2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar

General

Target
2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar
Size 2.2MB
Sample260419-sd17aadv4k
SHA256 e0bb9e75fae2f549fe3fa41d2a632083f1d893d7494bd6c5f0d856762b0ffaa7
MD5 9e0f3b432567f25aea19110516fada85
SHA1 582e9f297f4047a25d6ec4319a0c29ee660fd4c5
SHA512 feb6de08f2957ee065a357c39668a0d356460b0b060f832caf81aab4ae02cc59bf4a81baf0c61282ae46c4b0dfef35181c105ed731494b9356c9ac7a0422c35e
SSDEEP 24576:uWvWL0vbxSIa5jcAkSYqyEid4Kplkxf1IP+:hA0vb7ApYqCXp7m
TLSH
T1EAB58C12F6A48535E0B38175C9D3A796EA3278110B708BCB1385A27D2F73BD2AD35772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar

File Explorer

2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar

.exe 2.2MB

2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar

IMPHASH 75e7fb7458b2e2dd8c3b4d1f0020fc10
SHA256 e0bb9e75fae2f549fe3fa41d2a632083f1d893d7494bd6c5f0d856762b0ffaa7
MD5 9e0f3b432567f25aea19110516fada85
SHA1 582e9f297f4047a25d6ec4319a0c29ee660fd4c5
SHA512 feb6de08f2957ee065a357c39668a0d356460b0b060f832caf81aab4ae02cc59bf4a81baf0c61282ae46c4b0dfef35181c105ed731494b9356c9ac7a0422c35e
SSDEEP 24576:uWvWL0vbxSIa5jcAkSYqyEid4Kplkxf1IP+:hA0vb7ApYqCXp7m
TLSH
T1EAB58C12F6A48535E0B38175C9D3A796EA3278110B708BCB1385A27D2F73BD2AD35772
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9451

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb

kernel32

GetEnvironmentVariableW GetProcessIoCounters FreeLibrary SetDllDirectoryW VerSetConditionMask GetCurrentProcess SetEnvironmentVariableW GetModuleHandleW WideCharToMultiByte LoadLibraryW GetFileAttributesW VerifyVersionInfoA GetModuleFileNameW MultiByteToWideChar FlushInstructionCache GetProcAddress VirtualProtectEx VirtualAllocEx GetModuleHandleA LoadLibraryExA ExpandEnvironmentStringsW LoadLibraryExW SetFilePointerEx ReadFile CreateFileW CloseHandle IsDebuggerPresent RaiseException GetLastError GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapSize RtlUnwind HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree HeapAlloc SetStdHandle OutputDebugStringW GetStringTypeW CompareStringW LCMapStringW GetConsoleCP GetConsoleMode HeapReAlloc SetEnvironmentVariableA ReadConsoleW FlushFileBuffers WriteConsoleW SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-19_9e0f3b432567f25aea19110516fada85_amadey_cobalt-strike_elex_hijackloader_maze_rhadamanthys_smoke-loader_vidar

kernel32

generic