2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar
Size 553KB
Sample261014-ff89fsywfv
SHA256 8446d4472e31d125b0a08e7a7641d871d36fdaf994777af5a2d28832657c3e7b
MD5 d70e5854f7b008357b90d72b7574cd23
SHA1 08d71bfcf8fddcd9b82d8560accd324e58fe2b9a
SHA512 24f465338b917250639b9b905fdd37aba414762ec39fe7f4d0a1578ea0e20f6f008991299f271b081f789a13dad7844be7e85c90ab7153523a13ab7253bb22d7
SSDEEP 6144:wvhKCHhjy7b0/W9hmXeq1e11BONCgF+JHk3x/utKReXsHTL+4ES892Z7dS8YVhC:xCNy7WwOgDevF+JKu4eU+ViVLKhC
TLSH
T167C4BF06F6D00475D4B7513889F39A66D77ABC2507609BCF23E0476A2F33BD1AA3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

File Explorer

2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

.exe 553KB

2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

IMPHASH ee897f88e1b7454abfe903e70ab551ff
SHA256 8446d4472e31d125b0a08e7a7641d871d36fdaf994777af5a2d28832657c3e7b
MD5 d70e5854f7b008357b90d72b7574cd23
SHA1 08d71bfcf8fddcd9b82d8560accd324e58fe2b9a
SHA512 24f465338b917250639b9b905fdd37aba414762ec39fe7f4d0a1578ea0e20f6f008991299f271b081f789a13dad7844be7e85c90ab7153523a13ab7253bb22d7
SSDEEP 6144:wvhKCHhjy7b0/W9hmXeq1e11BONCgF+JHk3x/utKReXsHTL+4ES892Z7dS8YVhC:xCNy7WwOgDevF+JKu4eU+ViVLKhC
TLSH
T167C4BF06F6D00475D4B7513889F39A66D77ABC2507609BCF23E0476A2F33BD1AA3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\YoavShaharabani\source\repos\scenario-generator\Release\PrintSpoolerHijack.pdb

kernel32

DecodePointer LocalFree DeleteCriticalSection GetModuleHandleW EnterCriticalSection TerminateProcess GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetTempPathW CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex GetModuleHandleA DisconnectNamedPipe Sleep TerminateThread CreateThread GetProcAddress FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GetFullPathNameW ReadFile FindFirstFileW SetErrorMode SetFilePointer FindClose CreateEventW GetCurrentThread LoadLibraryA GetFileSize IsWow64Process GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetProcessHeap CloseHandle Process32FirstW CreateFileA Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx WriteFile GetCurrentProcess GetCommandLineW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapSize WriteConsoleW CreateDirectoryA GetModuleFileNameA HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA HeapAlloc HeapFree

user32

SendMessageA wsprintfW FindWindowA

advapi32

SetEntriesInAclW CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW QueryServiceStatusEx SetNamedSecurityInfoW GetNamedSecurityInfoW

ole32

CoCreateInstance CoUninitialize CoInitialize

rpcrt4

RpcStringBindingComposeW NdrClientCall2 RpcBindingFree RpcStringFreeW RpcBindingSetAuthInfoExW RpcBindingFromStringBindingW

winmm

timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_d70e5854f7b008357b90d72b7574cd23_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_stealc_vidar

kernel32

user32

advapi32

ole32

rpcrt4

winmm

generic