2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar

General

Target
2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar
Size 3.4MB
Sample260708-18b5msay2x
SHA256 d75bf01c515a3955a2c67e75070c783f55f07889dfc0bf5344f9b723f0e437a5
MD5 8b321d4f2ee279f3209f36b87097b7b2
SHA1 28c4ef4d6516fd0e83b885464b790cab0968ebb1
SHA512 6ed98d9d83e98203f02f5c4ddeb3c83ae44c8fcb4c792c0d2182b02100d9fe0e201199036c672ef60195f2cb02b49f882660b0e7c95d655705b20393e32c99fc
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvJ:TIDQ/rwSR1t3x
TLSH
T1C1F55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar

File Explorer

2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar

.exe 3.4MB

2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar

IMPHASH ad4e7a75c87d00b0aef55f559d390c99
SHA256 d75bf01c515a3955a2c67e75070c783f55f07889dfc0bf5344f9b723f0e437a5
MD5 8b321d4f2ee279f3209f36b87097b7b2
SHA1 28c4ef4d6516fd0e83b885464b790cab0968ebb1
SHA512 6ed98d9d83e98203f02f5c4ddeb3c83ae44c8fcb4c792c0d2182b02100d9fe0e201199036c672ef60195f2cb02b49f882660b0e7c95d655705b20393e32c99fc
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvJ:TIDQ/rwSR1t3x
TLSH
T1C1F55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 ord518 __vbaStrCat __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct ord593 __vbaExitProc __vbaForEachCollObj ord594 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarTstLt _CIsin __vbaNextEachCollObj __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord529 __vbaPutOwner3 __vbaPutOwner4 __vbaI2I4 __vbaObjVar __vbaStrR4 _adj_fpatan ord567 EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord531 ord716 __vbaFPException __vbaStrVarVal __vbaVarCat _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 __vbaVarTstNe __vbaVarSetVar __vbaLateMemCall __vbaVarDup ord617 _CIatan __vbaStrMove __vbaCastObj ord619 _allmul _CItan __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj ord580

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_remcos_smoke-loader_stop_vidar

msvbvm60

generic