2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar

General

Target
2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar
Size 3.4MB
Sample260524-ryphjsax7t
SHA256 34f920ce160ccbeae6a88d296c4b0e7340b1c735d9bc3304ebc4df1b55ddf389
MD5 bb6e98ef06f72c509e0e5a95a43bb368
SHA1 95b63152e35e4bf42b630ad98bc5fe08d3a2922d
SHA512 171208a4d5cc33f454790dd27f0fdb4812b296b1d2d40ad054def893ca794891566d4d7fc55aebd0159aba301af1079e2fb332503e4736a62b09b43b95c7e484
SSDEEP 49152:Mss1TMEzuhKPgssSt2g7ceW4SkZP4sz9MbS+gc:IZahv7StJIfkZcoc
TLSH
T156F53A12B6F8C236E0B396B5C9A597A5B9367C515F3086CF13807B2D2E72AC19532337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar

File Explorer

2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar

.exe 3.4MB

2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar

IMPHASH 8d0049281f7a49486287791e14061feb
SHA256 34f920ce160ccbeae6a88d296c4b0e7340b1c735d9bc3304ebc4df1b55ddf389
MD5 bb6e98ef06f72c509e0e5a95a43bb368
SHA1 95b63152e35e4bf42b630ad98bc5fe08d3a2922d
SHA512 171208a4d5cc33f454790dd27f0fdb4812b296b1d2d40ad054def893ca794891566d4d7fc55aebd0159aba301af1079e2fb332503e4736a62b09b43b95c7e484
SSDEEP 49152:Mss1TMEzuhKPgssSt2g7ceW4SkZP4sz9MbS+gc:IZahv7StJIfkZcoc
TLSH
T156F53A12B6F8C236E0B396B5C9A597A5B9367C515F3086CF13807B2D2E72AC19532337
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

40668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\java\java\obj64\java.pdb

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA RegEnumKeyA

user32

MessageBoxA

comctl32

InitCommonControlsEx

kernel32

CreateFileW GetCommandLineA GetModuleFileNameA QueryPerformanceCounter QueryPerformanceFrequency LocalFree FormatMessageA GetLastError CloseHandle GetExitCodeProcess WaitForSingleObject CreateProcessA GetProcAddress GetModuleHandleA LoadLibraryA GetExitCodeThread FindFirstFileA FindNextFileA FindClose GetModuleHandleW ExitProcess DecodePointer EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapFree FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA MultiByteToWideChar GetFileAttributesA ExitThread GetCurrentThreadId CreateThread InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetCurrentProcess FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc RtlUnwindEx WriteFile GetStdHandle GetModuleFileNameW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW HeapSetInformation GetVersion HeapCreate GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetStdHandle GetConsoleCP GetConsoleMode GetFullPathNameA GetFileInformationByHandle PeekNamedPipe CreateFileA GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW SetEnvironmentVariableA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize CompareStringW SetFilePointer ReadFile WriteConsoleW GetDriveTypeW SetEndOfFile GetProcessHeap GetTimeZoneInformation LCMapStringW GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-24_bb6e98ef06f72c509e0e5a95a43bb368_amadey_cobalt-strike_coinminer_darkgate_hijackloader_rugmi_satacom_smoke-loader_stop_vidar

advapi32

user32

comctl32

kernel32

generic