2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

General

Target
2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar
Size 2.2MB
Sample260522-ter6faa17x
SHA256 16145b54e244cbb88cca015c1afc81dbd2ea7384190e166b254f53fc9b1a7182
MD5 21b2ec5e39c1d36e89d85b8fcfaf87a3
SHA1 215bf61c588910cc23134114717907242e5261c5
SHA512 9a99a5e416aa6c2d37d82da00c06dc2a24804af094bf7a6c6d354954d6aec3325e1db73a965da12261429d2e54f0162527aaf122d232e20bd0bd73824cce4598
SSDEEP 49152:O35DMnCIjtAysZqhaK6zbfqdlzqJtb2IrIAOj:B55axSH
TLSH
T1AAB52A21B6B443E9D473A179C5A39666E671BC015B30E6CF2248BB1D2E33ED1D93B321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

File Explorer

2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

.exe 2.2MB

2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

SHA256 16145b54e244cbb88cca015c1afc81dbd2ea7384190e166b254f53fc9b1a7182
MD5 21b2ec5e39c1d36e89d85b8fcfaf87a3
SHA1 215bf61c588910cc23134114717907242e5261c5
SHA512 9a99a5e416aa6c2d37d82da00c06dc2a24804af094bf7a6c6d354954d6aec3325e1db73a965da12261429d2e54f0162527aaf122d232e20bd0bd73824cce4598
SSDEEP 49152:O35DMnCIjtAysZqhaK6zbfqdlzqJtb2IrIAOj:B55axSH
TLSH
T1AAB52A21B6B443E9D473A179C5A39666E671BC015B30E6CF2248BB1D2E33ED1D93B321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

177464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\clview.pdb

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_21b2ec5e39c1d36e89d85b8fcfaf87a3_amadey_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

generic