2026-07-03_918010a5f130a71685cad1fa4333a275_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar

General

Target
2026-07-03_918010a5f130a71685cad1fa4333a275_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar
Size 3.1MB
Sample260703-s92spact2v
SHA256 7eb5b59a0c63ac27eb57eea961b0c65273f39e18b33d63863d3c2c22100d0910
MD5 918010a5f130a71685cad1fa4333a275
SHA1 efd69607a8ee1f9c69defcfbc93eb996440bc834
SHA512 51bafd3ead6262caae8c01506ca09d952531a641175573283da5f32d332e9d461dad8686c69b8b5bc8a6653290e28551e8f06c4d0c8799d019cfe96625acd526
SSDEEP 49152:pJXDtoZerRokp8rOO53RTqtiZEp6056rrhOuqJtb2IRpYq:aYrRokKrOO53up6rrv06
TLSH
T110E5291DFEA48E31E077817589A2935DE9763C611F3086CB1284BA2DEE32FD19935723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_918010a5f130a71685cad1fa4333a275_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar

2026-07-03_918010a5f130a71685cad1fa4333a275_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar

.exe 3.1MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 7eb5b59a0c63ac27eb57eea961b0c65273f39e18b33d63863d3c2c22100d0910
MD5 918010a5f130a71685cad1fa4333a275
SHA1 efd69607a8ee1f9c69defcfbc93eb996440bc834
SHA512 51bafd3ead6262caae8c01506ca09d952531a641175573283da5f32d332e9d461dad8686c69b8b5bc8a6653290e28551e8f06c4d0c8799d019cfe96625acd526
SSDEEP 49152:pJXDtoZerRokp8rOO53RTqtiZEp6056rrhOuqJtb2IRpYq:aYrRokKrOO53up6rrv06
TLSH
T110E5291DFEA48E31E077817589A2935DE9763C611F3086CB1284BA2DEE32FD19935723
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths