2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar

General

Target
2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar
Size 1.5MB
Sample260524-tedcaaat4m
SHA256 d36f440f7c57788409d657eb30caa174122134462b34a5cbf1931d5d246b984e
MD5 553c35ccaaaef8b7feafd5385f94ab6a
SHA1 d347cc5ea1295dffc13fa47de1d04eb3faba65e7
SHA512 6824a9496a2ec37c22271744db4af820535551584ff11601a2fa1a609192187cbaf65626d20e22cad77163d228e6354a3d796a1d34b59e81f65ad0807997a400
SSDEEP 12288:TvXk1r3zKScuzkB/X/2xlsxjbN3FFcSRPPbYNtGD5BqqGjpjrQ:Dk1qScuzKPgssStPUvg5BRiU
TLSH
T17875F90263E64066F1B23A70C9B9A75447627FB46D37D21EBE90310AAE71BC18933777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar

.exe 1.5MB

2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar

IMPHASH 6475c67b13bd524a574fee91f1de7cd5
SHA256 d36f440f7c57788409d657eb30caa174122134462b34a5cbf1931d5d246b984e
MD5 553c35ccaaaef8b7feafd5385f94ab6a
SHA1 d347cc5ea1295dffc13fa47de1d04eb3faba65e7
SHA512 6824a9496a2ec37c22271744db4af820535551584ff11601a2fa1a609192187cbaf65626d20e22cad77163d228e6354a3d796a1d34b59e81f65ad0807997a400
SSDEEP 12288:TvXk1r3zKScuzkB/X/2xlsxjbN3FFcSRPPbYNtGD5BqqGjpjrQ:Dk1qScuzKPgssStPUvg5BRiU
TLSH
T17875F90263E64066F1B23A70C9B9A75447627FB46D37D21EBE90310AAE71BC18933777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryA CreateFileMappingA MapViewOfFile GetLastError CloseHandle MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsA GetProcAddress LoadLibraryA WriteConsoleW GetModuleFileNameA SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc OutputDebugStringW RtlUnwind LoadLibraryExW GetShortPathNameA GetFullPathNameA SetFilePointerEx GetCommandLineW LCMapStringW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW EncodePointer DecodePointer HeapAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetStringTypeW RaiseException ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection CreateFileW

user32

SetForegroundWindow ShowWindow IsIconic DefWindowProcA PostQuitMessage IsWindow CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DispatchMessageA TranslateMessage GetMessageA GetDesktopWindow SetTimer

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-24_553c35ccaaaef8b7feafd5385f94ab6a_amadey_bkransomware_cobalt-strike_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stop_vidar

kernel32

user32

advapi32

shell32

generic