2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar
Size 595KB
Sample261020-wp71ratscy
SHA256 1cfb0dd92217d80bb8d697f57cce90add5848fb437eb986c00193b6f8adb8012
MD5 667b3982a368d1b4d72eb65151c65a5b
SHA1 fe8263365ceb119490ce5f3b01c62033ac6d6d9b
SHA512 87dc546bc506d1d8e466cc04e0484f7ce1a7b2d5eac2d3ce6deabf7491a27ab656fe513583d7cc204b1008eba6f3ea08abe138124533ab366af16197957f543d
SSDEEP 6144:2vhKCHhjy7b0/W9hmXeq1eEHftMgYPd21Pzb81nLGSsc5LTnPNYgLDDjqw5hC:zCNy7WwOn/tMx1CMlSNc5zDjRhC
TLSH
T175D49E12B6D00076E873513885F38A76E77AB86907619BCF0394477E9F2B7C1663DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar

File Explorer

2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar

.exe 595KB

2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar

IMPHASH ee897f88e1b7454abfe903e70ab551ff
SHA256 1cfb0dd92217d80bb8d697f57cce90add5848fb437eb986c00193b6f8adb8012
MD5 667b3982a368d1b4d72eb65151c65a5b
SHA1 fe8263365ceb119490ce5f3b01c62033ac6d6d9b
SHA512 87dc546bc506d1d8e466cc04e0484f7ce1a7b2d5eac2d3ce6deabf7491a27ab656fe513583d7cc204b1008eba6f3ea08abe138124533ab366af16197957f543d
SSDEEP 6144:2vhKCHhjy7b0/W9hmXeq1eEHftMgYPd21Pzb81nLGSsc5LTnPNYgLDDjqw5hC:zCNy7WwOn/tMx1CMlSNc5zDjRhC
TLSH
T175D49E12B6D00076E873513885F38A76E77AB86907619BCF0394477E9F2B7C1663DB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\YoavShaharabani\source\repos\scenario-generator\Release\PrintSpoolerHijack.pdb

kernel32

DecodePointer LocalFree DeleteCriticalSection GetModuleHandleW EnterCriticalSection TerminateProcess GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetTempPathW CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex GetModuleHandleA DisconnectNamedPipe Sleep TerminateThread CreateThread GetProcAddress FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GetFullPathNameW ReadFile FindFirstFileW SetErrorMode SetFilePointer FindClose CreateEventW GetCurrentThread LoadLibraryA GetFileSize IsWow64Process GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetProcessHeap CloseHandle Process32FirstW CreateFileA Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx WriteFile GetCurrentProcess GetCommandLineW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapSize WriteConsoleW CreateDirectoryA GetModuleFileNameA HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA HeapAlloc HeapFree

user32

SendMessageA wsprintfW FindWindowA

advapi32

SetEntriesInAclW CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW QueryServiceStatusEx SetNamedSecurityInfoW GetNamedSecurityInfoW

ole32

CoCreateInstance CoUninitialize CoInitialize

rpcrt4

RpcStringBindingComposeW NdrClientCall2 RpcBindingFree RpcStringFreeW RpcBindingSetAuthInfoExW RpcBindingFromStringBindingW

winmm

timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_667b3982a368d1b4d72eb65151c65a5b_amadey_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar

kernel32

user32

advapi32

ole32

rpcrt4

winmm

generic