2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry
Size 4.2MB
Sample261009-vtq3csda79
SHA256 96438e58b5026fff8d7f740c1ceff22bc30201020d3c1115b68b76713d6d4acc
MD5 36d6fa8610aaab722f798e2fe0de1796
SHA1 a8e08c6be3f43db6b634a15cc07bfed4b72a7c01
SHA512 5862ba058ac4ebfa6e7ae0198121fb09fde0c85b910afa53b9a2f5c6aed5c739142f0cdf3a658fdb6d133e281acdfb7d47a6cf0a012768ad57a550b23b60cebb
SSDEEP 49152:EBqatglweW4SkZP4sz9MbNy6i1zuajsauZjahUqatglP56rIeW4SkZP4sz9Mb8pr:wLfkZcNtOqLr0fkZc86
TLSH
T1A5162915B6B88762E0B3C179C9E7A696FA3238451F3086CF1245973C2E337D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

File Explorer

2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

.exe 4.2MB

2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

IMPHASH fb6d984e582ac651e9cf6b1e1235d867
SHA256 96438e58b5026fff8d7f740c1ceff22bc30201020d3c1115b68b76713d6d4acc
MD5 36d6fa8610aaab722f798e2fe0de1796
SHA1 a8e08c6be3f43db6b634a15cc07bfed4b72a7c01
SHA512 5862ba058ac4ebfa6e7ae0198121fb09fde0c85b910afa53b9a2f5c6aed5c739142f0cdf3a658fdb6d133e281acdfb7d47a6cf0a012768ad57a550b23b60cebb
SSDEEP 49152:EBqatglweW4SkZP4sz9MbNy6i1zuajsauZjahUqatglP56rIeW4SkZP4sz9Mb8pr:wLfkZcNtOqLr0fkZc86
TLSH
T1A5162915B6B88762E0B3C179C9E7A696FA3238451F3086CF1245973C2E337D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e7:a4:87:da:62:df:ed:95:4b:83:a7:45:55:7b:62:62:c9:22:83:33:97:fb:62:49:23:70:18:be:df:0d:5b:66

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 7, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

28928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\TextExtractor.pdb

query

LoadIFilter

kernel32

GetLongPathNameW SetErrorMode GetCurrentProcess GetModuleHandleA GetProcAddress LocalFree VerSetConditionMask CloseHandle GetCommandLineW ResetEvent OpenEventW WaitForMultipleObjects OpenProcess OpenFileMappingW MapViewOfFile UnmapViewOfFile VerifyVersionInfoW GetSystemTimeAsFileTime GetTickCount MultiByteToWideChar SetEvent GetLastError WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

CommandLineToArgvW

ole32

CoInitialize CoUninitialize

oleaut32

VariantClear SysAllocString SysFreeString SysStringLen

shlwapi

PathFindExtensionW PathFileExistsW PathAddBackslashW PathIsDirectoryW PathIsRelativeW

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_terminate memcpy __current_exception_context __current_exception __C_specific_handler memset memmove _CxxThrowException __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_c_exit _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback terminate _exit exit _initterm_e _initterm _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s _wfullpath _fullpath

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscpy_s wcslen _wcslwr _wcsnicmp

api-ms-win-crt-multibyte-l1-1-0

_mbslwr _mbschr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswscanf __p__commode

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_36d6fa8610aaab722f798e2fe0de1796_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

PE Signature issue

query

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic