Overview

overview

8

Static

static

8

2026-09-29...rm.exe

windows10-2004-x64

1

2026-09-29...rm.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-29_bd64b0bd5ebeb6da3b327f41cfdec868_akira_amadey_cobalt-strike_elex_glassworm
  • Size 213KB
  • Sample260929-v428dastfv
  • SHA256 4c843843ab2e7eeea471f8905f975ed0fa03f808fc64e66323361573867e02e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
revoked_codesign

Malware Config

Signatures

  • Revoked Certificate in Chain 1 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

    revoked_codesign
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 2026-09-29_bd64b0bd5ebeb6da3b327f41cfdec868_akira_amadey_cobalt-strike_elex_glassworm
    .exe 213KB

2026-09-29_bd64b0bd5ebeb6da3b327f41cfdec868_akira_amadey_cobalt-strike_elex_glassworm

  • IMPHASH 18e9b63c2ca39c0d3ceaf6657efe5a9c
  • SHA256 4c843843ab2e7eeea471f8905f975ed0fa03f808fc64e66323361573867e02e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx86arch:x86

  • Revoked Certificate in Chain

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

    revoked_codesign

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
42:86:ce:ea:d2:4b:c2:0b:17:29:e6:89:3f:6e:ab:6a:9f:c6:41:99:c4:70:33:09:ef:9e:e4:bd:00:21:5d:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=92371323MAKJLYRF26,CN=Xidao E-commerce Studio\, Yishui County,O=Xidao E-commerce Studio\, Yishui County,L=临沂市,ST=山东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b8b4e6b282e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#130f427573696e65737320456e74697479
Minor OS version
0
Major OS version
6
Entry point
67578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths
ev_loader.pdb