2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar

General

Target
2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar
Size 2.9MB
Sample260903-lxc58seq2z
SHA256 648b32bd55bb392067cd43c86969af7d32d6c1f6b45f25c6b567ecc4adced72b
MD5 72b2b0d36f2af4887789c791ff8c9e1c
SHA1 c93e857a8ef3bef1f2c37cd27971bef93dcefb9c
SHA512 efab7ef56fbf725668f204cbe2173989e7250cf2a79ecba2268e01cc3042166d1eefa63a758241abe8e0c2073c0ae7e37858dbbea8c6be82ceaf3608fb6a2b41
SSDEEP 49152:/nT9v9Ms/4MnYYJ2ZhqSGLHkJEMqM84pgjpYq9W1PszNsQYxGUU7:B9+IDQzfgj6yW1Psz1
TLSH
T1BEE58D12B7A04A71E1B7903589A2A265EA777D110F30C7CF13949E6E3F336D19A39327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar

File Explorer

2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar

.exe 2.9MB

2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar

SHA256 648b32bd55bb392067cd43c86969af7d32d6c1f6b45f25c6b567ecc4adced72b
MD5 72b2b0d36f2af4887789c791ff8c9e1c
SHA1 c93e857a8ef3bef1f2c37cd27971bef93dcefb9c
SHA512 efab7ef56fbf725668f204cbe2173989e7250cf2a79ecba2268e01cc3042166d1eefa63a758241abe8e0c2073c0ae7e37858dbbea8c6be82ceaf3608fb6a2b41
SSDEEP 49152:/nT9v9Ms/4MnYYJ2ZhqSGLHkJEMqM84pgjpYq9W1PszNsQYxGUU7:B9+IDQzfgj6yW1Psz1
TLSH
T1BEE58D12B7A04A71E1B7903589A2A265EA777D110F30C7CF13949E6E3F336D19A39327
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

117416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_72b2b0d36f2af4887789c791ff8c9e1c_amadey_cobalt-strike_darkgate_glassworm_hijackloader_rhadamanthys_satacom_stop_vidar

generic