2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar

General

Target
2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar
Size 2.7MB
Sample260511-rf77yaft7p
SHA256 8a325196d171fae10bb2b20ffd1ab1df6e7640154c2c5066b67409093170a70b
MD5 da82e5e647b358b9a021e126f741bbad
SHA1 b53fc2cf7439eabd9fb9fdb9cf5564aa02d5fb16
SHA512 f678698329c3e268a6e01e6b9c9a1d640228a231981de956cf18c0aa00a0682b698a6f3571729c7abd9fe5c19e375d9f6d491ccf92ed9f1b7c021e6383e011e0
SSDEEP 49152:HUv3dC55Ctljzc9IW1dXgfC/MHmgI56rVK:HXec9IW1dXgfC/MHmgFrVK
TLSH
T1AFD508C3E6D38517F1AA15704E618A1075737FD04E2676BBE2563E4EE73E2C2A92C312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar

File Explorer

2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar

.exe 2.7MB

2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar

SHA256 8a325196d171fae10bb2b20ffd1ab1df6e7640154c2c5066b67409093170a70b
MD5 da82e5e647b358b9a021e126f741bbad
SHA1 b53fc2cf7439eabd9fb9fdb9cf5564aa02d5fb16
SHA512 f678698329c3e268a6e01e6b9c9a1d640228a231981de956cf18c0aa00a0682b698a6f3571729c7abd9fe5c19e375d9f6d491ccf92ed9f1b7c021e6383e011e0
SSDEEP 49152:HUv3dC55Ctljzc9IW1dXgfC/MHmgI56rVK:HXec9IW1dXgfC/MHmgFrVK
TLSH
T1AFD508C3E6D38517F1AA15704E618A1075737FD04E2676BBE2563E4EE73E2C2A92C312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

154177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\vpreview.pdb

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_da82e5e647b358b9a021e126f741bbad_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_mespinoza_smoke-loader_vidar

generic