2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry
Size 25.0MB
Sample260730-d3tfeabb83
SHA256 d873393ba5d0b51bf49ae5b0501e705fe1ac3866d8273db8d670ba9f5afd3556
MD5 4c9ded8a736ab405c67cf15fced43f74
SHA1 a1bc9707789363ca202cda315725f53a2d38daea
SHA512 bb13dcee3285e1027d6aebd430c1e8b319f558e5db7a00836689961b53840f41731fb09cf9f1f4bf6585e243a55815fa965a567d64e0d0eb1dbf7654c0e60e53
SSDEEP 393216:1PXQpPd6SM6PXQpAfih/YX26RtdQe2cjgPd6SM6PXQpAfih/YX26RtdQe2cjg:ud6SLix8f+d6SLix8f
TLSH
T175479D22F6E48175C067C075CA96A7BAEB7175450B308AC727D48E6D3F33BE1963A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry

File Explorer

2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry

.exe 25.0MB

2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry

IMPHASH b4ce35d8bbe6970242b7f77f42650784
SHA256 d873393ba5d0b51bf49ae5b0501e705fe1ac3866d8273db8d670ba9f5afd3556
MD5 4c9ded8a736ab405c67cf15fced43f74
SHA1 a1bc9707789363ca202cda315725f53a2d38daea
SHA512 bb13dcee3285e1027d6aebd430c1e8b319f558e5db7a00836689961b53840f41731fb09cf9f1f4bf6585e243a55815fa965a567d64e0d0eb1dbf7654c0e60e53
SSDEEP 393216:1PXQpPd6SM6PXQpAfih/YX26RtdQe2cjgPd6SM6PXQpAfih/YX26RtdQe2cjg:ud6SLix8f+d6SLix8f
TLSH
T175479D22F6E48175C067C075CA96A7BAEB7175450B308AC727D48E6D3F33BE1963A321
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor
UPX dump on OEP (original entry point)
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1044268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

StartServiceCtrlDispatcherW CreateRestrictedToken AllocateAndInitializeSid OpenProcessToken CreateProcessWithLogonW CreateProcessAsUserW AdjustTokenPrivileges SetTokenInformation LookupPrivilegeValueW DuplicateTokenEx GetTokenInformation StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW SetSecurityInfo SetEntriesInAclW GetSecurityInfo LookupAccountSidW RegCloseKey RegCreateKeyExW ChangeServiceConfig2W ChangeServiceConfigW InitiateSystemShutdownW RegQueryValueExW RegSetValueExW RegDeleteValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteKeyW RegQueryValueExA RegOpenKeyExW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExA RegOpenKeyExA SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetNamedSecurityInfoW LookupAccountNameW GetUserNameW RegUnLoadKeyW RegLoadKeyW CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW CryptGetProvParam CryptEnumProviderTypesW CheckTokenMembership RegisterServiceCtrlHandlerW AbortSystemShutdownW SetServiceStatus ControlService DeleteService FreeSid

gdi32

GetBkColor DeleteObject SelectObject DeleteDC SetTextColor SetBkMode GetStockObject AddFontResourceW RemoveFontResourceW CreateSolidBrush BitBlt CreateCompatibleBitmap CreateCompatibleDC GetObjectW GetDeviceCaps Rectangle MoveToEx LineTo GetTextMetricsW Polyline CreateEllipticRgn CreatePen Ellipse SetPixel ExtTextOutW GetPixel CreateBitmap SetBkColor SetDIBits CreateFontW CreateRectRgn CombineRgn SelectPalette RealizePalette GetDIBits CreateDCW StretchBlt

