2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry
Size 4.2MB
Sample260522-pg6dmadt2x
SHA256 3fcb96c3a78c3cb2d7c7542fe7e24d1e4f515dfebae0f121676e2fdc2b009a41
MD5 417000a8c2d6307cc2cf6b26de21b92d
SHA1 4616004cde1105bbf4a0325ee1c56670957caa93
SHA512 e0cd3eda015f5f49dc0aa657dd069445a78075fde593d7277b61f11dbbdb71c2ba8cfc4e723e98e8c9a684dbf72be350d4f1993c56e2cbe4bb65f4ee62fae635
SSDEEP 98304:SOHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7St0:1HLD53kRIci9XwgwAHvU0
TLSH
T1352629036E9C8035E1BF3D715D65D3D95626BD204B22B98B6ED43E8DEAB05C0B93D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry

File Explorer

2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry

.exe 4.2MB

2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry

IMPHASH 8e382beb8f618c29dede8f29725989ad
SHA256 3fcb96c3a78c3cb2d7c7542fe7e24d1e4f515dfebae0f121676e2fdc2b009a41
MD5 417000a8c2d6307cc2cf6b26de21b92d
SHA1 4616004cde1105bbf4a0325ee1c56670957caa93
SHA512 e0cd3eda015f5f49dc0aa657dd069445a78075fde593d7277b61f11dbbdb71c2ba8cfc4e723e98e8c9a684dbf72be350d4f1993c56e2cbe4bb65f4ee62fae635
SSDEEP 98304:SOHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7St0:1HLD53kRIci9XwgwAHvU0
TLSH
T1352629036E9C8035E1BF3D715D65D3D95626BD204B22B98B6ED43E8DEAB05C0B93D322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

19:31:ce:6f:08:6e:e5:3b:90:cb:bb:8a:9b:e1:3d:98:cd:23:79:48

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

24369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\onenote\x86\ship\0\onelev.pdb

kernel32

lstrlenW RaiseException InitializeCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject GetModuleFileNameW Sleep EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCurrentThreadId CreateThread CreateEventW SetEvent GetCommandLineW LoadLibraryA FreeLibrary LocalAlloc HeapSize HeapReAlloc HeapDestroy GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange LoadLibraryW HeapAlloc HeapFree GetTempPathA GetTempFileNameA CreateProcessA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetACP GetLocaleInfoA GetThreadLocale IsDebuggerPresent

user32

DispatchMessageW TranslateMessage CharUpperW CharNextW UnregisterClassA GetMessageW PostThreadMessageW

msvcr80

_cexit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ __getmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s vswprintf_s wcsrchr memset calloc memmove_s memcpy_s malloc realloc ??2@YAPAXI@Z __CxxFrameHandler3 ??_U@YAPAXI@Z ??_V@YAXPAX@Z wcscat_s wcsncpy_s wcscpy_s _CxxThrowException free ??3@YAXPAX@Z _exit

netapi32

NetShareAdd

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_417000a8c2d6307cc2cf6b26de21b92d_amadey_coinminer_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop_wannacry

PE Signature issue

kernel32

user32

msvcr80

netapi32

secur32

generic