ecd251d8310439bcb038810bacd127db3dd8df20d964fc345d0e2fad9f134a0cc9b3ea5f72e531b208b454756e765ea02b835
SSDEEP 196608:HSfG77Vdd6GNXIXbD9cf3D8wYyNPEgFA6FGauQ9e:F7YCP9FA6saB9e
TLSH
T19C86630267FD0418F5F36B799B7A98518A3BBC660B34E5DF00581C5D0B73A829DB2B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8499200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\__w\1\s\exe\Win32\Public_Release\Sysmon.pdb

tdh

TdhGetEventMapInformation TdhGetEventInformation

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeExW GetFileVersionInfoExW

netapi32

NetApiBufferFree NetServerEnum

ws2_32

getnameinfo htons gethostname inet_ntoa WSAStartup gethostbyname ntohs

mpr

WNetCancelConnection2W WNetAddConnection2W

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx StringFromGUID2 IIDFromString CoUninitialize CoInitializeSecurity

kernel32

Module32FirstW K32EnumProcesses SystemTimeToFileTime GetSystemTime SizeofResource LockResource LoadResource FindResourceW CreateDirectoryW GetConsoleScreenBufferInfo lstrlenW RemoveDirectoryW GetTempPathW CreateFileW GetFileAttributesW GetSystemDirectoryW Process32NextW SetEvent DeleteFileW Process32FirstW GetSystemInfo VerSetConditionMask GetComputerNameW CreateProcessW VerifyVersionInfoW GetSystemTimeAsFileTime GetTickCount ConnectNamedPipe GetExitCodeProcess ExpandEnvironmentStringsW ProcessIdToSessionId ExitProcess GetCurrentProcessId CopyFileW ReadFile SetConsoleCtrlHandler GetFileSizeEx CreateThreadpool WaitForMultipleObjects SetThreadPriority SetThreadpoolThreadMinimum CreateEventW SetThreadpoolThreadMaximum GetOverlappedResult SubmitThreadpoolWork SetUnhandledExceptionFilter CreateThreadpoolWork QueryDosDeviceW ReleaseSRWLockExclusive WriteFile CreateToolhelp32Snapshot GetWindowsDirectoryW GetTempFileNameW K32GetMappedFileNameW QueryPerformanceFrequency ResetEvent QueryPerformanceCounter CreateThread FindFirstFileW FindNextFileW FindClose LoadLibraryW K32GetModuleBaseNameW WideCharToMultiByte UnmapViewOfFile CreateFileMappingW MapViewOfFile TerminateProcess SetFileAttributesW GlobalSize FreeConsole GlobalLock GlobalUnlock GetEnabledXStateFeatures InitializeCriticalSectionEx GetConsoleMode GetCommandLineA SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread InitializeSRWLock ResumeThread ExitThread GetConsoleCP GetModuleHandleExW SetStdHandle TlsFree InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException OutputDebugStringW GetCPInfo CompareStringEx LCMapStringEx GetLocaleInfoEx EncodePointer GetStringTypeW GetConsoleOutputCP OpenProcess DeviceIoControl CloseThreadpoolWork AcquireSRWLockShared DecodePointer ReleaseSRWLockShared GetLogicalDriveStringsW GetLastError FormatMessageW GetDateFormatW FreeLibrary GetTimeFormatW FileTimeToSystemTime MultiByteToWideChar TlsGetValue DeleteCriticalSection CloseHandle TlsAlloc GetCurrentThread Sleep DuplicateHandle ReleaseMutex GetCurrentThreadId WaitForSingleObject CreateMutexW InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnterCriticalSection TlsSetValue GetModuleHandleW LocalFree GetProcAddress LocalAlloc GetStdHandle GetCommandLineW LoadLibraryExW GetVersionExW SetLastError GetFileType GetModuleFileNameW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA AcquireSRWLockExclusive InitializeSListHead SetFilePointerEx HeapReAlloc SetCurrentDirectoryW GetCurrentDirectoryW HeapSize FindFirstFileExW IsValidCodePage GetACP GetStartupInfoW IsDebuggerPresent SleepConditionVariableSRW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation WriteConsoleW SetEndOfFile WakeAllConditionVariable IsProcessorFeaturePresent GetFullPathNameW ReadConsoleW FormatMessageA UnhandledExceptionFilter

user32

GetWindowThreadProcessId GetMessageW DefWindowProcW SetClipboardViewer GetClipboardOwner CreateWindowExW GetPriorityClipboardFormat OpenClipboard DispatchMessageW ChangeClipboardChain CloseClipboard RegisterClassW TranslateMessage GetClipboardData GetClipboardSequenceNumber MessageBoxW UnregisterClassW InflateRect EndDialog SetWindowTextW DialogBoxIndirectParamW LoadCursorW SetCursor GetDlgItem GetSysColorBrush SendMessageW

gdi32

EndDoc GetDeviceCaps SetMapMode StartDocW EndPage StartPage

comdlg32

PrintDlgW

advapi32

RevertToSelf GetSecurityDescriptorSacl GetSecurityDescriptorDacl CryptAcquireContextW GetAce CryptGenRandom IsWellKnownSid GetSecurityDescriptorOwner GetFileSecurityW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx CryptReleaseContext DeregisterEventSource GetSidSubAuthorityCount GetSidSubAuthority CopySid RegisterEventSourceW RegNotifyChangeKeyValue RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl RegDeleteKeyW SetServiceStatus ChangeServiceConfig2W RegQueryValueExW SetEntriesInAclW RegCreateKeyExW InitializeSecurityDescriptor StartServiceCtrlDispatcherW QueryServiceConfigW RegDeleteValueW QueryServiceConfig2W LookupAccountSidW LookupAccountNameW LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyW CreateServiceW QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid DeleteService ControlService ImpersonateLoggedOnUser LogonUserW OpenProcessToken FreeSid StartServiceW RegConnectRegistryW OpenServiceW GetTokenInformation GetLengthSid GetSecurityDescriptorLength ReportEventW StartTraceW ProcessTrace CloseTrace ControlTraceW OpenTraceW EnableTraceEx2 ConvertSidToStringSidW RegGetValueW RegCloseKey RegSetValueExW RegOpenKeyExW RegOpenKeyW

oleaut32

VariantInit SafeArrayDestroy SysAllocStringLen SafeArrayGetElement SysStringByteLen VariantChangeType VariantClear CreateErrorInfo SafeArrayGetLBound SysFreeString SysAllocString SysStringLen SafeArrayGetUBound SafeArrayUnaccessData SysAllocStringByteLen GetErrorInfo SetErrorInfo SafeArrayAccessData

crypt32

CertGetNameStringW CryptFindOIDInfo CertDuplicateCertificateContext CertGetCertificateChain

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

rpcrt4

RpcStringFreeW RpcServerRegisterIfEx NdrClientCall2 NdrServerCall2 RpcServerUseProtseqEpW RpcServerUnregisterIf RpcBindingFromStringBindingW I_RpcBindingInqLocalClientPID RpcStringBindingComposeW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

807KB

Virtual Size

807KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-11_3db21f094cd4ad9f7ce6e2f452f1398d_amadey_badda_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar

tdh

userenv

version

netapi32

ws2_32

mpr

wtsapi32

ole32

kernel32

user32

gdi32

comdlg32

advapi32

oleaut32

crypt32

secur32

rpcrt4

generic