2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
Size 4.7MB
Sample261024-tf86cafc42
SHA256 93d96aebe27a2481798b19ab8a2e7912482997be220c1aec72413a59584c38be
MD5 3cb6e3ecaa00f9750c5a23779e211431
SHA1 edfe468029a26a7ce18fa220c11d5e2c77477044
SHA512 534a4d59a7f23c74e3db49ed07bd8d666f06b7def8e3e325c5efc3313c1139ebad372a22363230e89dd33ae94042d67cf2470923c5f4d115543423ae463996a1
SSDEEP 49152:OWSytLd2nTJPBMO+YrovpU/9FITeqass1TNeW4SkZP4sz9MbkqJtb2Ij56ru56rX:OstJROgveqijfkZckJrbrX
TLSH
T1C836F62DED648F35D06B8074C592A76DE6323C018F224ACB5249BEACFE73FD15539226
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar

File Explorer

2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar

.exe 4.7MB

2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar

IMPHASH 4476a387919a0e264ba6d7a29b130d38
SHA256 93d96aebe27a2481798b19ab8a2e7912482997be220c1aec72413a59584c38be
MD5 3cb6e3ecaa00f9750c5a23779e211431
SHA1 edfe468029a26a7ce18fa220c11d5e2c77477044
SHA512 534a4d59a7f23c74e3db49ed07bd8d666f06b7def8e3e325c5efc3313c1139ebad372a22363230e89dd33ae94042d67cf2470923c5f4d115543423ae463996a1
SSDEEP 49152:OWSytLd2nTJPBMO+YrovpU/9FITeqass1TNeW4SkZP4sz9MbkqJtb2Ij56ru56rX:OstJROgveqijfkZckJrbrX
TLSH
T1C836F62DED648F35D06B8074C592A76DE6323C018F224ACB5249BEACFE73FD15539226
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

64BitMAPIBroker.pdb

kernel32

WriteFile InitializeCriticalSection CreateEventA LeaveCriticalSection TransactNamedPipe ReadFile CreateFileW DisconnectNamedPipe GetLastError SetLastError GetProcAddress EnterCriticalSection ResetEvent GetFileType SetNamedPipeHandleState DeleteCriticalSection CloseHandle GetCurrentProcessId WaitNamedPipeW CreateThread GetVersionExA PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers CreateNamedPipeA WaitForMultipleObjects GetCommandLineA Sleep FreeLibrary WideCharToMultiByte LoadLibraryA CreateNamedPipeW GetModuleHandleW GetSystemTimeAsFileTime GetCurrentThreadId ConnectNamedPipe SetEvent WaitForSingleObject GetCurrentProcess LocalFree GetTickCount QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW DecodePointer EncodePointer GetCurrentThread LocalAlloc TlsSetValue CreateSemaphoreA TlsAlloc TlsGetValue CreateMutexW TlsFree MultiByteToWideChar

user32

TranslateMessage DispatchMessageA GetMessageA

advapi32

ConvertSidToStringSidA GetTokenInformation OpenProcessToken OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFileInfoW

msvcp100

?_Xout_of_range@std@@YAXPEBD@Z ?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z ?_Xlength_error@std@@YAXPEBD@Z

msvcr100

memcpy memcmp memchr memset _vsnwprintf_s swscanf_s __C_specific_handler _unlock __dllonexit _lock _onexit _amsg_exit __wgetmainargs _XcptFilter _exit _cexit exit _wcmdln _initterm _initterm_e _configthreadlocale _CxxThrowException _commode _fmode __set_app_type __crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QEAAXXZ _wsplitpath_s vwprintf_s malloc free wcscpy_s ??_V@YAXPEAX@Z ??2@YAPEAX_K@Z memcpy_s ??3@YAXPEAX@Z _wassert memmove ??0exception@std@@QEAA@AEBV01@@Z ??0exception@std@@QEAA@AEBQEBD@Z ??1exception@std@@UEAA@XZ ?what@exception@std@@UEBAPEBDXZ __CxxFrameHandler3 wcscat_s wcstok_s _set_invalid_parameter_handler __setusermatherr strtok_s _purecall

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_3cb6e3ecaa00f9750c5a23779e211431_amadey_cobalt-strike_hijackloader_redline-stealer_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar

kernel32

user32

advapi32

shell32

msvcp100

msvcr100

generic