2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar
Size 1.8MB
Sample260727-pdgwvs1fpg
SHA256 7622513feb09d50c68a8682911b3134ee8d025f2170e4423300cdeff92f20159
MD5 69d95412e64652186f3b723bdec010f4
SHA1 ca16edc45a7c351cd4822be5ae0e016a8dd0311f
SHA512 c96687f915019bc21e501259393fa331ec496a1b02643d2174218a0c5357b106fb289bc8e77ff4f75916b2d9b584a5be2c9841fcbd154607bb9f65aa5aa15e9a
SSDEEP 24576:LrxL/5jcAkSYqyEeAhYJ0Le5ji0hmxNrM05jcAkSYqyEej:/xRpYq+PPji0AjvpYqY
TLSH
T1F695F715F6648671D073C0B9C5D2A68EEA31304587328ECB12859FECBFE76E68936731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar

File Explorer

2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar

.exe 1.8MB

2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar

IMPHASH 7becb1f69fa89755329ee7563f2c3c02
SHA256 7622513feb09d50c68a8682911b3134ee8d025f2170e4423300cdeff92f20159
MD5 69d95412e64652186f3b723bdec010f4
SHA1 ca16edc45a7c351cd4822be5ae0e016a8dd0311f
SHA512 c96687f915019bc21e501259393fa331ec496a1b02643d2174218a0c5357b106fb289bc8e77ff4f75916b2d9b584a5be2c9841fcbd154607bb9f65aa5aa15e9a
SSDEEP 24576:LrxL/5jcAkSYqyEeAhYJ0Le5ji0hmxNrM05jcAkSYqyEej:/xRpYq+PPji0AjvpYqY
TLSH
T1F695F715F6648671D073C0B9C5D2A68EEA31304587328ECB12859FECBFE76E68936731
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ce:80:c6:90:e8:eb:7a:91:06:a0:f9:63:fa:e1:40:57:95:65:74:ac

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

Major OS version

Entry point

56156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\misc_hev\x-none\msohtmed.pdb

kernel32

GetUserDefaultLangID GetCommandLineW ReleaseMutex ExitProcess CreateFileW CreateMutexW CreateProcessW CreateFileMappingW GetModuleHandleW GetProcAddress LoadLibraryExA GetLastError GetFileAttributesW GlobalFree GlobalAlloc DebugBreak ExpandEnvironmentStringsW GetACP MultiByteToWideChar CloseHandle SetFilePointer GetModuleFileNameW ReadFile FreeLibrary VirtualQuery IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW HeapFree HeapAlloc RaiseException WerRegisterMemoryBlock VirtualProtect GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW GetCurrentProcessId HeapSetInformation GetProcessHeap QueryPerformanceCounter IsDebuggerPresent InitializeSListHead

advapi32

DeregisterEventSource ReportEventW RegSetValueExW RegQueryValueExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegisterEventSourceW

ole32

CoFileTimeNow CoUninitialize StgOpenStorage CoInitialize CoCreateInstance

vcruntime140

__C_specific_handler __telemetry_main_invoke_trigger __telemetry_main_return_trigger __vcrt_InitializeCriticalSectionEx memset

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _exit _register_thread_local_exe_atexit_callback _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _initialize_onexit_table _initterm_e _register_onexit_function _crt_atexit terminate exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_69d95412e64652186f3b723bdec010f4_amadey_cobalt-strike_glassworm_hijackloader_icedid_mespinoza_ryuk_satacom_vidar

PE Signature issue

kernel32

advapi32

ole32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic