2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry

General

Target
2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry
Size 3.4MB
Sample260509-m92j2afy21
SHA256 69dec0aeeaf22a5f96056438cf4ea9b9bd6af8c1342e4d3ed941b26de870c2d1
MD5 a86b49cadb85d49d9fed502c64971fe8
SHA1 7b89a81b787d5316886c5dbb68e5d8621a04f468
SHA512 9dae11f6f8cc670c8098154f0c1a6591f32de06456e3fe500b64d622c4f7556fdb9f5785bb10e8cdc836a42036603ebbcdcb1b52da8d0edbbcde39eae32b1ae9
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/b9TI:urRokqOgmhv7Stig
TLSH
T178F53A212AF08439E57796705A79E69891267D60DB72898F33D13EAEFBF06D04532333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry

File Explorer

2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry

.exe 3.4MB

2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry

IMPHASH 4b28658f0faec3fceb2d96685cc1842a
SHA256 69dec0aeeaf22a5f96056438cf4ea9b9bd6af8c1342e4d3ed941b26de870c2d1
MD5 a86b49cadb85d49d9fed502c64971fe8
SHA1 7b89a81b787d5316886c5dbb68e5d8621a04f468
SHA512 9dae11f6f8cc670c8098154f0c1a6591f32de06456e3fe500b64d622c4f7556fdb9f5785bb10e8cdc836a42036603ebbcdcb1b52da8d0edbbcde39eae32b1ae9
SSDEEP 49152:nxzQrRokplBMO+YrovpU/9JhKPgssSt2gzcY/b9TI:urRokqOgmhv7Stig
TLSH
T178F53A212AF08439E57796705A79E69891267D60DB72898F33D13EAEFBF06D04532333
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

13648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\jabswitch\jabswitch.pdb

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

wsprintfW

msvcr100

strcpy_s vsprintf_s _CRT_RTC_INITW _amsg_exit __getmainargs __C_specific_handler _XcptFilter _exit _cexit exit strcat_s _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type __crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit wcscpy_s wcstok_s wcscat_s wcsstr _wcslwr_s wcslen ??2@YAPEAX_K@Z _dupenv_s printf perror free fopen_s fprintf fclose remove _errno rename strstr feof fgets _stricmp fputs strtok_s memset __initenv

kernel32

VirtualQuery GetProcessHeap HeapAlloc HeapFree FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter DecodePointer LoadLibraryW GetProcAddress lstrlenA MultiByteToWideChar WideCharToMultiByte RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess EncodePointer Sleep GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GetVersionExW

Name

.text

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

972B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

410B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-09_a86b49cadb85d49d9fed502c64971fe8_amadey_darkgate_glassworm_smoke-loader_stop_wannacry

advapi32

version

user32

msvcr100

kernel32

generic