2026-08-05_532e60858bd9716da181e85f723da9d2_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar

General

Target
2026-08-05_532e60858bd9716da181e85f723da9d2_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar
Size 2.9MB
Sample260805-tghd1swtbv
SHA256 eca3cd2f0b83b670a09ca40e8a2b2fe8c13c80c33bed0e3a28abb9340e49a8ca
MD5 532e60858bd9716da181e85f723da9d2
SHA1 b510f0af63d55aed2e2fbc3e6b71f0e48fbc5a8e
SHA512 ed903c631c878aa37a8c7c69235e7a9260c95e434d9aeafca11036fac68d002498918586975c303ac96e5459236d73e4414352bd8f1c4d29173aa4affbf3dca6
SSDEEP 49152:/agnTVO4rOO53RTqtihhbuRKwpBu56rnqatglP56rjUOlk09:A4rOO53BHerjLrF9
TLSH
T139E56B12B7A48AA2D06F517489668756E6737C110F2097CF5254BF2E7E337C0AE36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_532e60858bd9716da181e85f723da9d2_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar

2026-08-05_532e60858bd9716da181e85f723da9d2_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar

.exe 2.9MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 eca3cd2f0b83b670a09ca40e8a2b2fe8c13c80c33bed0e3a28abb9340e49a8ca
MD5 532e60858bd9716da181e85f723da9d2
SHA1 b510f0af63d55aed2e2fbc3e6b71f0e48fbc5a8e
SHA512 ed903c631c878aa37a8c7c69235e7a9260c95e434d9aeafca11036fac68d002498918586975c303ac96e5459236d73e4414352bd8f1c4d29173aa4affbf3dca6
SSDEEP 49152:/agnTVO4rOO53RTqtihhbuRKwpBu56rnqatglP56rjUOlk09:A4rOO53BHerjLrF9
TLSH
T139E56B12B7A48AA2D06F517489668756E6737C110F2097CF5254BF2E7E337C0AE36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths