2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry

General

Target
2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry
Size 4.6MB
Sample260528-tmr6eaev8p
SHA256 a8f15104df7f48c68c3650123efcbf40f4481a3795d8465fa1f199bff2443790
MD5 6632ce7f968fe56d8d35ae0435670a9a
SHA1 f80b6c9a3d911d309e17ea6e206fb31731aa3a75
SHA512 938c98829c8f0f2819fae73654c6593ecd7a7ad13bbc50ee50fd8c9a362924a760ceb48de4c8ef68e8c2c5c5473051dd6e3dbf4e6a27d724a45b8a276a62cddc
SSDEEP 98304:IHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7StJ6:IHLD53kRIci9XwgwAHvUJ6
TLSH
T1AF26AE02F7E48175E1B392718EB69319EA36BC210B31D6CF63946B5D5E726C09A36333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry

File Explorer

2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry

.exe 4.6MB

2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry

IMPHASH 8d0049281f7a49486287791e14061feb
SHA256 a8f15104df7f48c68c3650123efcbf40f4481a3795d8465fa1f199bff2443790
MD5 6632ce7f968fe56d8d35ae0435670a9a
SHA1 f80b6c9a3d911d309e17ea6e206fb31731aa3a75
SHA512 938c98829c8f0f2819fae73654c6593ecd7a7ad13bbc50ee50fd8c9a362924a760ceb48de4c8ef68e8c2c5c5473051dd6e3dbf4e6a27d724a45b8a276a62cddc
SSDEEP 98304:IHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7StJ6:IHLD53kRIci9XwgwAHvUJ6
TLSH
T1AF26AE02F7E48175E1B392718EB69319EA36BC210B31D6CF63946B5D5E726C09A36333
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

40668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\java\java\obj64\java.pdb

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA RegEnumKeyA

user32

MessageBoxA

comctl32

InitCommonControlsEx

kernel32

CreateFileW GetCommandLineA GetModuleFileNameA QueryPerformanceCounter QueryPerformanceFrequency LocalFree FormatMessageA GetLastError CloseHandle GetExitCodeProcess WaitForSingleObject CreateProcessA GetProcAddress GetModuleHandleA LoadLibraryA GetExitCodeThread FindFirstFileA FindNextFileA FindClose GetModuleHandleW ExitProcess DecodePointer EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapFree FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA MultiByteToWideChar GetFileAttributesA ExitThread GetCurrentThreadId CreateThread InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetCurrentProcess FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc RtlUnwindEx WriteFile GetStdHandle GetModuleFileNameW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW HeapSetInformation GetVersion HeapCreate GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetStdHandle GetConsoleCP GetConsoleMode GetFullPathNameA GetFileInformationByHandle PeekNamedPipe CreateFileA GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW SetEnvironmentVariableA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize CompareStringW SetFilePointer ReadFile WriteConsoleW GetDriveTypeW SetEndOfFile GetProcessHeap GetTimeZoneInformation LCMapStringW GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_6632ce7f968fe56d8d35ae0435670a9a_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader_stop_vidar_wannacry

advapi32

user32

comctl32

kernel32

generic