2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar
Size 2.5MB
Sample260530-qwjzlsdv21
SHA256 407e16982cd196216874a2a95ef5e7b613600ed20230f290b4b6ec535ca45f7a
MD5 10e06605e8aec15e55fe59fe03506313
SHA1 9509a78e7964a648a8eef5217cceceb0d0ab7555
SHA512 87c0fdd6740ed57fbc10f5d8148462252dd6fb640b90bfbc4f9dda47f6bfea7f4160d7dcdbf1b49ec76e49fb1bd57dac70dfcce209ddf538119880ee79f77a69
SSDEEP 49152:pLtk1qbLLfUHeW4SkZP4sz9MbI2gA2eQJa:JKBfkZcIc2eQ8
TLSH
T17EC54916B6B88B62E0B79174C5A69645EB337C010F3087CF12589B2D2E336E19D3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar

File Explorer

2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar

.exe 2.5MB

2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar

IMPHASH c320870209f8127dd7e4590516029388
SHA256 407e16982cd196216874a2a95ef5e7b613600ed20230f290b4b6ec535ca45f7a
MD5 10e06605e8aec15e55fe59fe03506313
SHA1 9509a78e7964a648a8eef5217cceceb0d0ab7555
SHA512 87c0fdd6740ed57fbc10f5d8148462252dd6fb640b90bfbc4f9dda47f6bfea7f4160d7dcdbf1b49ec76e49fb1bd57dac70dfcce209ddf538119880ee79f77a69
SSDEEP 49152:pLtk1qbLLfUHeW4SkZP4sz9MbI2gA2eQJa:JKBfkZcIc2eQ8
TLSH
T17EC54916B6B88B62E0B79174C5A69645EB337C010F3087CF12589B2D2E336E19D3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FileSyncConfig.pdb

kernel32

FindClose CreateFileW CompareStringOrdinal IsWow64Process SetFileAttributesW GetFileAttributesW DeleteFileW GetCurrentProcess Sleep FindFirstFileW CloseHandle IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer OutputDebugStringW IsDebuggerPresent GetDiskFreeSpaceExW GetFileInformationByHandle SetLastError GetVolumeInformationByHandleW GetCurrentDirectoryW DecodePointer GetVolumePathNameW SetFileInformationByHandle SetFilePointerEx SetFileTime GetSystemDirectoryW MoveFileExW ReplaceFileW VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetFileInformationByHandleEx

msvcp120

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?_Orphan_all@_Container_base0@std@@QAEXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1ios_base@std@@UAE@XZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??0id@locale@std@@QAE@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?uncaught_exception@std@@YA_NXZ

msvcr120

_gmtime64 _read _close ??3@YAXPAX@Z _purecall __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??2@YAPAXI@Z _except_handler4_common _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter memset printf fprintf __iob_func memcpy __CxxFrameHandler3 _CxxThrowException ??_V@YAXPAX@Z memmove free _wcsicmp wcsrchr _errno _wfullpath _wmkdir _wrmdir _wunlink _wfindfirst64i32 ?_wopen@@YAHPB_WHH@Z _wstat64 _wfopen wcscpy_s _wcsnicmp ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ fclose feof ferror fread _fseeki64 fwrite _write _chsize _get_osfhandle _open_osfhandle ?what@exception@std@@UBEPBDXZ _vsnwprintf _vsnprintf malloc

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree PropVariantClear CoTaskMemAlloc

advapi32

RegEnumKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey InitializeAcl SetNamedSecurityInfoW

shell32

SHChangeNotify SHGetDataFromIDListW SHBindToParent SHParseDisplayName ord709 SHFileOperationW SHGetKnownFolderPath ord526

shlwapi

PathIsDirectoryW PathIsPrefixW

telemetry

??1ScenarioQosSyncWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z ?DefineDatapointValueList@ScenarioQosSyncWrapper@QoS@@IAEXPAV?$vector@W4DatapointValueType@ValueNode@@V?$allocator@W4DatapointValueType@ValueNode@@@std@@@std@@@Z ??0ScenarioQosSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIIII@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIII@Z ?RecordUploadDownloadScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@IABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11II@Z ?RecordFailedAssert@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I0_N@Z ?GetTxnContextString@ScenarioQosWrapper@QoS@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ??1ScenarioQosWrapper@QoS@@MAE@XZ ??1ScenarioQosSyncPerfWrapper@QoS@@UAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenarioWithSize@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@I@Z

loggingplatform

?LoggingWriteStructuredEvent@@YGXPBDI0ABU_GUID@@IIIQAUStructuredEventParameter@@@Z ?LoggingRotateIfNeeded@@YGXXZ ?StripPrivateInfoFromString@@YG?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

