General
- Target 2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry
- Size 25.0MB
- Sample260730-d3tfeabb83
- SHA256 d873393ba5d0b51bf49ae5b0501e705fe1ac3866d8273db8d670ba9f5afd3556
- MD5 4c9ded8a736ab405c67cf15fced43f74
- SHA1 a1bc9707789363ca202cda315725f53a2d38daea
- SHA512 bb13dcee3285e1027d6aebd430c1e8b319f558e5db7a00836689961b53840f41731fb09cf9f1f4bf6585e243a55815fa965a567d64e0d0eb1dbf7654c0e60e53
- SSDEEP 393216:1PXQpPd6SM6PXQpAfih/YX26RtdQe2cjgPd6SM6PXQpAfih/YX26RtdQe2cjg:ud6SLix8f+d6SLix8f
- TLSH T175479D22F6E48175C067C075CA96A7BAEB7175450B308AC727D48E6D3F33BE1963A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry
- Size 25.0MB
- SHA256 d873393ba5d0b51bf49ae5b0501e705fe1ac3866d8273db8d670ba9f5afd3556
- MD5 4c9ded8a736ab405c67cf15fced43f74
- SHA1 a1bc9707789363ca202cda315725f53a2d38daea
- SHA512 bb13dcee3285e1027d6aebd430c1e8b319f558e5db7a00836689961b53840f41731fb09cf9f1f4bf6585e243a55815fa965a567d64e0d0eb1dbf7654c0e60e53
- SSDEEP 393216:1PXQpPd6SM6PXQpAfih/YX26RtdQe2cjgPd6SM6PXQpAfih/YX26RtdQe2cjg:ud6SLix8f+d6SLix8f
- TLSH T175479D22F6E48175C067C075CA96A7BAEB7175450B308AC727D48E6D3F33BE1963A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables built or packed with MPress PE compressor
-
UPX dump on OEP (original entry point)
-
AutoIT Executable
AutoIT scripts compiled to PE executables.