2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
Size 8.3MB
Sample260930-deandsxt8k
SHA256 9fa26404adb6c781997a688bf4836a75726c2e19930d05348b8e1d55b48458fa
MD5 3a615a0ca37f40e823924311e2598985
SHA1 d057d4c2f4bc27a1c159049d57b81e17a75a0866
SHA512 658faeba4c3a9866489a7e030d3b604b0db372c1ef159f7ca75fac9cc8fa09349619a91100e98ff4ef41a6080f87dc6dc3db5b1a6b23f7a55db9da7ba175acb0
SSDEEP 196608:TIV0GxRtX8tIHvM2c+tQasnAVQC2L4k/QBqjQHV0fJ4:EV0GxRtXiIHAnAl2L4De
TLSH
T11196CF11B390802AF4F701B586BE866AD9747E301725D0CFA3C07E5E6F716D1AA39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

.exe 8.3MB

2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 8961b6f3f37d074a3610bbbea0f6006c
SHA256 9fa26404adb6c781997a688bf4836a75726c2e19930d05348b8e1d55b48458fa
MD5 3a615a0ca37f40e823924311e2598985
SHA1 d057d4c2f4bc27a1c159049d57b81e17a75a0866
SHA512 658faeba4c3a9866489a7e030d3b604b0db372c1ef159f7ca75fac9cc8fa09349619a91100e98ff4ef41a6080f87dc6dc3db5b1a6b23f7a55db9da7ba175acb0
SSDEEP 196608:TIV0GxRtX8tIHvM2c+tQasnAVQC2L4k/QBqjQHV0fJ4:EV0GxRtXiIHAnAl2L4De
TLSH
T11196CF11B390802AF4F701B586BE866AD9747E301725D0CFA3C07E5E6F716D1AA39B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2218039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\autobuild_sesvc_13\360sesvc\bin\Release\sesvc.pdb

kernel32

SetErrorMode lstrcmpiW LoadLibraryExW OutputDebugStringA QueryInformationJobObject IsProcessInJob FlushFileBuffers QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapFree HeapCreate AreFileApisANSI TryEnterCriticalSection GetPrivateProfileStringW WritePrivateProfileStringW OpenProcess DebugBreak lstrlenA lstrlenW GetDiskFreeSpaceExW OpenMutexW GetCurrentThread WaitForMultipleObjects GetPrivateProfileIntW GetSystemDirectoryW GetTempFileNameW QueryDosDeviceW GetFileType DuplicateHandle DosDateTimeToFileTime GetCurrentDirectoryW GetExitCodeProcess ReleaseMutex GetSystemTimes MoveFileW VirtualQuery SetUnhandledExceptionFilter GetCommandLineW WritePrivateProfileStructW DeviceIoControl ResetEvent TlsAlloc TlsSetValue TlsFree CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer IsBadReadPtr IsBadWritePtr GetModuleHandleA lstrcpynW TerminateThread SuspendThread lstrcmpA lstrcmpiA GetFileSizeEx ExitProcess LocalFileTimeToFileTime CloseHandle MapViewOfFile GetCurrentProcess CreateFileMappingW CreateFileW GetLastError GetFileSize WriteFile ReadFile SetFilePointer CreateFileA VirtualAlloc VirtualFree GetVersionExW SetLastError SetFileTime CreateDirectoryW GetFileAttributesW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection DeleteFileW MultiByteToWideChar WideCharToMultiByte SetEvent WaitForSingleObject CreateEventW GetCurrentThreadId WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetModuleFileNameA SetEnvironmentVariableA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsGetValue SwitchToThread EncodePointer LoadLibraryExA VirtualProtect VerifyVersionInfoA VerSetConditionMask PeekNamedPipe GetStdHandle GetEnvironmentVariableA MoveFileExA GetSystemDirectoryA QueryPerformanceFrequency SleepEx GetACP TerminateProcess InterlockedDecrement InterlockedIncrement FindFirstFileW RemoveDirectoryW FindClose FreeLibrary InitializeCriticalSection ExitThread MoveFileExW SetFileAttributesW GetModuleFileNameW GlobalAddAtomW CopyFileW GetTempPathW GetTickCount CreateThread Process32NextW Process32FirstW UnmapViewOfFile FindNextFileW EnterCriticalSection LeaveCriticalSection CreateMutexW FreeResource LockResource GetProcAddress GlobalAlloc GlobalLock GlobalUnlock GlobalFree Sleep LoadResource SizeofResource LoadLibraryW GetModuleHandleW CreateProcessW FindResourceW CreateToolhelp32Snapshot GetLongPathNameW

user32

TrackMouseEvent GetMonitorInfoW MonitorFromWindow GetDesktopWindow SetWindowLongW GetWindowLongW GetWindowRect SetWindowTextW DestroyWindow LoadCursorW KillTimer SetTimer GetAsyncKeyState GetKeyState SetWindowPos ShowWindow IsWindow UnregisterClassW GetMessageW PostThreadMessageW GetMessagePos CreateWindowExW GetClassInfoExW UpdateLayeredWindow IsWindowVisible GetSystemMetrics RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW CreatePopupMenu GetShellWindow DestroyMenu MsgWaitForMultipleObjects CloseWindow RealGetWindowClassW SystemParametersInfoW WindowFromPoint GetLastInputInfo SendMessageTimeoutW wsprintfW EnumDisplayDevicesW EnumDisplaySettingsW CharLowerW EnumDisplayMonitors GetWindowTextW wvsprintfW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowW CharNextW PeekMessageW ReleaseDC GetClassNameW SendMessageW DispatchMessageW TranslateMessage UnregisterHotKey RegisterHotKey GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow SetFocus AttachThreadInput FindWindowExW FindWindowExA FindWindowA GetDC DrawTextW SetMenuInfo TrackPopupMenu AppendMenuW PostMessageW

gdi32

GetDeviceCaps GetObjectW SetTextColor SetBkMode SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap

shell32

SHGetFolderPathW ord165 SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW SHFileOperationW ord680 SHAppBarMessage

ws2_32

send recv listen htons htonl closesocket accept gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAIoctl WSASetLastError setsockopt ntohs getsockopt getsockname getpeername connect bind WSAGetLastError socket WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAStartup WSAWaitForMultipleEvents

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

shlwapi

PathFindExtensionW SHGetValueA PathIsRootW PathGetDriveNumberW PathAddBackslashW StrDupW StrStrIW PathFindFileNameA StrStrIA SHDeleteValueW PathFindFileNameW StrCmpIW SHSetValueW SHGetValueW PathCombineW PathRemoveFileSpecW PathFileExistsA PathAppendW PathFileExistsW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

setupapi

SetupIterateCabinetW

netapi32

Netbios NetUserChangePassword

generic

count=20, id=241, version=40116,

count=204, id=243, version=40116,

count=30, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=199, version=41118,

count=27, id=259, version=26706,

count=35, id=260, version=26706,

count=77, id=261, version=26706,

count=113, id=260, version=27034,

count=33, id=261, version=27034,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=718, id=1, productName=Unmarked objects,

count=116, id=261, version=27043,

count=49, id=260, version=27043,

count=1, id=256, version=27043,

count=1, id=255, version=27043,

count=1, id=151,

count=1, id=258, version=27043,