2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
Size 1.4MB
Sample260510-plnpdagt21
SHA256 067a6b6022d0aba113d83081ef57d2dbb0cb9c540410514188a965c50ad8117b
MD5 47ccbc029af0fcab5af4dcd95afa71db
SHA1 4f2de0e33aa6abf928347f4a3d7d9c501968bbd4
SHA512 969685807eac9ada8a1a01408a2cbacefe83d6e3efe318f0f2d8dd2b54255304ad67fa3411ea15d75bfe6d5ebafda0536a1cbfe32b8bd9ab91c3516dbe9481e5
SSDEEP 24576:GK9NGQRl0M84p2x/WnSyhbzv8O0YD5TvinrmeTiw2cVCh:GK9NG40M84p+WSytLdR56r/iw2H
TLSH
T13A657C2276E89A35E1BF153599A1C660AA77BC210F3083CF53509F6D3E726C1AE36707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

File Explorer

2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

.exe 1.4MB

2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

IMPHASH cbab2d4030b9e874a8f9238b43cb9c91
SHA256 067a6b6022d0aba113d83081ef57d2dbb0cb9c540410514188a965c50ad8117b
MD5 47ccbc029af0fcab5af4dcd95afa71db
SHA1 4f2de0e33aa6abf928347f4a3d7d9c501968bbd4
SHA512 969685807eac9ada8a1a01408a2cbacefe83d6e3efe318f0f2d8dd2b54255304ad67fa3411ea15d75bfe6d5ebafda0536a1cbfe32b8bd9ab91c3516dbe9481e5
SSDEEP 24576:GK9NGQRl0M84p2x/WnSyhbzv8O0YD5TvinrmeTiw2cVCh:GK9NG40M84p+WSytLdR56r/iw2H
TLSH
T13A657C2276E89A35E1BF153599A1C660AA77BC210F3083CF53509F6D3E726C1AE36707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\misc\x86\ship\0\oinfop12.pdb

oinfo12.ocx

DeleteOfficeData GetOfficeData

kernel32

lstrlenA SizeofResource LockResource LoadResource FindResourceA FindResourceExA CloseHandle WaitForSingleObject InitializeCriticalSection DeleteCriticalSection Sleep CreateThread lstrcmpiA GetModuleFileNameA GetModuleHandleA GetCurrentThreadId IsDBCSLeadByte SetEvent EnterCriticalSection LeaveCriticalSection FreeLibrary LoadLibraryExA GetCommandLineA InterlockedExchange IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange LoadLibraryW lstrlenW GetLastError RaiseException WideCharToMultiByte MultiByteToWideChar CreateEventA GetTempPathA GetTempFileNameA CreateProcessA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA GetThreadLocale GetLocaleInfoA GetACP

user32

CharNextA PostThreadMessageA GetMessageA TranslateMessage DispatchMessageA CharUpperA UnregisterClassA

advapi32

RegOpenKeyExW RegQueryValueExW RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryValueExA RegEnumKeyExA

ole32

CoInitialize CoTaskMemRealloc CoRevokeClassObject CoCreateInstance CoRegisterClassObject CoTaskMemFree CoUninitialize StringFromGUID2 CoTaskMemAlloc

oleaut32

RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen VarUdateFromDate VarBstrFromDate SafeArrayGetLBound VarUI4FromStr SafeArrayGetElement VariantClear SysAllocStringLen SysFreeString LoadRegTypeLi SafeArrayGetUBound

msvcr80

_resetstkoflw ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _controlfp_s ??3@YAXPAX@Z malloc free wcscpy_s _recalloc ??_V@YAXPAX@Z vsprintf_s memcpy_s memmove_s _wcsicmp strftime ??_U@YAPAXI@Z strcpy_s wcsncpy_s strncpy_s strcat_s memset ??2@YAPAXI@Z wcsrchr vswprintf_s fclose fwprintf_s fopen_s _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_47ccbc029af0fcab5af4dcd95afa71db_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

oinfo12.ocx

kernel32

user32

advapi32

ole32

oleaut32

msvcr80

generic