2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar

General

Target
2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar
Size 2.0MB
Sample260510-nwtspse141
SHA256 0e293f1a1fc5e2e007a9cd9ed9cb490c6bdba32904862ef57b6eb459572bb1f6
MD5 c77939e622c1e4efff3a7cdee276264a
SHA1 48d3b550ce6f9be0e8452daa76180b5c90bcc615
SHA512 0e648baa4121550b7cd958ff9b4f2307c6e96b9d96b53c3ca30643ca53aa962583d9b584bddc4d591f990109a80049136adfaba4f4bb9027914807752f9cf33a
SSDEEP 24576:Dk1Z5jcAkSYqyEYExqatgl8bVrCn5KE+9xYcLGszrYm4R+9Mt:Dk1PpYqXqatgloC5KYcLGKzq+9G
TLSH
T1ABA53A16B7A44571E073857488A6825EEE317805CB32CE8F1254AEEDBFB36E09D39731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar

File Explorer

2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar

.exe 2.0MB

2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar

IMPHASH 6475c67b13bd524a574fee91f1de7cd5
SHA256 0e293f1a1fc5e2e007a9cd9ed9cb490c6bdba32904862ef57b6eb459572bb1f6
MD5 c77939e622c1e4efff3a7cdee276264a
SHA1 48d3b550ce6f9be0e8452daa76180b5c90bcc615
SHA512 0e648baa4121550b7cd958ff9b4f2307c6e96b9d96b53c3ca30643ca53aa962583d9b584bddc4d591f990109a80049136adfaba4f4bb9027914807752f9cf33a
SSDEEP 24576:Dk1Z5jcAkSYqyEYExqatgl8bVrCn5KE+9xYcLGszrYm4R+9Mt:Dk1PpYqXqatgloC5KYcLGKzq+9G
TLSH
T1ABA53A16B7A44571E073857488A6825EEE317805CB32CE8F1254AEEDBFB36E09D39731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryA CreateFileMappingA MapViewOfFile GetLastError CloseHandle MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsA GetProcAddress LoadLibraryA WriteConsoleW GetModuleFileNameA SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc OutputDebugStringW RtlUnwind LoadLibraryExW GetShortPathNameA GetFullPathNameA SetFilePointerEx GetCommandLineW LCMapStringW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW EncodePointer DecodePointer HeapAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetStringTypeW RaiseException ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection CreateFileW

user32

SetForegroundWindow ShowWindow IsIconic DefWindowProcA PostQuitMessage IsWindow CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DispatchMessageA TranslateMessage GetMessageA GetDesktopWindow SetTimer

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_c77939e622c1e4efff3a7cdee276264a_amadey_bkransomware_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_maze_njrat_rhadamanthys_smoke-loader_vidar

kernel32

user32

advapi32

shell32

generic