2026-08-06_dc529e568520500e9c68789407eaf92b_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar

General

Target
2026-08-06_dc529e568520500e9c68789407eaf92b_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar
Size 2.7MB
Sample260806-r796lstdkh
SHA256 21aea5a02c190c5c9f44678d8aaada2bc3fce26a2f6b8960615a774851131917
MD5 dc529e568520500e9c68789407eaf92b
SHA1 6d070d7c76f7da6ed9a9dc052f2454f63cc12d20
SHA512 742c7aa278ef22ec6ffa5f179d68f1633d4a6decbe5c60672a1385b8f4f376b0e95e09a9cbcef3f9bb05b66f3f2f24b7c78ae2bd78375d6d7efd9ad201606366
SSDEEP 49152:ggnThXqatgltKzq+9zX1opwBDx00ZImDP56rtTeX:rdlErtTQ
TLSH
T154D5F546A65446B1D0AB81748952861EE6727C15CF238FCB1290AEEEFFF36C05E35732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_dc529e568520500e9c68789407eaf92b_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar

2026-08-06_dc529e568520500e9c68789407eaf92b_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar

.exe 2.7MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 21aea5a02c190c5c9f44678d8aaada2bc3fce26a2f6b8960615a774851131917
MD5 dc529e568520500e9c68789407eaf92b
SHA1 6d070d7c76f7da6ed9a9dc052f2454f63cc12d20
SHA512 742c7aa278ef22ec6ffa5f179d68f1633d4a6decbe5c60672a1385b8f4f376b0e95e09a9cbcef3f9bb05b66f3f2f24b7c78ae2bd78375d6d7efd9ad201606366
SSDEEP 49152:ggnThXqatgltKzq+9zX1opwBDx00ZImDP56rtTeX:rdlErtTQ
TLSH
T154D5F546A65446B1D0AB81748952861EE6727C15CF238FCB1290AEEEFFF36C05E35732
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths