2026-07-02_f7988e8d1d1f3937a0a30e926b14ed1f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

General

Target
2026-07-02_f7988e8d1d1f3937a0a30e926b14ed1f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
Size 1.4MB
Sample260702-msad8aew3k
SHA256 de6c0a4dc071d7cacaf5739be49f6af03dda712021575beb0129ac71303ca1d2
MD5 f7988e8d1d1f3937a0a30e926b14ed1f
SHA1 0650e17c53c053d4c699e89fda3e18a51e1cb471
SHA512 d0b5eb502dba84c3322428aa542d2a7141c5a582b01e5233038fa5b3683b89bd8ae5636d31b1fb5441c63304e9c69289c6928f991d31ac2d8eb829a88c9ce0c4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79liTWaLl3z0zDQ0Le5ji0hmxNrM:WqFgqFUHaT1LljdPji0Aj
TLSH
T166656C16F2A046B8D073C075C9E29776EA71785207309BDF1395E7392F23BE19A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_f7988e8d1d1f3937a0a30e926b14ed1f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

2026-07-02_f7988e8d1d1f3937a0a30e926b14ed1f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

.exe 1.4MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 de6c0a4dc071d7cacaf5739be49f6af03dda712021575beb0129ac71303ca1d2
MD5 f7988e8d1d1f3937a0a30e926b14ed1f
SHA1 0650e17c53c053d4c699e89fda3e18a51e1cb471
SHA512 d0b5eb502dba84c3322428aa542d2a7141c5a582b01e5233038fa5b3683b89bd8ae5636d31b1fb5441c63304e9c69289c6928f991d31ac2d8eb829a88c9ce0c4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79liTWaLl3z0zDQ0Le5ji0hmxNrM:WqFgqFUHaT1LljdPji0Aj
TLSH
T166656C16F2A046B8D073C075C9E29776EA71785207309BDF1395E7392F23BE19A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths