2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry

General

Target
2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
Size 4.8MB
Sample260416-sdnwyscv3p
SHA256 83e1522d2625b440f768f3e7c6326d8cf92b26a4f399d3b84356d5f4da6c3d02
MD5 52790d4f038749b0c7f33bf3fa43383c
SHA1 4ac7d417a4a87d7c86c58b1bb003d1a6268d16d5
SHA512 b6f89b5e07eb7a55ad758dbf6b7fc979f0036a1a216e11ea9b9d30d057d551e11461a0babb63fd7120c098110aa48aede44a3e7c7feded37528dacf9db86d347
SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqL:7ID41qM5ram6m5h6N
TLSH
T1F8364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry

File Explorer

2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry

.exe 4.8MB

2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry

IMPHASH ad4e7a75c87d00b0aef55f559d390c99
SHA256 83e1522d2625b440f768f3e7c6326d8cf92b26a4f399d3b84356d5f4da6c3d02
MD5 52790d4f038749b0c7f33bf3fa43383c
SHA1 4ac7d417a4a87d7c86c58b1bb003d1a6268d16d5
SHA512 b6f89b5e07eb7a55ad758dbf6b7fc979f0036a1a216e11ea9b9d30d057d551e11461a0babb63fd7120c098110aa48aede44a3e7c7feded37528dacf9db86d347
SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqL:7ID41qM5ram6m5h6N
TLSH
T1F8364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 ord518 __vbaStrCat __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct ord593 __vbaExitProc __vbaForEachCollObj ord594 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarTstLt _CIsin __vbaNextEachCollObj __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord529 __vbaPutOwner3 __vbaPutOwner4 __vbaI2I4 __vbaObjVar __vbaStrR4 _adj_fpatan ord567 EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord531 ord716 __vbaFPException __vbaStrVarVal __vbaVarCat _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 __vbaVarTstNe __vbaVarSetVar __vbaLateMemCall __vbaVarDup ord617 _CIatan __vbaStrMove __vbaCastObj ord619 _allmul _CItan __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj ord580

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry

msvbvm60

generic