2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar

General

Target
2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar
Size 2.4MB
Sample260808-c8bxwabc63
SHA256 214adb2341ac2ef026132935156cc3419d8ae3489eba398130ea17475d4baa94
MD5 c9b80b754b19bece2cf9e204771e75ae
SHA1 f4a423c08c48b8ab5511ad46dc25fde02a7d57eb
SHA512 3590961562d051d0a8a3b39705b4505a8cad5745092010f0e828a79cc67e2fd52a8fa90ae72a2c1df898dc2e351eaab90e1f516121a82a10c3c7407311fae00a
SSDEEP 24576:MAhYA5d4Kplk45jcAkSYqyEqT5jcAkSYqyEoD5TvinrmrkExqatgl8bP:Mi5XpppYq2pYq+56ruqatglE
TLSH
T111B5E501F6548A71D06B8175C692569AFA3338018F628FCB12C4EEBCBFA36D19975733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar

File Explorer

2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar

.exe 2.4MB

2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar

IMPHASH 8df305cbfddc966a7b6ab459d5570a2d
SHA256 214adb2341ac2ef026132935156cc3419d8ae3489eba398130ea17475d4baa94
MD5 c9b80b754b19bece2cf9e204771e75ae
SHA1 f4a423c08c48b8ab5511ad46dc25fde02a7d57eb
SHA512 3590961562d051d0a8a3b39705b4505a8cad5745092010f0e828a79cc67e2fd52a8fa90ae72a2c1df898dc2e351eaab90e1f516121a82a10c3c7407311fae00a
SSDEEP 24576:MAhYA5d4Kplk45jcAkSYqyEqT5jcAkSYqyEoD5TvinrmrkExqatgl8bP:Mi5XpppYq2pYq+56ruqatglE
TLSH
T111B5E501F6548A71D06B8175C692569AFA3338018F628FCB12C4EEBCBFA36D19975733
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

6520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x64\ship\setupexe\x-none\setup.pdb

kernel32

GetLastError SetLastError GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryW OutputDebugStringA VerifyVersionInfoW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW FormatMessageW VerSetConditionMask QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwindEx RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetACP HeapFree HeapAlloc HeapReAlloc GetProcessHeap CloseHandle FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_c9b80b754b19bece2cf9e204771e75ae_amadey_cobalt-strike_glassworm_hijackloader_icedid_vidar

kernel32

generic