2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry
Size 2.0MB
Sample260530-sn6jragx21
SHA256 bf0d5e523e2b0e0993d128522ed9808048d023cc408675639097edbe1c7b6c41
MD5 f2888033054c20e6f13282de88060e5a
SHA1 d279e973a59671963b06fc034a214e3e5bed8dff
SHA512 288ac3148f49045e365139e041b66d62b8b4b2d9037905a513cd5f2762a88c4cb5d5ddbb849ada3e8935a85814295639ac0df90f1be14a4be4e7bc4936771223
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfUEny6i1zuxw7ljsarakkqt4jtw3rCn5W:pLtk1qbLLfU8y6i1zuajsauZjabC5W
TLSH
T1C7956C2B77E844A5E5B3567486748241EB72B8311B31C3CF2264D63D1F27AE0AD3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry

File Explorer

2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry

.exe 2.0MB

2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry

IMPHASH c320870209f8127dd7e4590516029388
SHA256 bf0d5e523e2b0e0993d128522ed9808048d023cc408675639097edbe1c7b6c41
MD5 f2888033054c20e6f13282de88060e5a
SHA1 d279e973a59671963b06fc034a214e3e5bed8dff
SHA512 288ac3148f49045e365139e041b66d62b8b4b2d9037905a513cd5f2762a88c4cb5d5ddbb849ada3e8935a85814295639ac0df90f1be14a4be4e7bc4936771223
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfUEny6i1zuxw7ljsarakkqt4jtw3rCn5W:pLtk1qbLLfU8y6i1zuajsauZjabC5W
TLSH
T1C7956C2B77E844A5E5B3567486748241EB72B8311B31C3CF2264D63D1F27AE0AD3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FileSyncConfig.pdb

kernel32

FindClose CreateFileW CompareStringOrdinal IsWow64Process SetFileAttributesW GetFileAttributesW DeleteFileW GetCurrentProcess Sleep FindFirstFileW CloseHandle IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer OutputDebugStringW IsDebuggerPresent GetDiskFreeSpaceExW GetFileInformationByHandle SetLastError GetVolumeInformationByHandleW GetCurrentDirectoryW DecodePointer GetVolumePathNameW SetFileInformationByHandle SetFilePointerEx SetFileTime GetSystemDirectoryW MoveFileExW ReplaceFileW VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetFileInformationByHandleEx

msvcp120

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?_Orphan_all@_Container_base0@std@@QAEXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1ios_base@std@@UAE@XZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??0id@locale@std@@QAE@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?uncaught_exception@std@@YA_NXZ

msvcr120

_gmtime64 _read _close ??3@YAXPAX@Z _purecall __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??2@YAPAXI@Z _except_handler4_common _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter memset printf fprintf __iob_func memcpy __CxxFrameHandler3 _CxxThrowException ??_V@YAXPAX@Z memmove free _wcsicmp wcsrchr _errno _wfullpath _wmkdir _wrmdir _wunlink _wfindfirst64i32 ?_wopen@@YAHPB_WHH@Z _wstat64 _wfopen wcscpy_s _wcsnicmp ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ fclose feof ferror fread _fseeki64 fwrite _write _chsize _get_osfhandle _open_osfhandle ?what@exception@std@@UBEPBDXZ _vsnwprintf _vsnprintf malloc

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree PropVariantClear CoTaskMemAlloc

advapi32

RegEnumKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey InitializeAcl SetNamedSecurityInfoW

shell32

SHChangeNotify SHGetDataFromIDListW SHBindToParent SHParseDisplayName ord709 SHFileOperationW SHGetKnownFolderPath ord526

shlwapi

PathIsDirectoryW PathIsPrefixW

telemetry

??1ScenarioQosSyncWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z ?DefineDatapointValueList@ScenarioQosSyncWrapper@QoS@@IAEXPAV?$vector@W4DatapointValueType@ValueNode@@V?$allocator@W4DatapointValueType@ValueNode@@@std@@@std@@@Z ??0ScenarioQosSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIIII@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIII@Z ?RecordUploadDownloadScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@IABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11II@Z ?RecordFailedAssert@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I0_N@Z ?GetTxnContextString@ScenarioQosWrapper@QoS@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ??1ScenarioQosWrapper@QoS@@MAE@XZ ??1ScenarioQosSyncPerfWrapper@QoS@@UAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenarioWithSize@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@I@Z

loggingplatform

?LoggingWriteStructuredEvent@@YGXPBDI0ABU_GUID@@IIIQAUStructuredEventParameter@@@Z ?LoggingRotateIfNeeded@@YGXXZ ?StripPrivateInfoFromString@@YG?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

