2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry
Size 4.1MB
Sample260702-zh4arsew2x
SHA256 9546fd31eaf47a94cdd11890e2b63a3bf961dcbf744100358cc86e6e89257cf5
MD5 50a6d96292815c7d847b1d2b83e4d3cb
SHA1 8fda8d3ee645add60a00db8e90b8137488256c8c
SHA512 6bdea46cc7a3456f45ee2a75a58f706b2bbb704dde6feccb05403db072e91ce8fd86d7d10f9aacca2786eece0bf1f8b794bbbf35c3ce70217d1b6170a457edd5
SSDEEP 49152:lhKPgssSt2gboJdXN0BMOwLloBrugxljdHF+3j5D78OBUEPji0AjVpwq:lhv7StiJdXN0B7+s1Cs1Cjox
TLSH
T134168C12B7F88535F0B39675DAB19315A9727C614B34C2CF6280666E1E72BC18A37B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

File Explorer

2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

.exe 4.1MB

2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

IMPHASH afb218cadc8024176a62f4e2f67b9144
SHA256 9546fd31eaf47a94cdd11890e2b63a3bf961dcbf744100358cc86e6e89257cf5
MD5 50a6d96292815c7d847b1d2b83e4d3cb
SHA1 8fda8d3ee645add60a00db8e90b8137488256c8c
SHA512 6bdea46cc7a3456f45ee2a75a58f706b2bbb704dde6feccb05403db072e91ce8fd86d7d10f9aacca2786eece0bf1f8b794bbbf35c3ce70217d1b6170a457edd5
SSDEEP 49152:lhKPgssSt2gboJdXN0BMOwLloBrugxljdHF+3j5D78OBUEPji0AjVpwq:lhv7StiJdXN0B7+s1Cs1Cjox
TLSH
T134168C12B7F88535F0B39675DAB19315A9727C614B34C2CF6280666E1E72BC18A37B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

243527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord118 ord115 ord119 ord171 ord240 ord141 ord281 ord195 ord181 ord123 ord120 ord114 ord160 ord159 ord116 ord32 ord8 ord92 ord88 ord205 ord70

psapi

GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW

sensapi

IsNetworkAlive

kernel32

LoadLibraryA CompareStringW GlobalFindAtomW FreeResource FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime InterlockedIncrement LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree SetErrorMode GetFileSizeEx GetFileTime GetVersionExA WritePrivateProfileStringW GlobalFlags GetStartupInfoW SetEnvironmentVariableW HeapFree HeapAlloc GetSystemTimeAsFileTime ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate QueryPerformanceCounter GetCurrentDirectoryA GetDriveTypeA GetTimeZoneInformation GetCPInfo GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetModuleHandleA GetCurrentProcessId GlobalAddAtomW InterlockedDecrement SuspendThread ResumeThread SetThreadPriority GlobalDeleteAtom GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GetModuleFileNameW GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo GetCurrentThread UnmapViewOfFile OpenFileMappingW MapViewOfFile GetVolumeInformationW GetCurrentProcess OpenEventW Module32NextW Module32FirstW Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot OpenProcess lstrcmpA lstrcmpW LocalAlloc lstrlenW GetExitCodeProcess CreateProcessW SetLastError OpenMutexW CreateMutexW GetThreadPriority RemoveDirectoryW GetVersionExW LoadLibraryW SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary lstrlenA GetACP GetPrivateProfileSectionNamesW GetPrivateProfileStringW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LocalFree FormatMessageW GetThreadLocale WideCharToMultiByte GetProcAddress GetModuleHandleW VirtualAlloc VirtualFree GetTickCount CreateEventW WaitForSingleObject GetTempPathW Sleep SetEvent MultiByteToWideChar CloseHandle CreateFileW ReadFile SetFilePointer GetFileSize CreateFileA FindClose FindFirstFileW DeleteFileW SetFileAttributesW SetFileTime WriteFile GetLastError CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource

user32

GetSysColorBrush DestroyMenu GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu ShowScrollBar CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SystemParametersInfoA GetWindowPlacement CopyRect GetSysColor EndPaint BeginPaint ReleaseDC GetDC ScreenToClient GrayStringW DrawTextW TabbedTextOutW GetLastActivePopup SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW EnableMenuItem CheckMenuItem GetWindowTextLengthW SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongW GetDlgCtrlID GetWindowLongW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetDlgItem GetWindow UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState ValidateRect PostQuitMessage CharUpperW GetMenuState GetMenuStringW ExitWindowsEx RegisterWindowMessageW EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow KillTimer DrawIcon GetClientRect GetSystemMetrics UnregisterClassW IsIconic PeekMessageW UpdateWindow GetFocus GetWindowRect SetTimer IsWindow SendMessageW EnableWindow GetForegroundWindow PostMessageW SetForegroundWindow LoadIconW MessageBoxW DrawTextExW

gdi32

GetStockObject ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps GetTextExtentPoint32W DeleteDC ScaleWindowExtEx SetWindowExtEx CreateFontIndirectW GetObjectW DeleteObject PtVisible

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

GetLengthSid RegCreateKeyW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegDeleteValueW OpenThreadToken DuplicateToken CheckTokenMembership GetTokenInformation IsValidSid ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW LookupAccountNameW CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumValueW RegQueryInfoKeyW GetUserNameW RegQueryValueExW RegFlushKey RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW SHCreateDirectoryExW SHFileOperationW SHAppBarMessage Shell_NotifyIconW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

SHDeleteKeyW PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

VariantInit VariantChangeType VariantClear

urlmon

URLDownloadToFileW

crypt32

CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CryptProtectData CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptUnprotectData CertGetNameStringW

wintrust

WinVerifyTrust

userenv

UnloadUserProfile

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_50a6d96292815c7d847b1d2b83e4d3cb_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_rhadamanthys_smoke-loader_stop_vidar_wannacry

msi

psapi

version

wininet

sensapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

crypt32

wintrust

userenv

generic