2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar

General

Target
2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar
Size 3.4MB
Sample260509-bnq1mahs21
SHA256 e24cc7e3603b4fe75bc3b44e9dc7018781c934f8f52f173b306513172173793a
MD5 94154dce528bad4318241d9b64ca96ba
SHA1 716f21e884fbf1bf65ac2925b8907d955ff4cab0
SHA512 1999bca6ffe45a2bd9d95414584b0d98b256789570637869e9e0d224ce9b6c77b06013b3d086ef457c8b5d3d2ec8cd0bd0d04ac3d9343b2c4a5d98fd5f06e64f
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/Q:urRokqOgmhv7Sti9
TLSH
T1CFF53B212AF08439E57796705A79E69D91267C60DB7289CF23D13EAEFBF06D04931332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar

File Explorer

2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar

.exe 3.4MB

2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar

IMPHASH 4b28658f0faec3fceb2d96685cc1842a
SHA256 e24cc7e3603b4fe75bc3b44e9dc7018781c934f8f52f173b306513172173793a
MD5 94154dce528bad4318241d9b64ca96ba
SHA1 716f21e884fbf1bf65ac2925b8907d955ff4cab0
SHA512 1999bca6ffe45a2bd9d95414584b0d98b256789570637869e9e0d224ce9b6c77b06013b3d086ef457c8b5d3d2ec8cd0bd0d04ac3d9343b2c4a5d98fd5f06e64f
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/Q:urRokqOgmhv7Sti9
TLSH
T1CFF53B212AF08439E57796705A79E69D91267C60DB7289CF23D13EAEFBF06D04931332
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

13648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\jabswitch\jabswitch.pdb

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

wsprintfW

msvcr100

strcpy_s vsprintf_s _CRT_RTC_INITW _amsg_exit __getmainargs __C_specific_handler _XcptFilter _exit _cexit exit strcat_s _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type __crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit wcscpy_s wcstok_s wcscat_s wcsstr _wcslwr_s wcslen ??2@YAPEAX_K@Z _dupenv_s printf perror free fopen_s fprintf fclose remove _errno rename strstr feof fgets _stricmp fputs strtok_s memset __initenv

kernel32

VirtualQuery GetProcessHeap HeapAlloc HeapFree FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter DecodePointer LoadLibraryW GetProcAddress lstrlenA MultiByteToWideChar WideCharToMultiByte RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess EncodePointer Sleep GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GetVersionExW

Name

.text

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

972B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

410B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-08_94154dce528bad4318241d9b64ca96ba_amadey_cobalt-strike_darkgate_glassworm_hijackloader_satacom_smoke-loader_stop_vidar

advapi32

version

user32

msvcr100

kernel32

generic