propsys

PropVariantToGUID

ntdll

NtQueryDirectoryFile RtlNtStatusToDosError

??0ScenarioQosChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosClientPolicy@QoS@@QAE@ABV01@@Z ??0ScenarioQosClientPolicy@QoS@@QAE@XZ ??0ScenarioQosDownloadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@_N@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@ABV01@@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@XZ ??0ScenarioQosLogUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosLogUpload@QoS@@QAE@XZ ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@ABV01@@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@_N@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@XZ ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@ABV01@@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@XZ ??0ScenarioQosSubScopeMapping@QoS@@QAE@ABV01@@Z ??0ScenarioQosSubScopeMapping@QoS@@QAE@XZ ??0ScenarioQosSyncPerf@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncPerf@QoS@@QAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@XZ ??0ScenarioQosSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@XZ ??0ScenarioQosUploadExternalFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadExternalFile@QoS@@QAE@XZ ??0ScenarioQosUploadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadFile@QoS@@QAE@_N@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@_N@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosWrapper@QoS@@QAE@ABV01@@Z ??1ScenarioQosChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosClientPolicy@QoS@@UAE@XZ ??1ScenarioQosDownloadFile@QoS@@UAE@XZ ??1ScenarioQosGetSpecialFolderInfo@QoS@@UAE@XZ ??1ScenarioQosLogUpload@QoS@@UAE@XZ ??1ScenarioQosPollingChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosQuotaStatus@QoS@@UAE@XZ ??1ScenarioQosSelectiveSyncEnumeration@QoS@@UAE@XZ ??1ScenarioQosStartupChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosStorageProvisioning@QoS@@UAE@XZ ??1ScenarioQosSubScopeMapping@QoS@@UAE@XZ ??1ScenarioQosSyncPerf@QoS@@UAE@XZ ??1ScenarioQosSyncVerification@QoS@@UAE@XZ ??1ScenarioQosUploadCrossScopeCopy@QoS@@UAE@XZ ??1ScenarioQosUploadExternalFile@QoS@@UAE@XZ ??1ScenarioQosUploadFile@QoS@@UAE@XZ ??1ScenarioQosUploadMetadata@QoS@@UAE@XZ ??1ScenarioQosWNSNotificationChangeEnumeration@QoS@@UAE@XZ ??4ScenarioQosChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosClientPolicy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDownloadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosGetSpecialFolderInfo@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosLogUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPollingChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosQuotaStatus@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSelectiveSyncEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStartupChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStorageProvisioning@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSubScopeMapping@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerf@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerfWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncVerification@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadCrossScopeCopy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadExternalFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadMetadata@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWrapper@QoS@@QAEAAV01@ABV01@@Z ??_7ScenarioQosChangeEnumeration@QoS@@6B@ ??_7ScenarioQosClientPolicy@QoS@@6B@ ??_7ScenarioQosDownloadFile@QoS@@6B@ ??_7ScenarioQosGetSpecialFolderInfo@QoS@@6B@ ??_7ScenarioQosLogUpload@QoS@@6B@ ??_7ScenarioQosPollingChangeEnumeration@QoS@@6B@ ??_7ScenarioQosQuotaStatus@QoS@@6B@ ??_7ScenarioQosSelectiveSyncEnumeration@QoS@@6B@ ??_7ScenarioQosStartupChangeEnumeration@QoS@@6B@ ??_7ScenarioQosStorageProvisioning@QoS@@6B@ ??_7ScenarioQosSubScopeMapping@QoS@@6B@ ??_7ScenarioQosSyncPerf@QoS@@6B@ ??_7ScenarioQosSyncPerfWrapper@QoS@@6B@ ??_7ScenarioQosSyncVerification@QoS@@6B@ ??_7ScenarioQosSyncWrapper@QoS@@6B@ ??_7ScenarioQosUploadCrossScopeCopy@QoS@@6B@ ??_7ScenarioQosUploadExternalFile@QoS@@6B@ ??_7ScenarioQosUploadFile@QoS@@6B@ ??_7ScenarioQosUploadMetadata@QoS@@6B@ ??_7ScenarioQosWNSNotificationChangeEnumeration@QoS@@6B@ ??_7ScenarioQosWrapper@QoS@@6B@ ?DefaultOrMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@W434@@Z ?GetApiId@ScenarioQosWrapper@QoS@@IAE?AW4_ApiId@Bici@@XZ ?GetMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_f2888033054c20e6f13282de88060e5a_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar_wannacry

kernel32

msvcp120

msvcr120

ole32

advapi32

shell32

shlwapi

telemetry

loggingplatform

propsys

ntdll

generic