2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry
Size 4.2MB
Sample260529-e23hcscz91
SHA256 9aefb68368ff3a483a33d81eaa02bd2b44b2b2b5958368fe1d6761883bd5b1e4
MD5 7da7e77e9a0d5d99b432977dcbd91c42
SHA1 5015215a3c186264f6e528fda02c6fea2b4b8903
SHA512 cbfa0e2b2fceb66926b838202b1e6552abd0e4f1812b0101cb888cf34c04df68d6af207fc27eb8edf17e80562671ac70b404cb41f594cc374f4808865a59e5a4
SSDEEP 98304:SOHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7SteVErX:1HLD53kRIci9XwgwAHvUwAX
TLSH
T1DC269C02B3E58175E2B712709E759325A677BC310F3197CF63946E2E2EB16C0AA35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

File Explorer

2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

.exe 4.2MB

2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

IMPHASH 8e382beb8f618c29dede8f29725989ad
SHA256 9aefb68368ff3a483a33d81eaa02bd2b44b2b2b5958368fe1d6761883bd5b1e4
MD5 7da7e77e9a0d5d99b432977dcbd91c42
SHA1 5015215a3c186264f6e528fda02c6fea2b4b8903
SHA512 cbfa0e2b2fceb66926b838202b1e6552abd0e4f1812b0101cb888cf34c04df68d6af207fc27eb8edf17e80562671ac70b404cb41f594cc374f4808865a59e5a4
SSDEEP 98304:SOHcOrOO53k9KYOXwnS4rVIsNi9XwgwfoFhv7SteVErX:1HLD53kRIci9XwgwAHvUwAX
TLSH
T1DC269C02B3E58175E2B712709E759325A677BC310F3197CF63946E2E2EB16C0AA35723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

06:5f:5b:b3:5e:11:63:7f:ef:2c:cd:00:55:6f:66:db:cf:11:ce:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

24369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\onenote\x86\ship\0\onelev.pdb

kernel32

lstrlenW RaiseException InitializeCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject GetModuleFileNameW Sleep EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCurrentThreadId CreateThread CreateEventW SetEvent GetCommandLineW LoadLibraryA FreeLibrary LocalAlloc HeapSize HeapReAlloc HeapDestroy GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange LoadLibraryW HeapAlloc HeapFree GetTempPathA GetTempFileNameA CreateProcessA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetACP GetLocaleInfoA GetThreadLocale IsDebuggerPresent

user32

DispatchMessageW TranslateMessage CharUpperW CharNextW UnregisterClassA GetMessageW PostThreadMessageW

msvcr80

_cexit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ __getmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s vswprintf_s wcsrchr memset calloc memmove_s memcpy_s malloc realloc ??2@YAPAXI@Z __CxxFrameHandler3 ??_U@YAPAXI@Z ??_V@YAXPAX@Z wcscat_s wcsncpy_s wcscpy_s _CxxThrowException free ??3@YAXPAX@Z _exit

netapi32

NetShareAdd

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_7da7e77e9a0d5d99b432977dcbd91c42_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

PE Signature issue

kernel32

user32

msvcr80

netapi32

secur32

generic