2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry
Size 86.6MB
Sample261030-j6zpgsxthy
SHA256 aef4564eed9ed0c3b9d5a2b3d53c6d236d7e733a0ae83a0f3f4de3f7be6ab07a
MD5 26f950d7a3908a09cb7a818b3932332a
SHA1 f9d8a17f9c24b82845388de4afb550ed436caa72
SHA512 bd5d4693e540ca79f47783cc33d755201eff099057b072ce4f0ed032de209aaf6a9b0b65cb97c0e4b197e261ca439b546f7224a92f757dec325c39da13ab05aa
SSDEEP 1572864:Svf1icCvRPow21UmUOmQM10UYb/ywoABhmmN3PStR99qUeCAFr+lTww8SUwQU+W:Svf1A1UzmJ10UlABhPY5owAeTwwoHU+
TLSH
T1791833606A6590F6C911A57E8D33AF64DBA2A5EC03216BC31FC0C1447F6B2A85F3ED74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry

File Explorer

2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry

.exe 86.6MB

2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry

IMPHASH 7be4ee26b48cd1554fe05cd0c1a48e04
SHA256 aef4564eed9ed0c3b9d5a2b3d53c6d236d7e733a0ae83a0f3f4de3f7be6ab07a
MD5 26f950d7a3908a09cb7a818b3932332a
SHA1 f9d8a17f9c24b82845388de4afb550ed436caa72
SHA512 bd5d4693e540ca79f47783cc33d755201eff099057b072ce4f0ed032de209aaf6a9b0b65cb97c0e4b197e261ca439b546f7224a92f757dec325c39da13ab05aa
SSDEEP 1572864:Svf1icCvRPow21UmUOmQM10UYb/ywoABhmmN3PStR99qUeCAFr+lTww8SUwQU+W:Svf1A1UzmJ10UlABhPY5owAeTwwoHU+
TLSH
T1791833606A6590F6C911A57E8D33AF64DBA2A5EC03216BC31FC0C1447F6B2A85F3ED74
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey

kernel32

GetEnvironmentStringsW GetCommandLineA GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile FreeEnvironmentStringsW GetCommandLineW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFullPathNameW SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError Sleep OpenProcess VirtualQueryEx ReadProcessMemory GetModuleFileNameW CopyFileW MoveFileExW WaitForSingleObject CreateRemoteThread GetExitCodeThread VirtualAllocEx WriteProcessMemory GetModuleHandleW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetTickCount VirtualProtectEx VirtualFreeEx CreateProcessW WideCharToMultiByte MultiByteToWideChar IsDebuggerPresent GetCurrentProcess LoadLibraryExW VirtualProtect GetFileType HeapAlloc FindClose FindFirstFileExW FindNextFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree RtlUnwind

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.durl

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dhook

Size

1024B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dpl

Size

535KB

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bait

Size

85.8MB

Virtual Size

85.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_26f950d7a3908a09cb7a818b3932332a_amadey_cobalt-strike_icedid_njrat_satacom_stealc_wannacry

advapi32

kernel32

shell32

ole32

generic