2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar

General

Target
2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar
Size 3.3MB
Sample260522-ppcraaa16j
SHA256 d4a6cbbfc4c587c1783fa48a2d89ade3609011750da7baa8e8645bc6ed7cbe4b
MD5 4698d4f8a917f9dddee06c1b25729b1d
SHA1 385a06f9267e80475590de47aac87c44f6b61f3e
SHA512 4ebc1a9cace3487c22844da9791aced2f2bec4a7fa9d8dd51d58b529a2fce5d303a171abf0c7666f0c3694182e2ad3f51efe0703ade68c19b5c91be886756a03
SSDEEP 98304:1+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWY:cmAEnG
TLSH
T1CAF57C02B7E4C472D1B70A3198ABE726A775BC111F6187CF6354B79D5E323C0AA32726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar

.exe 3.3MB

2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar

IMPHASH 440bc139f19edeac18ebed46859ccfed
SHA256 d4a6cbbfc4c587c1783fa48a2d89ade3609011750da7baa8e8645bc6ed7cbe4b
MD5 4698d4f8a917f9dddee06c1b25729b1d
SHA1 385a06f9267e80475590de47aac87c44f6b61f3e
SHA512 4ebc1a9cace3487c22844da9791aced2f2bec4a7fa9d8dd51d58b529a2fce5d303a171abf0c7666f0c3694182e2ad3f51efe0703ade68c19b5c91be886756a03
SSDEEP 98304:1+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWY:cmAEnG
TLSH
T1CAF57C02B7E4C472D1B70A3198ABE726A775BC111F6187CF6354B79D5E323C0AA32726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_atg\Plugins\Updater\acroaum\win\Release\acroaum.pdb

kernel32

LoadLibraryW GetProcAddress MultiByteToWideChar WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA GetLastError GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP LoadLibraryA InitializeCriticalSection GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW ReadFile SetFilePointer SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

MessageBoxA

advapi32

RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_4698d4f8a917f9dddee06c1b25729b1d_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_manuscrypt_rhadamanthys_smoke-loader_stop_vidar

kernel32

user32

advapi32

generic