2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry

General

Target
2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
Size 2.8MB
Sample260601-l2a7faaz3n
SHA256 2112e1fcc7ba4dd86d47c684cba5c93cabd5fdc2d5fa9d5bcc04ae5612fdf0ef
MD5 c7226345f0df1fd890ac7d090be633e9
SHA1 82cad803e6e9369abed2c6c307aa5960da2e72e6
SHA512 487e858e5a54d78dc80d8f6e5f4234ec14b2bc6a60833a106dd7035df033d7ec0b5f80811acf0c73aebb012cd4e796ae63dbaddbf9a52becdc6d4b8c5451a056
SSDEEP 24576:VslZOZ4GT5jcAkSYqyE8rYn5Gq2fTiw2ZLyDIiukOiFOPfepJ12eCtsO8e7zYKaW:AmpYqQY5G7iw2ZcgA2eQJaljIrGc
TLSH
T147D54A15B7F84AA1E1B79574C9A29256FE727C510F3087CF12909A2E2F33AD0DD39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry

File Explorer

2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry

.exe 2.8MB

2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry

IMPHASH 69c8890c645bc52baf5347009201dcb7
SHA256 2112e1fcc7ba4dd86d47c684cba5c93cabd5fdc2d5fa9d5bcc04ae5612fdf0ef
MD5 c7226345f0df1fd890ac7d090be633e9
SHA1 82cad803e6e9369abed2c6c307aa5960da2e72e6
SHA512 487e858e5a54d78dc80d8f6e5f4234ec14b2bc6a60833a106dd7035df033d7ec0b5f80811acf0c73aebb012cd4e796ae63dbaddbf9a52becdc6d4b8c5451a056
SSDEEP 24576:VslZOZ4GT5jcAkSYqyE8rYn5Gq2fTiw2ZLyDIiukOiFOPfepJ12eCtsO8e7zYKaW:AmpYqQY5G7iw2ZcgA2eQJaljIrGc
TLSH
T147D54A15B7F84AA1E1B79574C9A29256FE727C510F3087CF12909A2E2F33AD0DD39722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

83976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer RaiseException FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleW LoadLibraryExA VirtualQuery VirtualProtect

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 RpcImpersonateClient RpcRevertToSelf

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_c7226345f0df1fd890ac7d090be633e9_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry

advapi32

kernel32

rpcrt4

wintrust

generic