2026-08-27_ebabb11ffabf4b83e64130166f93a95b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader_vidar

General

Target
2026-08-27_ebabb11ffabf4b83e64130166f93a95b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader_vidar
Size 1.8MB
Sample260828-df4ymabf67
SHA256 1025168e6607a14b2bdc21defda29f71adfebb5637c4abb86d44b81ec8448f0e
MD5 ebabb11ffabf4b83e64130166f93a95b
SHA1 fd6419f50f2f70921e0cc68614fde3bf52b81b3c
SHA512 b8d5523e1ac14fb7f27f6c2da1a6c3f21bc0b67b26d27bb1812a3a058a65232fe2ca6b7e6400535fdf6a7af775bf60ae3fadc4ffa8ce9a109e518f71bd7cd7d5
SSDEEP 24576:fHg3nFoAAGaewsAjuMbAwew/rz05jcAkSYqyE:/FljNvSpYq
TLSH
T104955C21F6B4C036D0B38AB589A6C7A6E9357D511F209ACB63C47B5D2F327C28935336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_ebabb11ffabf4b83e64130166f93a95b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader_vidar

2026-08-27_ebabb11ffabf4b83e64130166f93a95b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader_vidar

.exe 1.8MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 1025168e6607a14b2bdc21defda29f71adfebb5637c4abb86d44b81ec8448f0e
MD5 ebabb11ffabf4b83e64130166f93a95b
SHA1 fd6419f50f2f70921e0cc68614fde3bf52b81b3c
SHA512 b8d5523e1ac14fb7f27f6c2da1a6c3f21bc0b67b26d27bb1812a3a058a65232fe2ca6b7e6400535fdf6a7af775bf60ae3fadc4ffa8ce9a109e518f71bd7cd7d5
SSDEEP 24576:fHg3nFoAAGaewsAjuMbAwew/rz05jcAkSYqyE:/FljNvSpYq
TLSH
T104955C21F6B4C036D0B38AB589A6C7A6E9357D511F209ACB63C47B5D2F327C28935336
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths