2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry
Size 1.8MB
Sample260528-rertkabt6z
SHA256 722942e68109276efa858793ef2b0bdcb5bb5033670c9741fcc4659b83a9c606
MD5 02736437b1ea248da8db24f19366d482
SHA1 487fb976182a18b1ad5843c7eb8c6f17a4a516cf
SHA512 47602634a142f3dd3a1e11259ab82984d19cc010655e2cda1019d5cf1492a7305b5d7d0aa2aa785b4a50983ede29447809c8c833f3296fc337c2da4d761f71a8
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfUEkqMA0Le5ji0hmxNrM:pLtk1qbLLfUwPji0Aj
TLSH
T186953A2FFE648EA1C07285748595D34DD731BC510B2086CB6268B75DEE32FE1AD3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry

File Explorer

2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry

.exe 1.8MB

2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry

IMPHASH c320870209f8127dd7e4590516029388
SHA256 722942e68109276efa858793ef2b0bdcb5bb5033670c9741fcc4659b83a9c606
MD5 02736437b1ea248da8db24f19366d482
SHA1 487fb976182a18b1ad5843c7eb8c6f17a4a516cf
SHA512 47602634a142f3dd3a1e11259ab82984d19cc010655e2cda1019d5cf1492a7305b5d7d0aa2aa785b4a50983ede29447809c8c833f3296fc337c2da4d761f71a8
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfUEkqMA0Le5ji0hmxNrM:pLtk1qbLLfUwPji0Aj
TLSH
T186953A2FFE648EA1C07285748595D34DD731BC510B2086CB6268B75DEE32FE1AD3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FileSyncConfig.pdb

kernel32

FindClose CreateFileW CompareStringOrdinal IsWow64Process SetFileAttributesW GetFileAttributesW DeleteFileW GetCurrentProcess Sleep FindFirstFileW CloseHandle IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer OutputDebugStringW IsDebuggerPresent GetDiskFreeSpaceExW GetFileInformationByHandle SetLastError GetVolumeInformationByHandleW GetCurrentDirectoryW DecodePointer GetVolumePathNameW SetFileInformationByHandle SetFilePointerEx SetFileTime GetSystemDirectoryW MoveFileExW ReplaceFileW VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetFileInformationByHandleEx

msvcp120

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?_Orphan_all@_Container_base0@std@@QAEXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1ios_base@std@@UAE@XZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??0id@locale@std@@QAE@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?uncaught_exception@std@@YA_NXZ

msvcr120

_gmtime64 _read _close ??3@YAXPAX@Z _purecall __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??2@YAPAXI@Z _except_handler4_common _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter memset printf fprintf __iob_func memcpy __CxxFrameHandler3 _CxxThrowException ??_V@YAXPAX@Z memmove free _wcsicmp wcsrchr _errno _wfullpath _wmkdir _wrmdir _wunlink _wfindfirst64i32 ?_wopen@@YAHPB_WHH@Z _wstat64 _wfopen wcscpy_s _wcsnicmp ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ fclose feof ferror fread _fseeki64 fwrite _write _chsize _get_osfhandle _open_osfhandle ?what@exception@std@@UBEPBDXZ _vsnwprintf _vsnprintf malloc

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree PropVariantClear CoTaskMemAlloc

advapi32

RegEnumKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey InitializeAcl SetNamedSecurityInfoW

shell32

SHChangeNotify SHGetDataFromIDListW SHBindToParent SHParseDisplayName ord709 SHFileOperationW SHGetKnownFolderPath ord526

shlwapi

PathIsDirectoryW PathIsPrefixW

telemetry

??1ScenarioQosSyncWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z ?DefineDatapointValueList@ScenarioQosSyncWrapper@QoS@@IAEXPAV?$vector@W4DatapointValueType@ValueNode@@V?$allocator@W4DatapointValueType@ValueNode@@@std@@@std@@@Z ??0ScenarioQosSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIIII@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIII@Z ?RecordUploadDownloadScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@IABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11II@Z ?RecordFailedAssert@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I0_N@Z ?GetTxnContextString@ScenarioQosWrapper@QoS@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ??1ScenarioQosWrapper@QoS@@MAE@XZ ??1ScenarioQosSyncPerfWrapper@QoS@@UAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenarioWithSize@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@I@Z

loggingplatform

?LoggingWriteStructuredEvent@@YGXPBDI0ABU_GUID@@IIIQAUStructuredEventParameter@@@Z ?LoggingRotateIfNeeded@@YGXXZ ?StripPrivateInfoFromString@@YG?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

