2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar

General

Target
2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar
Size 2.6MB
Sample260701-e1merags6x
SHA256 c634b9b443de262f61dd62daab27d013ad4f7d282a86123ce2cf8d378ae7a5a8
MD5 709bc3ac9e84be56bed326b3a0dca335
SHA1 1e09693899ceeb2901e2dfd3cdeb1f445bb420a0
SHA512 d937964da972f6e22fc274dd4c203514357b238df96ea681614a580ea1b12fdefaddd0498287f102c890f6bd46a32493c7c8d1b1eb33c7e616ce25b2a8a1c02b
SSDEEP 49152:PB7O5LhKPgssSt2gx0g7mM+M6RkMkIM7I0672ljizEAD:PkLhv7St6M+M6RkMkIM7OAAD
TLSH
T1EBC56B02B7E49075F1B32A709EBAC3615A77BC615F35864F6394364E1E706C0AA36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar

.exe 2.6MB

2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar

IMPHASH 80a6f3e5fa03208812484d79d0ea1125
SHA256 c634b9b443de262f61dd62daab27d013ad4f7d282a86123ce2cf8d378ae7a5a8
MD5 709bc3ac9e84be56bed326b3a0dca335
SHA1 1e09693899ceeb2901e2dfd3cdeb1f445bb420a0
SHA512 d937964da972f6e22fc274dd4c203514357b238df96ea681614a580ea1b12fdefaddd0498287f102c890f6bd46a32493c7c8d1b1eb33c7e616ce25b2a8a1c02b
SSDEEP 49152:PB7O5LhKPgssSt2gx0g7mM+M6RkMkIM7I0672ljizEAD:PkLhv7St6M+M6RkMkIM7OAAD
TLSH
T1EBC56B02B7E49075F1B32A709EBAC3615A77BC615F35864F6394364E1E706C0AA36B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\webapprt\win\webapprt-stub.pdb

kernel32

MoveFileExW GetCurrentProcess SetEnvironmentVariableW GetModuleHandleW WideCharToMultiByte CopyFileW VerifyVersionInfoA GetModuleFileNameW MultiByteToWideChar FlushInstructionCache GetProcAddress MoveFileW VirtualProtectEx VirtualAllocEx VerSetConditionMask LoadLibraryExA CloseHandle ExpandEnvironmentStringsW TerminateProcess FreeLibrary LoadLibraryExW IsDebuggerPresent SetFilePointerEx ReadFile CreateFileW WriteConsoleW SetDllDirectoryW CreateProcessW GetModuleHandleA GetEnvironmentVariableW GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent GetLastError HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection HeapReAlloc SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree RaiseException RtlUnwind GetConsoleMode ReadConsoleW SetStdHandle IsValidCodePage GetACP GetOEMCP GetCPInfo OutputDebugStringW GetConsoleCP FlushFileBuffers SetEnvironmentVariableA GetStringTypeW CompareStringW LCMapStringW SetEndOfFile

user32

MessageBoxW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_709bc3ac9e84be56bed326b3a0dca335_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop_vidar

kernel32

user32

advapi32

generic