propsys

PropVariantToGUID

ntdll

NtQueryDirectoryFile RtlNtStatusToDosError

??0ScenarioQosChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosClientPolicy@QoS@@QAE@ABV01@@Z ??0ScenarioQosClientPolicy@QoS@@QAE@XZ ??0ScenarioQosDownloadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@_N@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@ABV01@@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@XZ ??0ScenarioQosLogUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosLogUpload@QoS@@QAE@XZ ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@ABV01@@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@_N@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@XZ ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@ABV01@@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@XZ ??0ScenarioQosSubScopeMapping@QoS@@QAE@ABV01@@Z ??0ScenarioQosSubScopeMapping@QoS@@QAE@XZ ??0ScenarioQosSyncPerf@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncPerf@QoS@@QAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@XZ ??0ScenarioQosSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@XZ ??0ScenarioQosUploadExternalFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadExternalFile@QoS@@QAE@XZ ??0ScenarioQosUploadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadFile@QoS@@QAE@_N@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@_N@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosWrapper@QoS@@QAE@ABV01@@Z ??1ScenarioQosChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosClientPolicy@QoS@@UAE@XZ ??1ScenarioQosDownloadFile@QoS@@UAE@XZ ??1ScenarioQosGetSpecialFolderInfo@QoS@@UAE@XZ ??1ScenarioQosLogUpload@QoS@@UAE@XZ ??1ScenarioQosPollingChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosQuotaStatus@QoS@@UAE@XZ ??1ScenarioQosSelectiveSyncEnumeration@QoS@@UAE@XZ ??1ScenarioQosStartupChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosStorageProvisioning@QoS@@UAE@XZ ??1ScenarioQosSubScopeMapping@QoS@@UAE@XZ ??1ScenarioQosSyncPerf@QoS@@UAE@XZ ??1ScenarioQosSyncVerification@QoS@@UAE@XZ ??1ScenarioQosUploadCrossScopeCopy@QoS@@UAE@XZ ??1ScenarioQosUploadExternalFile@QoS@@UAE@XZ ??1ScenarioQosUploadFile@QoS@@UAE@XZ ??1ScenarioQosUploadMetadata@QoS@@UAE@XZ ??1ScenarioQosWNSNotificationChangeEnumeration@QoS@@UAE@XZ ??4ScenarioQosChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosClientPolicy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDownloadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosGetSpecialFolderInfo@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosLogUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPollingChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosQuotaStatus@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSelectiveSyncEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStartupChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStorageProvisioning@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSubScopeMapping@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerf@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerfWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncVerification@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadCrossScopeCopy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadExternalFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadMetadata@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWrapper@QoS@@QAEAAV01@ABV01@@Z ??_7ScenarioQosChangeEnumeration@QoS@@6B@ ??_7ScenarioQosClientPolicy@QoS@@6B@ ??_7ScenarioQosDownloadFile@QoS@@6B@ ??_7ScenarioQosGetSpecialFolderInfo@QoS@@6B@ ??_7ScenarioQosLogUpload@QoS@@6B@ ??_7ScenarioQosPollingChangeEnumeration@QoS@@6B@ ??_7ScenarioQosQuotaStatus@QoS@@6B@ ??_7ScenarioQosSelectiveSyncEnumeration@QoS@@6B@ ??_7ScenarioQosStartupChangeEnumeration@QoS@@6B@ ??_7ScenarioQosStorageProvisioning@QoS@@6B@ ??_7ScenarioQosSubScopeMapping@QoS@@6B@ ??_7ScenarioQosSyncPerf@QoS@@6B@ ??_7ScenarioQosSyncPerfWrapper@QoS@@6B@ ??_7ScenarioQosSyncVerification@QoS@@6B@ ??_7ScenarioQosSyncWrapper@QoS@@6B@ ??_7ScenarioQosUploadCrossScopeCopy@QoS@@6B@ ??_7ScenarioQosUploadExternalFile@QoS@@6B@ ??_7ScenarioQosUploadFile@QoS@@6B@ ??_7ScenarioQosUploadMetadata@QoS@@6B@ ??_7ScenarioQosWNSNotificationChangeEnumeration@QoS@@6B@ ??_7ScenarioQosWrapper@QoS@@6B@ ?DefaultOrMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@W434@@Z ?GetApiId@ScenarioQosWrapper@QoS@@IAE?AW4_ApiId@Bici@@XZ ?GetMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_10e06605e8aec15e55fe59fe03506313_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_karagany_njrat_rhadamanthys_smoke-loader_vidar

kernel32

msvcp120

msvcr120

ole32

advapi32

shell32

shlwapi

telemetry

loggingplatform

propsys

ntdll

generic