2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar
Size 6.0MB
Sample261113-j9w3rssv2m
SHA256 88ecfc2964ae78fc8a7ce336a0290cda1f97e93f2faf088cd754cf61258ff9bd
MD5 0f0c83a1829333fba1d39c1fdded163b
SHA1 7f19881d2ca36a90299bbb3ad25f670f2f133af0
SHA512 392e85927f7fe998c5af49d9db75dbcd3810ac19ccef2be10d7a008b98477f2bdf813efff8e39bd65577e287a77b16489d5ab6e7ddc441334b5f1248a59888f9
SSDEEP 49152:l60NB82om6mZ4/YaX2LP9YgtI8GoWv4QjeNwr7xUScjuiJl5jszRVs4n0enI+h:lJliQamLjsoHV2rRiJe902
TLSH
T123563815A6D8062AF2B39130CAF2C216E7737CD55B308B8F09E997075BA3AD15937339
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

File Explorer

2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

.exe 6.0MB

2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

IMPHASH 4de88c573ca25682f1fe7d87fb67e7ec
SHA256 88ecfc2964ae78fc8a7ce336a0290cda1f97e93f2faf088cd754cf61258ff9bd
MD5 0f0c83a1829333fba1d39c1fdded163b
SHA1 7f19881d2ca36a90299bbb3ad25f670f2f133af0
SHA512 392e85927f7fe998c5af49d9db75dbcd3810ac19ccef2be10d7a008b98477f2bdf813efff8e39bd65577e287a77b16489d5ab6e7ddc441334b5f1248a59888f9
SSDEEP 49152:l60NB82om6mZ4/YaX2LP9YgtI8GoWv4QjeNwr7xUScjuiJl5jszRVs4n0enI+h:lJliQamLjsoHV2rRiJe902
TLSH
T123563815A6D8062AF2B39130CAF2C216E7737CD55B308B8F09E997075BA3AD15937339
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

213728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleMode SetConsoleTextAttribute SetConsoleTitleA GetConsoleScreenBufferInfo GetCurrentDirectoryA SetLastError DecodePointer RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx DeleteCriticalSection GetConsoleMode WideCharToMultiByte MultiByteToWideChar MoveFileExA CopyFileA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetFirmwareEnvironmentVariableW QueryFullProcessImageNameW CreateFileMappingA LocalFree LocalAlloc LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile VirtualProtect GetTickCount CreateProcessA GetCurrentThreadId GetCurrentThread TerminateProcess GetCurrentProcess Sleep WaitForSingleObject GetLastError CloseHandle GetTempPathW SetFileAttributesW GetLogicalDrives GetFileAttributesA FindNextFileW FindFirstFileW FindClose DeleteFileW DeleteFileA CreateFileW CreateDirectoryA GetStdHandle GetProcessHeap HeapFree HeapAlloc OutputDebugStringW GetExitCodeProcess FreeLibrary CreateProcessW WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetFileType RtlUnwind CreateThread InitializeCriticalSection CreatePipe GetVolumeInformationA ReadFile GetCPInfo EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeLibraryAndExitThread ResumeThread ExitThread GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW SetEnvironmentVariableW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA QueryPerformanceFrequency SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI DeviceIoControl GetFileInformationByHandleEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW RtlPcToFileHeader

user32

wsprintfW MessageBoxA

advapi32

LookupPrivilegeValueW SetSecurityInfo SetNamedSecurityInfoW SetEntriesInAclW StartServiceW OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle RegCopyTreeW RegSetKeyValueW RegSetKeyValueA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCreateKeyW RegCreateKeyA AllocateAndInitializeSid SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RevertToSelf IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl ImpersonateSelf GetTokenInformation GetLengthSid FreeSid AdjustTokenPrivileges AddAccessAllowedAce AccessCheck OpenThreadToken OpenProcessToken RegCloseKey

shell32

SHFileOperationW SHGetFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance StringFromGUID2

ws2_32

recv inet_ntoa setsockopt closesocket connect htons send socket gethostbyname shutdown WSAStartup inet_addr

iphlpapi

GetAdaptersInfo

shlwapi

StrStrW SHDeleteValueW PathFileExistsW PathRemoveFileSpecA SHDeleteKeyW

urlmon

URLDownloadToFileA

ntdll

RtlNtStatusToDosError RtlLookupFunctionEntry RtlSetLastWin32Error RtlVirtualUnwind NtClose NtOpenProcessToken NtAdjustPrivilegesToken RtlCaptureContext NtQuerySystemInformation RtlGetVersion

wininet

InternetGetConnectedState

Name

.text

Size

436KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

477KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_0f0c83a1829333fba1d39c1fdded163b_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

ws2_32

iphlpapi

shlwapi

urlmon

ntdll

wininet

generic