2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar
Size 552KB
Sample261014-e6stqafw7v
SHA256 f25fb0912d0695d2460336781af1a2c865d8f61664f2c1b7a19b149a5a353384
MD5 d8b96cb8fc0e9eb6b4a3615f3a38a8f1
SHA1 4b68723cabef708ad96a99facaa3dce476cc5a21
SHA512 a944b2feb9fa48cb27d0c8342fa674a41f0d64daa49cce7d4b42701ae8eb3957352d25b4e09c932134be0a9448a6aeb5a333a18dc7d0dc145c2c84f40e1fe2e2
SSDEEP 6144:ivhKCHhjy7b0/W9hmXeq1eHgmuibVyCncVes4t4e8ERchOMJqhVZYtrowDYtShC:fCNy7WwO6j1bVyx418UMJ4EoftShC
TLSH
T13DC4BF06B6D004B5D0B7513889F35A62D77ABC5907619BCF23D00B6A6F33BD19E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

File Explorer

2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

.exe 552KB

2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

IMPHASH ee897f88e1b7454abfe903e70ab551ff
SHA256 f25fb0912d0695d2460336781af1a2c865d8f61664f2c1b7a19b149a5a353384
MD5 d8b96cb8fc0e9eb6b4a3615f3a38a8f1
SHA1 4b68723cabef708ad96a99facaa3dce476cc5a21
SHA512 a944b2feb9fa48cb27d0c8342fa674a41f0d64daa49cce7d4b42701ae8eb3957352d25b4e09c932134be0a9448a6aeb5a333a18dc7d0dc145c2c84f40e1fe2e2
SSDEEP 6144:ivhKCHhjy7b0/W9hmXeq1eHgmuibVyCncVes4t4e8ERchOMJqhVZYtrowDYtShC:fCNy7WwO6j1bVyx418UMJ4EoftShC
TLSH
T13DC4BF06B6D004B5D0B7513889F35A62D77ABC5907619BCF23D00B6A6F33BD19E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\YoavShaharabani\source\repos\scenario-generator\Release\PrintSpoolerHijack.pdb

kernel32

DecodePointer LocalFree DeleteCriticalSection GetModuleHandleW EnterCriticalSection TerminateProcess GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetTempPathW CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex GetModuleHandleA DisconnectNamedPipe Sleep TerminateThread CreateThread GetProcAddress FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GetFullPathNameW ReadFile FindFirstFileW SetErrorMode SetFilePointer FindClose CreateEventW GetCurrentThread LoadLibraryA GetFileSize IsWow64Process GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetProcessHeap CloseHandle Process32FirstW CreateFileA Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx WriteFile GetCurrentProcess GetCommandLineW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapSize WriteConsoleW CreateDirectoryA GetModuleFileNameA HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA HeapAlloc HeapFree

user32

SendMessageA wsprintfW FindWindowA

advapi32

SetEntriesInAclW CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW QueryServiceStatusEx SetNamedSecurityInfoW GetNamedSecurityInfoW

ole32

CoCreateInstance CoUninitialize CoInitialize

rpcrt4

RpcStringBindingComposeW NdrClientCall2 RpcBindingFree RpcStringFreeW RpcBindingSetAuthInfoExW RpcBindingFromStringBindingW

winmm

timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_d8b96cb8fc0e9eb6b4a3615f3a38a8f1_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

kernel32

user32

advapi32

ole32

rpcrt4

winmm

generic