2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm
Size 476KB
Sample261024-satm2avvhy
SHA256 d452397a387705fca9b3850a92ba01c14adaaaed5208fb1d63b85ffd351ab448
MD5 4467134e57a2ba647a18ae51fc5889e7
SHA1 44810f2976f5041631ef9a5cd15aa29f3744c1a1
SHA512 f8754ccca61a957baa082dcf196b4891de9f3dae3091df42107ca35301d0800110087445c2e97ab49b6358b5af624fefe680c848d0c026478d876ae237dbb5e9
SSDEEP 12288:hB+B+MRMIheYyDi5eNiQ7uysMFZzN/z/msuF3oE:hB+BxRjPbvgQd
TLSH
T10BA49F06F79008F9D4A7C53489A24556DE3A7C9A0B71EEDF17C8432A1F327E08E39B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

File Explorer

2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

.exe 476KB

2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

IMPHASH 71395dc0f2e96d6793e63bc299f4ab99
SHA256 d452397a387705fca9b3850a92ba01c14adaaaed5208fb1d63b85ffd351ab448
MD5 4467134e57a2ba647a18ae51fc5889e7
SHA1 44810f2976f5041631ef9a5cd15aa29f3744c1a1
SHA512 f8754ccca61a957baa082dcf196b4891de9f3dae3091df42107ca35301d0800110087445c2e97ab49b6358b5af624fefe680c848d0c026478d876ae237dbb5e9
SSDEEP 12288:hB+B+MRMIheYyDi5eNiQ7uysMFZzN/z/msuF3oE:hB+BxRjPbvgQd
TLSH
T10BA49F06F79008F9D4A7C53489A24556DE3A7C9A0B71EEDF17C8432A1F327E08E39B65
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ea:4b:cc:73:c3:95:24:ad:fc:bb:c3:1a:5a:f4:55:5a:ea:32:4d:30:07:a5:08:9c:09:74:02:b0:11:0e:2b:28

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Chains

Mar 2, 2020

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

01:97:07:a6:52:82:d8:3c:bd:f3:3e:7a:55:ff:6a:2b:8e:98:13:b6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Mar 2, 2020

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

06:ae:a7:6b:ac:46:a9:e8:cf:e6:d2:9e:45:aa:f0:33

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2019 - Nov 16, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Serial Number

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 7, 2018 - Nov 17, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

5295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdateOnDemand_unsigned.pdb

2026-10-22_4467134e57a2ba647a18ae51fc5889e7_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

PE Signature issue

PE Signature issue

kernel32

shlwapi

generic