2026-05-11_4530c7c9f68276146d1ee4619e810eca_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar

General

Target
2026-05-11_4530c7c9f68276146d1ee4619e810eca_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar
Size 3.2MB
Sample260511-qg418sax21
SHA256 afa79f0f5fd0796cdbaa5fbb5a7bb75a6ed6e6dd698ddbd33a547ee914e748f3
MD5 4530c7c9f68276146d1ee4619e810eca
SHA1 53c9ba393742c979e31d6409f0ae16f36354d3e2
SHA512 d444f41515bc50a5300b40449141b90e75eef562838c9b31b4c4f9af555755f863d6b947a77d20ec3992d234d258757d28478ce2cf747a456acdb579334aa1dc
SSDEEP 49152:BCL2c8MNFLA0vb7w56rn9TI956rOa56r5qJtb2I:YqcxAO1rnBrOXr5
TLSH
T144F50611E2944FB5D06F8074C6925659F6337C118FA28FCB1280AEBD7FB26C199B6633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_4530c7c9f68276146d1ee4619e810eca_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar

2026-05-11_4530c7c9f68276146d1ee4619e810eca_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar

.exe 3.2MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 afa79f0f5fd0796cdbaa5fbb5a7bb75a6ed6e6dd698ddbd33a547ee914e748f3
MD5 4530c7c9f68276146d1ee4619e810eca
SHA1 53c9ba393742c979e31d6409f0ae16f36354d3e2
SHA512 d444f41515bc50a5300b40449141b90e75eef562838c9b31b4c4f9af555755f863d6b947a77d20ec3992d234d258757d28478ce2cf747a456acdb579334aa1dc
SSDEEP 49152:BCL2c8MNFLA0vb7w56rn9TI956rOa56r5qJtb2I:YqcxAO1rnBrOXr5
TLSH
T144F50611E2944FB5D06F8074C6925659F6337C118FA28FCB1280AEBD7FB26C199B6633
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths