2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
Size 29.4MB
Sample260707-eqpr5aew6q
SHA256 df39cebabe265cbc6a4f651ecfc369fa98956fa6f340dacb381afbb436ca4efa
MD5 43144a3ffa3a2a1542a510d57ea0dd93
SHA1 2cce96def6d856901f7c2b1366877a2678454b66
SHA512 7ff65c5c29b928a9ce4ca115909380938a32ff9425cea3615b4eb80dfcf0c23bc8e6de99993b7b0472bb68cba0a02fefbe46c476e94823dca0f240ea4e006ffb
SSDEEP 196608:mMsGKGQnMkhgJuP32+dmhZk/x6ZmlrB3ytPqVxUQVmBDTSWhTwfx:mVT5nHS+2zZm0PqbsBDThAx
TLSH
T128675ACAAAE403E3D06A9674CA7682B1E631BC431B22978B357CB35D1F336D18D35761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

File Explorer

2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

.exe 29.4MB

2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

IMPHASH 94b537cd7c7f753d1d3803f936a74791
SHA256 df39cebabe265cbc6a4f651ecfc369fa98956fa6f340dacb381afbb436ca4efa
MD5 43144a3ffa3a2a1542a510d57ea0dd93
SHA1 2cce96def6d856901f7c2b1366877a2678454b66
SHA512 7ff65c5c29b928a9ce4ca115909380938a32ff9425cea3615b4eb80dfcf0c23bc8e6de99993b7b0472bb68cba0a02fefbe46c476e94823dca0f240ea4e006ffb
SSDEEP 196608:mMsGKGQnMkhgJuP32+dmhZk/x6ZmlrB3ytPqVxUQVmBDTSWhTwfx:mVT5nHS+2zZm0PqbsBDThAx
TLSH
T128675ACAAAE403E3D06A9674CA7682B1E631BC431B22978B357CB35D1F336D18D35761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

exit _c_exit _except_handler3 _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __initenv _cexit _XcptFilter _exit _wcsicmp

kernel32

SetErrorMode GetModuleHandleA

ulib

?AnalyzePath@PATH@@QAE?AW4PATH_ANALYZE_CODE@@PAVWSTRING@@PAV1@0@Z ??1PATH@@UAE@XZ ??0PATH@@QAE@XZ ??0DSTRING@@QAE@XZ ?Initialize@WSTRING@@QAEEPBV1@KK@Z ??1ARGUMENT_LEXEMIZER@@UAE@XZ ??1ARRAY@@UAE@XZ ??1STRING_ARGUMENT@@UAE@XZ ?GetLexeme@ARGUMENT@@QAEPAVWSTRING@@XZ ?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z ?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z ?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z ?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z ?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z ?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z ?Put@ARRAY@@UAEEPAVOBJECT@@@Z ?Initialize@MULTIPLE_PATH_ARGUMENT@@QAEEPADEE@Z ?Initialize@LONG_ARGUMENT@@QAEEPAD@Z ?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z ?Initialize@STRING_ARGUMENT@@QAEEPAD@Z ?Initialize@ARRAY@@QAEEKK@Z ?Initialize@PROGRAM@@QAEEKKK@Z ??0LONG_ARGUMENT@@QAE@XZ ??0FLAG_ARGUMENT@@QAE@XZ ??0STRING_ARGUMENT@@QAE@XZ ??0ARRAY@@QAE@XZ ??0ARGUMENT_LEXEMIZER@@QAE@XZ ?Initialize@CLASS_DESCRIPTOR@@QAEEXZ ??0CLASS_DESCRIPTOR@@QAE@XZ ?QueryDriveType@SYSTEM@@SG?AW4DRIVE_TYPE@@PBVWSTRING@@@Z ?Strcat@WSTRING@@QAEEPBV1@@Z ?QueryString@WSTRING@@QBEPAV1@KK@Z ??1DSTRING@@UAE@XZ ??1OBJECT@@UAE@XZ ??1MULTIPLE_PATH_ARGUMENT@@UAE@XZ ??1PROGRAM@@UAE@XZ ??0PROGRAM@@IAE@XZ ??0MULTIPLE_PATH_ARGUMENT@@QAE@XZ ?Compare@OBJECT@@UBEJPBV1@@Z ?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ ?DisplayMessage@PROGRAM@@UBEEKW4MESSAGE_TYPE@@@Z ?Fatal@PROGRAM@@UBAXKKPADZZ ?Fatal@PROGRAM@@UBEXXZ ?GetStandardInput@PROGRAM@@UAEPAVSTREAM@@XZ ?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ ?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ ?Usage@PROGRAM@@UBEXXZ ?ValidateVersion@PROGRAM@@UBEXKK@Z ?Initialize@WSTRING@@QAEEPBDK@Z ?IsValueSet@ARGUMENT@@QAEEXZ

ifsutil

?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@0@Z ?QueryFileSystemName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@PAJ1@Z ?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z ?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z ??0MOUNT_POINT_TUPLE@@QAE@XZ ?Initialize@MOUNT_POINT_MAP@@QAEEXZ ?SetAutochkTimeOut@VOL_LIODPDRV@@SGEK@Z ?PushEntry@AUTOREG@@SGEPBVWSTRING@@@Z ??1MOUNT_POINT_MAP@@UAE@XZ ??1DP_DRIVE@@UAE@XZ ?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z ?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@E@Z ??0DP_DRIVE@@QAE@XZ ??0MOUNT_POINT_MAP@@QAE@XZ ?IsFrontEndPresent@AUTOREG@@SGEPBVWSTRING@@0@Z ?IsVolumeDirty@IFS_SYSTEM@@SGEPAVWSTRING@@PAE@Z ?QueryAutochkTimeOut@VOL_LIODPDRV@@SGEPAK@Z

ntdll

RtlFreeHeap RtlAllocateHeap

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_43144a3ffa3a2a1542a510d57ea0dd93_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

msvcrt

kernel32

ulib

ifsutil

ntdll

generic