2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc
Size 4.8MB
Sample261024-c6b5vsft2t
SHA256 a25a4659c2614735cee0d15bde9f1cfc30e3daca3a2927a2ec061cc4113e9891
MD5 9f8c3e9b284fc80f09c46fc45ba93242
SHA1 1061dbb0644cd992d2e6dbe6f4239fe676e19ae9
SHA512 fc0bd3b7571ef26471e5d4fd1070862cca058e380f86e714aca9f524d0301e0008018b342b11c32f00b95a74cb09ec3e25a765ebc824b4e7cfc331eb7a1417a7
SSDEEP 49152:A9dJggJQ97Q48DJs2U8IlQQIVvcTn/PIJ5MpXecESyjYs555H55ux7NyAZOerb5a:if+OUlRAvSn/PsMpeHAxB3H0
TLSH
T12A36E155A2A901E9EF77D2BC8D469317EA723CC9037097DB13A84A661F17BF21A3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc

File Explorer

2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc

.exe 4.8MB

2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc

IMPHASH 6c549fb3d24e507add685ac6f4be84d5
SHA256 a25a4659c2614735cee0d15bde9f1cfc30e3daca3a2927a2ec061cc4113e9891
MD5 9f8c3e9b284fc80f09c46fc45ba93242
SHA1 1061dbb0644cd992d2e6dbe6f4239fe676e19ae9
SHA512 fc0bd3b7571ef26471e5d4fd1070862cca058e380f86e714aca9f524d0301e0008018b342b11c32f00b95a74cb09ec3e25a765ebc824b4e7cfc331eb7a1417a7
SSDEEP 49152:A9dJggJQ97Q48DJs2U8IlQQIVvcTn/PIJ5MpXecESyjYs555H55ux7NyAZOerb5a:if+OUlRAvSn/PsMpeHAxB3H0
TLSH
T12A36E155A2A901E9EF77D2BC8D469317EA723CC9037097DB13A84A661F17BF21A3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

user32

IsIconic GetWindowThreadProcessId GetWindow IsWindowVisible GetWindowTextA EnumWindows GetClientRect RealGetWindowClassA

advapi32

AdjustTokenPrivileges OpenProcessToken GetTokenInformation LookupPrivilegeValueW

shell32

SHGetFolderPathA SHGetFolderPathW

kernel32

GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW ReadConsoleW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapSize HeapReAlloc WriteConsoleW FreeEnvironmentStringsW RtlLookupFunctionEntry FindNextFileW FindFirstFileExW FindClose CreateDirectoryW ReadFile SizeofResource WriteProcessMemory GetCurrentProcess WriteFile GetModuleFileNameW SetFilePointer WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetLastError GetFileAttributesExW Process32NextW LockResource DeleteFileW Process32FirstW CloseHandle LoadResource FindResourceW GetLocalTime GetProcAddress VirtualAllocEx LocalFree MoveFileExW GetModuleHandleW CopyFileW WideCharToMultiByte CreateRemoteThread FormatMessageA VirtualFreeEx IsWow64Process QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc

bcrypt

user32

advapi32

shell32

kernel32

generic