2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.4MB
Sample261027-xpl9qaec82
SHA256 6dac519707d396dd9e8a3396dae291114bb99068d8c9a56fc1d50dbb06182eb6
MD5 424d5433a1aaec495b08b89ae7d62757
SHA1 cfaf6e07a053cd7374ce9cf84f9ff04efd6a4e21
SHA512 e0b5a63fa8cf0b4c132d221f80705854ce9adbfb89460d2e265b680932e6cdef7c43856d887b36fe74388e4d222ffe619aa9d0bb5bea6110d880885f4619f22b
SSDEEP 49152:XYqXQiGA3wSy+p38nAWeWggO53Dx2Cdw9LJK5KMS+xitDU42mLsZFQw:yim8p3yggORx2d9LuhxQw7mLQuw
TLSH
T14DB5221172E480B5F1B3673089E4A961AA7AFC311B709ACF07901B3A5F366D1ED39763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.4MB

2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 3347322860d835185576f978c4ed0ee0
SHA256 6dac519707d396dd9e8a3396dae291114bb99068d8c9a56fc1d50dbb06182eb6
MD5 424d5433a1aaec495b08b89ae7d62757
SHA1 cfaf6e07a053cd7374ce9cf84f9ff04efd6a4e21
SHA512 e0b5a63fa8cf0b4c132d221f80705854ce9adbfb89460d2e265b680932e6cdef7c43856d887b36fe74388e4d222ffe619aa9d0bb5bea6110d880885f4619f22b
SSDEEP 49152:XYqXQiGA3wSy+p38nAWeWggO53Dx2Cdw9LJK5KMS+xitDU42mLsZFQw:yim8p3yggORx2d9LuhxQw7mLQuw
TLSH
T14DB5221172E480B5F1B3673089E4A961AA7AFC311B709ACF07901B3A5F366D1ED39763
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\git\servicesupdater\ChromeReprompt\x64\Release\ChromeReprompt.pdb

kernel32

LoadResource FindResourceW CreateProcessW GetExitCodeProcess lstrlenW lstrcpyW lstrcmpW GetTempPathA DeleteFileW ReadFile LockResource GetLastError GetTickCount64 CreateFileW LocalAlloc WaitForSingleObject RemoveDirectoryW WriteFile SizeofResource CreateDirectoryW SetDllDirectoryW GetSystemTime GetProcessHeap LocalFree HeapAlloc CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess GetCurrentProcess GetCommandLineW SetDefaultDllDirectories SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP HeapFree ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetLocalTime RtlLookupFunctionEntry GetACP IsValidCodePage RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType MultiByteToWideChar WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW

advapi32

ConvertSidToStringSidW FreeSid OpenProcessToken AllocateAndInitializeSid EqualSid ConvertStringSecurityDescriptorToSecurityDescriptorW RegGetValueW RegCloseKey RegCreateKeyExW RegSetValueExW GetTokenInformation RegOpenKeyExW RegDeleteValueW RegQueryValueExW

shell32

CommandLineToArgvW SHCreateDirectoryExW SHGetKnownFolderPath

ole32

CoCreateGuid CoTaskMemFree StringFromGUID2

urlmon

URLDownloadToFileW

crypt32

CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CryptMsgClose

wintrust

WinVerifyTrust

Name

.text

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_424d5433a1aaec495b08b89ae7d62757_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

shell32

ole32

urlmon

crypt32

wintrust

generic