2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar
Size 29.0MB
Sample261023-jb653scd84
SHA256 4bbccea6ff853e7b308c762882df82d6b4079cee0908f7664898f6f8820f16af
MD5 c952dfb6d5cb62eed97a1a6d78e7b57f
SHA1 80a6370728b655cefa929917f3fdf5404e129085
SHA512 d9f45d289f3c14a6bd061429495dfd421396b1e9e3fed260bea7d43c3e55cdfed016d698a19d922488c00b66c923d12c9ef11caea28a1544eeb5f4a5472a6738
SSDEEP 393216:GRLIbf77xkn1PYRYXG9ntWoSdjXlj42g5:8LkfqoYXRoSdjXi2
TLSH
T14B67BF05FBC940B1D5E785389E67D36BD636B8214B30CECBA190691D6E73BC14A39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

File Explorer

2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

.exe 29.0MB

2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

IMPHASH 19367e0731910af3d609b922c99465b2
SHA256 4bbccea6ff853e7b308c762882df82d6b4079cee0908f7664898f6f8820f16af
MD5 c952dfb6d5cb62eed97a1a6d78e7b57f
SHA1 80a6370728b655cefa929917f3fdf5404e129085
SHA512 d9f45d289f3c14a6bd061429495dfd421396b1e9e3fed260bea7d43c3e55cdfed016d698a19d922488c00b66c923d12c9ef11caea28a1544eeb5f4a5472a6738
SSDEEP 393216:GRLIbf77xkn1PYRYXG9ntWoSdjXlj42g5:8LkfqoYXRoSdjXi2
TLSH
T14B67BF05FBC940B1D5E785389E67D36BD636B8214B30CECBA190691D6E73BC14A39B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Demian\Projects\CIS\CIS_UM\CisReportTool\Release\x32\Symbols\CisReportTool.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CryptUnprotectData

kernel32

GetLastError HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CloseHandle CreateFileW GetProcAddress GetModuleHandleW WriteFile GetTempPathW DeleteFileW GetCurrentProcess VerSetConditionMask VerifyVersionInfoW SetEnvironmentVariableW CreateDirectoryW GetModuleFileNameW GetComputerNameW FindResourceW LoadResource SizeofResource LockResource GetStdHandle CreateProcessW WaitForSingleObject FindResourceExW GetExitCodeProcess LocalFree InitializeCriticalSectionEx DecodePointer DeleteCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP SetStdHandle WriteConsoleW GetTickCount GetACP IsValidCodePage ReadConsoleW GetFileSizeEx ReadFile SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle SetEndOfFile GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetFolderPathW

oleaut32

VarUdateFromDate SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

PathRemoveBackslashW PathRemoveFileSpecW PathQuoteSpacesW PathAddBackslashW PathAppendW PathFileExistsW

Name

.text

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28.7MB

Virtual Size

28.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_karagany_luca-stealer_lynx_medusalocker_njrat_redline-stealer_remcos_revil_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

version

crypt32

kernel32

advapi32

shell32

oleaut32

shlwapi

generic