2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar

General

Target
2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar
Size 3.1MB
Sample260522-rxea7ad14p
SHA256 630b5863ef85388ee04b8d02cf853f0051826aa17ff9b72987ebeea591ef6ea9
MD5 53a11d03118ba8f68b3fcbaf6a82ea50
SHA1 efed00cb3747b8e0c11ff0be29ca3c1b5bd40ebc
SHA512 302e9cfdbf258a8d09a2dea3958fc341556c3eff8e6d90b0f2d50b15987f44998bab408922efcace9a0c1b83468de5d6765aae21c7fbecfdf94a9db939eb20fe
SSDEEP 49152:F0g7mM+M6RkMkIM7I0678mUi6AjW/MUSdGRf3/HrOO53RTqtiyeW4SkZP4sz9MbL:kM+M6RkMkIM7ajxAZHrOO53KfkZcv
TLSH
T1FBE56D11F6B48172D0B29174C993A65DE631BC058B228ECF2248AF9D7FB36C1E936735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar

File Explorer

2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar

.exe 3.1MB

2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar

IMPHASH 440bc139f19edeac18ebed46859ccfed
SHA256 630b5863ef85388ee04b8d02cf853f0051826aa17ff9b72987ebeea591ef6ea9
MD5 53a11d03118ba8f68b3fcbaf6a82ea50
SHA1 efed00cb3747b8e0c11ff0be29ca3c1b5bd40ebc
SHA512 302e9cfdbf258a8d09a2dea3958fc341556c3eff8e6d90b0f2d50b15987f44998bab408922efcace9a0c1b83468de5d6765aae21c7fbecfdf94a9db939eb20fe
SSDEEP 49152:F0g7mM+M6RkMkIM7I0678mUi6AjW/MUSdGRf3/HrOO53RTqtiyeW4SkZP4sz9MbL:kM+M6RkMkIM7ajxAZHrOO53KfkZcv
TLSH
T1FBE56D11F6B48172D0B29174C993A65DE631BC058B228ECF2248AF9D7FB36C1E936735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_atg\Plugins\Updater\acroaum\win\Release\acroaum.pdb

kernel32

LoadLibraryW GetProcAddress MultiByteToWideChar WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA GetLastError GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP LoadLibraryA InitializeCriticalSection GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW ReadFile SetFilePointer SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

MessageBoxA

advapi32

RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_53a11d03118ba8f68b3fcbaf6a82ea50_amadey_cobalt-strike_elex_hijackloader_icedid_manuscrypt_rhadamanthys_stop_vidar

kernel32

user32

advapi32

generic