2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry
Size 1.2MB
Sample260727-r4v8aavyft
SHA256 70c16b4dd7ce4a3e57cd703139f8fbd66749a3eefd9e5800f189a7df6a508eda
MD5 4261f38b237c3a71e4d65ecdaaf04aef
SHA1 d1551c80ed79ef296ab745d14b79118f0c725e98
SHA512 d204d218da2cea908f630d427fa32e144a74d4f2a8383395ddf4c2175c3fb45ff5a12af7c3dae0002f1cdd142d5a5a61ad56e9ba06dbcc4b4da29b67eeb4086b
SSDEEP 24576:TQToqqfvoTsAhYujYTqMi8CtBd2QHCHmTBW59:TOQfJdqJtb2I0
TLSH
T1B445F615B6A486B1D0628074C992A65DEA313C81CB238ECB1285BFEDFFF36D19935731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry

File Explorer

2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry

.exe 1.2MB

2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry

IMPHASH 354b502a18753a5396ed0bdf24e61923
SHA256 70c16b4dd7ce4a3e57cd703139f8fbd66749a3eefd9e5800f189a7df6a508eda
MD5 4261f38b237c3a71e4d65ecdaaf04aef
SHA1 d1551c80ed79ef296ab745d14b79118f0c725e98
SHA512 d204d218da2cea908f630d427fa32e144a74d4f2a8383395ddf4c2175c3fb45ff5a12af7c3dae0002f1cdd142d5a5a61ad56e9ba06dbcc4b4da29b67eeb4086b
SSDEEP 24576:TQToqqfvoTsAhYujYTqMi8CtBd2QHCHmTBW59:TOQfJdqJtb2I0
TLSH
T1B445F615B6A486B1D0628074C992A65DEA313C81CB238ECB1285BFEDFFF36D19935731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\oneaddins\x-none\iecontentservice.pdb

vcruntime140

__std_exception_copy __std_exception_destroy __telemetry_main_invoke_trigger __telemetry_main_return_trigger __C_specific_handler __vcrt_InitializeCriticalSectionEx memset memmove wcschr wcsrchr memcpy memcmp __std_terminate __CxxFrameHandler3 _CxxThrowException wcsstr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _configure_narrow_argv _initterm _invalid_parameter_noinfo _initialize_narrow_environment _initterm_e exit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _exit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit _get_narrow_winmain_command_line

api-ms-win-crt-string-l1-1-0

strncpy_s _wcsicmp wcscpy_s isdigit wcscmp wcsncpy_s

api-ms-win-crt-heap-l1-1-0

realloc free _recalloc malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf_s __stdio_common_vsnprintf_s __stdio_common_vswprintf _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

kernel32

EncodePointer LoadLibraryExA VirtualQuery GetSystemInfo LCIDToLocaleName GetLongPathNameW GetUserDefaultLocaleName IsValidCodePage GetShortPathNameA GetModuleFileNameA WideCharToMultiByte OutputDebugStringW GetCommandLineW DecodePointer CloseHandle RaiseException GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection Sleep OpenProcess CreateFileMappingW OpenFileMappingW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW GlobalFree lstrcmpiW MultiByteToWideChar QueryPerformanceCounter GetProcessHeap HeapSetInformation GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount VirtualProtect WerRegisterMemoryBlock HeapAlloc HeapFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW FlsAlloc FlsFree GetStringTypeExW SetLastError CompareStringEx

gdiplus

GdipCreateBitmapFromHBITMAP GdipGetImageThumbnail GdipGetImageEncodersSize GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetImageEncoders

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep _Xtime_get_ticks ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

Name

.text

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_4261f38b237c3a71e4d65ecdaaf04aef_amadey_cobalt-strike_hijackloader_icedid_mespinoza_ryuk_satacom_stealc_vidar_wannacry

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

gdiplus

msvcp140

generic