2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

General

Target
2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar
Size 9.8MB
Sample261113-qqbfaacs2v
SHA256 a6303f2effa208bbd047c848e19b7b1a31d9fe57c0328f8de8ee2199ba017e2f
MD5 444acd887c45007743c3548bbd86c4ab
SHA1 aecb2b6e7b1d0483eb170e4b7901831a8f8408b6
SHA512 84642aefd2223cc5b16b634d01a04fdb89d9ecec80e5c2908dc780d76367f7f792f6a67d05e2b26db704ba02019906aa7b2df21b123cf9684c1707e010aed177
SSDEEP 196608:l5LPUYwHFsk5xrlnT4um89076hPZ+C9TVQBWG:LTUYwHFsk7rBu82MKB
TLSH
T18DA69F17A2E800ECD4F7D1388A578613E7B2B84A47B197DF0690557A1F63BE19E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

File Explorer

2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

.exe 9.8MB

2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

IMPHASH 0795074c0fd49af21c56997b57d9f871
SHA256 a6303f2effa208bbd047c848e19b7b1a31d9fe57c0328f8de8ee2199ba017e2f
MD5 444acd887c45007743c3548bbd86c4ab
SHA1 aecb2b6e7b1d0483eb170e4b7901831a8f8408b6
SHA512 84642aefd2223cc5b16b634d01a04fdb89d9ecec80e5c2908dc780d76367f7f792f6a67d05e2b26db704ba02019906aa7b2df21b123cf9684c1707e010aed177
SSDEEP 196608:l5LPUYwHFsk5xrlnT4um89076hPZ+C9TVQBWG:LTUYwHFsk7rBu82MKB
TLSH
T18DA69F17A2E800ECD4F7D1388A578613E7B2B84A47B197DF0690557A1F63BE19E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3380416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb

kernel32

LocalFree GetFileInformationByHandle GetTempPathW MoveFileExW OpenProcess TerminateProcess WaitForSingleObject LeaveCriticalSection EnterCriticalSection SwitchToThread GetExitCodeProcess ReadFile PeekNamedPipe ResumeThread UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW GetProcessTimes CreateProcessW DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetCurrentProcessId CreateNamedPipeW GetTickCount64 SetEndOfFile SetFilePointer GetWindowsDirectoryW GetEnvironmentVariableW RemoveDirectoryW DeleteFileW GetModuleHandleW GetModuleFileNameW HeapFree GetProcessHeap HeapAlloc FormatMessageW LocalAlloc CallNamedPipeW GetNamedPipeServerProcessId GetSystemDirectoryW LoadLibraryW GetProcAddress FreeLibrary CreateEventW SetEvent CreateThread DeviceIoControl MultiByteToWideChar FindFirstFileW FindNextFileW FindClose FindFirstFileExW CreateHardLinkW WriteFile WaitForMultipleObjects OpenEventW DebugBreak CreateRemoteThread VerifyVersionInfoW VerSetConditionMask InitializeCriticalSectionEx DecodePointer DeleteCriticalSection GetLongPathNameW CopyFileW IsWow64Process GetNativeSystemInfo GetSystemInfo GetVersionExW SetLastError CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW GetLogicalDriveStringsW QueryDosDeviceW GetCurrentThread WideCharToMultiByte VirtualQueryEx FindResourceW SizeofResource LoadResource LockResource FlushFileBuffers GetFileSizeEx CreateDirectoryW GetFullPathNameW SetFileAttributesW GetFileInformationByHandleEx GetTickCount GlobalAlloc GlobalFree GetSystemFirmwareTable GetFileSize DuplicateHandle OpenThread SetThreadPriority GetCurrentThreadId SetFileInformationByHandle SetSearchPathMode ExpandEnvironmentStringsW GetFileAttributesExW GetDriveTypeW GetLogicalDrives GetFileAttributesW GetLocalTime GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation SetFileTime lstrcmpA GetStdHandle GetModuleHandleA GetSystemWindowsDirectoryW GetSystemTimeAsFileTime OutputDebugStringW GetCurrentDirectoryW CreateFileA FindResourceExW InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW Sleep CreateFileW CloseHandle GetLastError GetCurrentProcess RaiseException VirtualQuery LoadLibraryExA GetStringTypeW GetLocaleInfoEx AreFileApisANSI QueryPerformanceCounter LoadLibraryExW EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx HeapReAlloc SetStdHandle HeapSize IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

authz

AuthzFreeContext AuthzAccessCheck AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

82KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

628KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_444acd887c45007743c3548bbd86c4ab_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_magniber_njrat_satacom_sliver_stealc_vidar

kernel32

authz

generic