2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
Size 1.6MB
Sample260510-mnn2tady21
SHA256 9d26d545ff9b74fe6693f29a85daa2f73b924f7438f77cd1e6b256cab8caa5e4
MD5 4d1c1f1abcbba3c394ba9070c1153378
SHA1 4c6cb45dd922ac8b2af5cc7fa9b35b473693e9d0
SHA512 bf433eeff05d40219b7feb1af39ed61f95ff16c8e7d73676fc496f3d3af71184645aa24f5c467a740e244fa6862eb3a79a99f3e3ef01c74faab6a2f6af1310bf
SSDEEP 24576:GK9NGQRl0M84p2x/WnSyhbzv8O0YD5Tvinrmz9kFlHVlN9o:GK9NG40M84p+WSytLdR56rVlE
TLSH
T18E85191176E44534E1BB5A719AB5852CAA37BC15CE238F8F12505ECEBBF16809E32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

File Explorer

2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

.exe 1.6MB

2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

IMPHASH cbab2d4030b9e874a8f9238b43cb9c91
SHA256 9d26d545ff9b74fe6693f29a85daa2f73b924f7438f77cd1e6b256cab8caa5e4
MD5 4d1c1f1abcbba3c394ba9070c1153378
SHA1 4c6cb45dd922ac8b2af5cc7fa9b35b473693e9d0
SHA512 bf433eeff05d40219b7feb1af39ed61f95ff16c8e7d73676fc496f3d3af71184645aa24f5c467a740e244fa6862eb3a79a99f3e3ef01c74faab6a2f6af1310bf
SSDEEP 24576:GK9NGQRl0M84p2x/WnSyhbzv8O0YD5Tvinrmz9kFlHVlN9o:GK9NG40M84p+WSytLdR56rVlE
TLSH
T18E85191176E44534E1BB5A719AB5852CAA37BC15CE238F8F12505ECEBBF16809E32733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\misc\x86\ship\0\oinfop12.pdb

oinfo12.ocx

DeleteOfficeData GetOfficeData

kernel32

lstrlenA SizeofResource LockResource LoadResource FindResourceA FindResourceExA CloseHandle WaitForSingleObject InitializeCriticalSection DeleteCriticalSection Sleep CreateThread lstrcmpiA GetModuleFileNameA GetModuleHandleA GetCurrentThreadId IsDBCSLeadByte SetEvent EnterCriticalSection LeaveCriticalSection FreeLibrary LoadLibraryExA GetCommandLineA InterlockedExchange IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange LoadLibraryW lstrlenW GetLastError RaiseException WideCharToMultiByte MultiByteToWideChar CreateEventA GetTempPathA GetTempFileNameA CreateProcessA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA GetThreadLocale GetLocaleInfoA GetACP

user32

CharNextA PostThreadMessageA GetMessageA TranslateMessage DispatchMessageA CharUpperA UnregisterClassA

advapi32

RegOpenKeyExW RegQueryValueExW RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryValueExA RegEnumKeyExA

ole32

CoInitialize CoTaskMemRealloc CoRevokeClassObject CoCreateInstance CoRegisterClassObject CoTaskMemFree CoUninitialize StringFromGUID2 CoTaskMemAlloc

oleaut32

RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen VarUdateFromDate VarBstrFromDate SafeArrayGetLBound VarUI4FromStr SafeArrayGetElement VariantClear SysAllocStringLen SysFreeString LoadRegTypeLi SafeArrayGetUBound

msvcr80

_resetstkoflw ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _controlfp_s ??3@YAXPAX@Z malloc free wcscpy_s _recalloc ??_V@YAXPAX@Z vsprintf_s memcpy_s memmove_s _wcsicmp strftime ??_U@YAPAXI@Z strcpy_s wcsncpy_s strncpy_s strcat_s memset ??2@YAPAXI@Z wcsrchr vswprintf_s fclose fwprintf_s fopen_s _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_4d1c1f1abcbba3c394ba9070c1153378_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

oinfo12.ocx

kernel32

user32

advapi32

ole32

oleaut32

msvcr80

generic