2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom
Size 31.4MB
Sample261102-l93xesa19l
SHA256 80b7a7329d4eefe8f4b4a16f06ae41d670765dd6dbd36a6bc836aeba1befac28
MD5 bc71a01e9198957ec28bc613f647c139
SHA1 e19871eb1433774c715f644e8f8703a9bb321ed9
SHA512 c62865dd779b6c19d812d64000d77c8d663d87e27119b33c8122757bdd90a3aa9b2c09a71169f2ac00751c2bfd2eccef2e86c3693972040f417bb5f931a8156d
SSDEEP 393216:T3JdnYvcKOcnZL6RuJUog1rperj/FMEo6/uhiM6rF3HYCOE:TTYocoRuJUogtpevSEo+u4M6rZYXE
TLSH
T15277AD02B7D88475E2FB2634257AA736557EBD201FE081CB2B54A7AE2C717C19E3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom

File Explorer

2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom

.exe 31.4MB

2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom

IMPHASH 452b43a4d3b0c5342aecc52d95d3735c
SHA256 80b7a7329d4eefe8f4b4a16f06ae41d670765dd6dbd36a6bc836aeba1befac28
MD5 bc71a01e9198957ec28bc613f647c139
SHA1 e19871eb1433774c715f644e8f8703a9bb321ed9
SHA512 c62865dd779b6c19d812d64000d77c8d663d87e27119b33c8122757bdd90a3aa9b2c09a71169f2ac00751c2bfd2eccef2e86c3693972040f417bb5f931a8156d
SSDEEP 393216:T3JdnYvcKOcnZL6RuJUog1rperj/FMEo6/uhiM6rF3HYCOE:TTYocoRuJUogtpevSEo+u4M6rZYXE
TLSH
T15277AD02B7D88475E2FB2634257AA736557EBD201FE081CB2B54A7AE2C717C19E3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sespeal.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetSystemTimes GetThreadId GetTickCount GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

CountClipboardFormats GetActiveWindow GetCursorPos GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetLastInputInfo GetShellWindow GetSystemMetrics SystemParametersInfoW

advapi32

GetSidLengthRequired

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

430KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

377KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

241B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bc71a01e9198957ec28bc613f647c139_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom

kernel32

user32

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

generic