propsys

PropVariantToGUID

ntdll

NtQueryDirectoryFile RtlNtStatusToDosError

??0ScenarioQosChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosClientPolicy@QoS@@QAE@ABV01@@Z ??0ScenarioQosClientPolicy@QoS@@QAE@XZ ??0ScenarioQosDownloadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@_N@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@ABV01@@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@XZ ??0ScenarioQosLogUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosLogUpload@QoS@@QAE@XZ ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@ABV01@@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@_N@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@XZ ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@ABV01@@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@XZ ??0ScenarioQosSubScopeMapping@QoS@@QAE@ABV01@@Z ??0ScenarioQosSubScopeMapping@QoS@@QAE@XZ ??0ScenarioQosSyncPerf@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncPerf@QoS@@QAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@XZ ??0ScenarioQosSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@XZ ??0ScenarioQosUploadExternalFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadExternalFile@QoS@@QAE@XZ ??0ScenarioQosUploadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadFile@QoS@@QAE@_N@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@_N@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosWrapper@QoS@@QAE@ABV01@@Z ??1ScenarioQosChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosClientPolicy@QoS@@UAE@XZ ??1ScenarioQosDownloadFile@QoS@@UAE@XZ ??1ScenarioQosGetSpecialFolderInfo@QoS@@UAE@XZ ??1ScenarioQosLogUpload@QoS@@UAE@XZ ??1ScenarioQosPollingChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosQuotaStatus@QoS@@UAE@XZ ??1ScenarioQosSelectiveSyncEnumeration@QoS@@UAE@XZ ??1ScenarioQosStartupChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosStorageProvisioning@QoS@@UAE@XZ ??1ScenarioQosSubScopeMapping@QoS@@UAE@XZ ??1ScenarioQosSyncPerf@QoS@@UAE@XZ ??1ScenarioQosSyncVerification@QoS@@UAE@XZ ??1ScenarioQosUploadCrossScopeCopy@QoS@@UAE@XZ ??1ScenarioQosUploadExternalFile@QoS@@UAE@XZ ??1ScenarioQosUploadFile@QoS@@UAE@XZ ??1ScenarioQosUploadMetadata@QoS@@UAE@XZ ??1ScenarioQosWNSNotificationChangeEnumeration@QoS@@UAE@XZ ??4ScenarioQosChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosClientPolicy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDownloadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosGetSpecialFolderInfo@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosLogUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPollingChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosQuotaStatus@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSelectiveSyncEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStartupChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStorageProvisioning@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSubScopeMapping@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerf@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerfWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncVerification@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadCrossScopeCopy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadExternalFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadMetadata@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWrapper@QoS@@QAEAAV01@ABV01@@Z ??_7ScenarioQosChangeEnumeration@QoS@@6B@ ??_7ScenarioQosClientPolicy@QoS@@6B@ ??_7ScenarioQosDownloadFile@QoS@@6B@ ??_7ScenarioQosGetSpecialFolderInfo@QoS@@6B@ ??_7ScenarioQosLogUpload@QoS@@6B@ ??_7ScenarioQosPollingChangeEnumeration@QoS@@6B@ ??_7ScenarioQosQuotaStatus@QoS@@6B@ ??_7ScenarioQosSelectiveSyncEnumeration@QoS@@6B@ ??_7ScenarioQosStartupChangeEnumeration@QoS@@6B@ ??_7ScenarioQosStorageProvisioning@QoS@@6B@ ??_7ScenarioQosSubScopeMapping@QoS@@6B@ ??_7ScenarioQosSyncPerf@QoS@@6B@ ??_7ScenarioQosSyncPerfWrapper@QoS@@6B@ ??_7ScenarioQosSyncVerification@QoS@@6B@ ??_7ScenarioQosSyncWrapper@QoS@@6B@ ??_7ScenarioQosUploadCrossScopeCopy@QoS@@6B@ ??_7ScenarioQosUploadExternalFile@QoS@@6B@ ??_7ScenarioQosUploadFile@QoS@@6B@ ??_7ScenarioQosUploadMetadata@QoS@@6B@ ??_7ScenarioQosWNSNotificationChangeEnumeration@QoS@@6B@ ??_7ScenarioQosWrapper@QoS@@6B@ ?DefaultOrMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@W434@@Z ?GetApiId@ScenarioQosWrapper@QoS@@IAE?AW4_ApiId@Bici@@XZ ?GetMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_02736437b1ea248da8db24f19366d482_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_wannacry

kernel32

msvcp120

msvcr120

ole32

advapi32

shell32

shlwapi

telemetry

loggingplatform

propsys

ntdll

generic