2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 2.1MB
Sample261027-e5w5rays7m
SHA256 3573e8a08f5b2f8dfef41344563979174146f1d8f4c0eac846fe348083349c64
MD5 e224866390fff9484c37ce550b345283
SHA1 997e6bd8fad613f5390e0def3dd22bf2350152e8
SHA512 7e94f1b7913d5d134a60c40a0f1d83566f54326f9f7c01bf42190056e20b2383be52153d895e54d7b3cafa91dfbde53d530b85095ba84b0d4d1b32a06299fef1
SSDEEP 49152:5HwoRN7BwQE1bLg5ZJtfTDarSj8RoTCCW:iolwXLgh1JTy
TLSH
T1D2A5AE1A67E8C1F8E697D0798E41A645E6B57C0547738EDF0E64262A3E337F00E3E618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 2.1MB

2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 9e81ad1e5392198ccd7289fad65dab81
SHA256 3573e8a08f5b2f8dfef41344563979174146f1d8f4c0eac846fe348083349c64
MD5 e224866390fff9484c37ce550b345283
SHA1 997e6bd8fad613f5390e0def3dd22bf2350152e8
SHA512 7e94f1b7913d5d134a60c40a0f1d83566f54326f9f7c01bf42190056e20b2383be52153d895e54d7b3cafa91dfbde53d530b85095ba84b0d4d1b32a06299fef1
SSDEEP 49152:5HwoRN7BwQE1bLg5ZJtfTDarSj8RoTCCW:iolwXLgh1JTy
TLSH
T1D2A5AE1A67E8C1F8E697D0798E41A645E6B57C0547738EDF0E64262A3E337F00E3E618
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

473264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\exchange-plugin\release-8.6\win64\UPIA\Project\Win\x64\Release\UnifiedPluginInstallerAgent.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

vulcancontrol

?ReleaseInstance@IVulcanController@api5@vulcan@adobe@@SAXXZ ?GetInstance@IVulcanController@api5@vulcan@adobe@@SA?AW4VulcanControlErrorCode@@PEAPEAV1234@@Z ?initLogging@VulcanControlLogger@api5@vulcan@adobe@@SA?AW4VulcanControlErrorCode@@PEB_WW4VCLogLevel@1234@_KW4VCLogTarget@1234@2@Z

vulcanmessage5

?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEBD0@Z ??0IVulcanMessageListener@api5@vulcan@adobe@@QEAA@XZ ??1IVulcanMessageListener@api5@vulcan@adobe@@UEAA@XZ ?SetPayload@SuiteMessage@api5@vulcan@adobe@@QEAAXPEBD@Z ?GetPayload@SuiteMessage@api5@vulcan@adobe@@QEBAXPEAD@Z ?GetPayloadSize@SuiteMessage@api5@vulcan@adobe@@QEBA_KXZ ?SetDestination@SuiteMessage@api5@vulcan@adobe@@QEAAXAEBVEndPoint@234@@Z ?SetSource@SuiteMessage@api5@vulcan@adobe@@QEAAXAEBVEndPoint@234@@Z ?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ ??0SuiteMessage@api5@vulcan@adobe@@QEAA@PEBD@Z ?GetType@VulcanMessage@api5@vulcan@adobe@@QEBAXPEAD@Z ?GetTypeSize@VulcanMessage@api5@vulcan@adobe@@QEBA_KXZ ?GetAppVersion@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z ?GetAppVersionSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ ?GetAppId@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z ?initLogging@VulcanMessageLogger@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEB_WW4VMLogLevel@1234@_KW4VMLogTarget@1234@2@Z ??1EndPoint@api5@vulcan@adobe@@UEAA@XZ ??4EndPoint@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z ??0EndPoint@api5@vulcan@adobe@@QEAA@AEBV0123@@Z ?GetAppIdSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ ?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEAPEAV1234@@Z ??1SuiteMessage@api5@vulcan@adobe@@UEAA@XZ ??0EndPoint@api5@vulcan@adobe@@QEAA@XZ

kernel32

GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetLastError DecodePointer InitializeCriticalSectionEx DeleteCriticalSection SetEvent FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW LocalFree FormatMessageA Sleep ReadFile FindFirstFileW FindNextFileW WriteFile RemoveDirectoryW GetTempPathW FindClose CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW CloseHandle MoveFileExW lstrcmpW FlushFileBuffers EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetFilePointer GetCurrentThreadId GetCurrentProcessId MultiByteToWideChar RaiseException GetCurrentProcess GetVersionExW CreateEventW VerSetConditionMask GetModuleHandleW VerifyVersionInfoW GetTimeZoneInformation LCMapStringW GetFileSizeEx FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW WaitForSingleObject ReleaseMutex OpenMutexW HeapFree SetLastError TerminateProcess HeapSize HeapReAlloc CreateThread ResetEvent HeapAlloc GetProcessHeap GetUserDefaultLangID GetUserDefaultUILanguage GetFileAttributesExW SetEndOfFile GetSystemTimeAsFileTime GetCurrentDirectoryW GetLongPathNameW GetSystemDirectoryW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetEnvironmentVariableA GetSystemInfo GetComputerNameA WideCharToMultiByte InterlockedPushEntrySList RtlUnwindEx OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess GetFileType CompareStringW GetLocaleInfoW IsValidLocale AcquireSRWLockExclusive EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetThreadPriority GetConsoleScreenBufferInfo SetConsoleTextAttribute ExitThread InitializeSRWLock GetUserDefaultLCID RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo RtlPcToFileHeader QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread InitializeConditionVariable WakeConditionVariable LCMapStringEx EncodePointer GetStringTypeW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable ReleaseSRWLockExclusive

advapi32

CryptGenRandom CryptReleaseContext ReportEventW RegisterEventSourceW DeregisterEventSource CryptAcquireContextW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetKnownFolderPath

ole32

CLSIDFromProgID CoUninitialize CLSIDFromString CoCreateInstance OleRun CoTaskMemFree CoInitialize

oleaut32

SysFreeString VariantClear SysAllocString GetErrorInfo

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathAppendW PathIsDirectoryW PathRenameExtensionW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW

iphlpapi

GetAdaptersInfo

Name

.text

Size

852KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

373KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

763KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e224866390fff9484c37ce550b345283_amadey_cobalt-strike_icedid_njrat_satacom_stealc_vidar

version

vulcancontrol

vulcanmessage5

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

generic