kernel32

CreateNamedPipeA SetFilePointer DuplicateHandle CreatePipe CreateThread GetModuleHandleW lstrcmpi lstrcmp LocalFree GetVersionExW CreateMutexA WideCharToMultiByte CreateFileA GetFileSizeEx DeleteFileW VirtualFree TlsSetValue WriteConsoleW TlsGetValue GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW QueryPerformanceFrequency GlobalFree GlobalAlloc SetCurrentDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot SetEnvironmentVariableW ExpandEnvironmentStringsW GlobalMemoryStatusEx LockResource LoadResource SizeofResource FindResourceW GetExitCodeThread WaitForMultipleObjects GetCurrentThreadId RemoveDirectoryW SetEndOfFile FormatMessageW QueryPerformanceCounter SetConsoleWindowInfo GetLargestConsoleWindowSize GetVolumeNameForVolumeMountPointW SetFilePointerEx GetSystemTimeAsFileTime DefineDosDeviceW VirtualAlloc QueryDosDeviceW SetThreadPriority GetCurrentThread CopyFileW GetProcessTimes GetLogicalDrives WaitNamedPipeW GlobalMemoryStatus SleepEx MoveFileW MoveFileExW OpenThread TerminateThread SetSystemPowerState GetUserDefaultLCID RaiseException FileTimeToSystemTime SystemTimeToFileTime GetVolumeInformationW SetNamedPipeHandleState ReleaseSemaphore ResetEvent DisconnectNamedPipe lstrcpy lstrcpyn GetHandleInformation SetLocalTime SetEnvironmentVariableA GlobalAddAtomA GetFileAttributesExW DeleteVolumeMountPointW GlobalUnWire GlobalLock CreateHardLinkW VirtualProtect GetConsoleWindow SetConsoleScreenBufferSize AllocConsole GetFullPathNameW FileTimeToLocalFileTime LCMapStringA GetSystemInfo GetFileSize EnumResourceNamesW GetTempPathW LCMapStringW SetVolumeMountPointW SetVolumeLabelW FindFirstFileW GetLongPathNameW GetTimeZoneInformation LocalFileTimeToFileTime GlobalDeleteAtom Beep GetFileInformationByHandle SetFileAttributesW SetFileTime OpenEventW CreateNamedPipeW CreateMailslotW OpenMutexW CreateSemaphoreW OpenSemaphoreW CompareStringA GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetModuleFileNameA HeapCreate HeapSetInformation GetConsoleMode GetConsoleCP SetStdHandle GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter FlsAlloc FlsFree FlsSetValue FlsGetValue RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry LoadLibraryExW WriteFile GetShortPathNameW ConnectNamedPipe GetOverlappedResult CreateJobObjectW AssignProcessToJobObject ResumeThread GetExitCodeProcess TerminateJobObject GetCommandLineW GetVersion ReadProcessMemory LoadLibraryW WaitForSingleObject ExitProcess lstrcat GetModuleHandleA CreateDirectoryW CreateProcessW FlushFileBuffers FindFirstVolumeW DeviceIoControl FindNextVolumeW FindVolumeClose GetProcessAffinityMask HeapFree GetModuleFileNameW SearchPathW CreateFileMappingA OpenFileMappingA TerminateProcess UnmapViewOfFile GetEnvironmentVariableA SetErrorMode GetStdHandle GetProcessHeap TlsAlloc LoadLibraryA GetProcAddress CreateFiber ConvertThreadToFiber DeleteFiber SwitchToFiber GetLocaleInfoW GetCurrentProcess SetProcessWorkingSetSize Sleep GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentProcessId OpenFileMappingW GetLastError SetLastError CreateMutexW CreateEventW CreateFileMappingW MapViewOfFile GetCurrentDirectoryW SetEvent FreeEnvironmentStringsW OpenProcess ReleaseMutex lstrlen lstrcpynW lstrcatW lstrcpyW lstrcmpW lstrcmpiW FindNextFileW FindClose ReadFile CreateFileW CloseHandle MulDiv GetTickCount GetStartupInfoW FreeLibrary lstrlenW GetDiskFreeSpaceW CompareStringW

ntdll

RtlInitializeCriticalSection RtlDeleteCriticalSection RtlReAllocateHeap RtlSizeHeap RtlDecodePointer RtlEncodePointer RtlAllocateHeap RtlEnterCriticalSection RtlLeaveCriticalSection NtdllDefWindowProc_W

oleaut32

OleLoadPicture

setupapi

SetupDiClassNameFromGuidA SetupDiOpenClassRegKey SetupDiGetDeviceInfoListDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiClassGuidsFromNameW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiClassNameFromGuidW SetupDiEnumDriverInfoW SetupDiGetDriverInfoDetailW SetupDiBuildDriverInfoList SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiChangeState SetupDiSetClassInstallParamsW SetupDiDestroyDeviceInfoList

cfgmgr32

CM_Get_DevNode_Status CM_Request_Device_EjectW CM_Query_And_Remove_SubTreeW CM_Get_Device_IDW CM_Get_DevNode_Status_Ex CM_Get_Parent CM_Reenumerate_DevNode CM_Locate_DevNodeW

shell32

SHGetSpecialFolderPathW SHChangeNotify SHAppBarMessage SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW SHFileOperationW DragAcceptFiles ShellExecuteExW SHGetSpecialFolderPathA DragQueryFileW

shlwapi

StrPBrkW StrCmpIW StrCmpNA wnsprintfW StrStrA PathMatchSpecW StrToIntExW StrCpyNW StrStrW StrStrIW StrRChrW StrChrW StrCmpNW StrCmpNIA StrCmpNIW

user32

GetScrollRange SubtractRect GetIconInfo DrawEdge DrawFrameControl DrawFocusRect DrawIconEx GetFocus GetScrollPos GetActiveWindow CreateDialogParamW SetMenuItemBitmaps EnumWindows UpdateWindow SetCapture ReleaseCapture ShowCursor GetWindowInfo ScrollWindow ChildWindowFromPointEx CreateIconFromResource GetScrollInfo WindowFromPoint IsChild DestroyCursor CreateIconIndirect FindWindowExW DrawIcon SetMenu CreateMenu SetWindowRgn FindWindowW LoadStringA CharUpperA IsWindowVisible GetClipboardData SwitchToThisWindow GetClassNameW IsWindowEnabled CreateIconFromResourceEx MessageBoxW IsRectEmpty EnumChildWindows PtInRect OpenClipboard EmptyClipboard SetClipboardData CloseClipboard SetCursorPos FindWindowExA GetForegroundWindow AttachThreadInput IsDialogMessageW GetSysColor CopyImage LoadCursorW SetCursor GetWindowThreadProcessId SetScrollInfo SetScrollPos SetScrollRange SetFocus GetWindowDC IsIconic GetMessageW DialogBoxParamW RegisterClassExW LockWorkStation ExitWindowsEx mouse_event EnumDisplayDevicesW ChangeDisplaySettingsExW DialogBoxIndirectParamW SetParent BeginPaint EndPaint GetWindowLongPtrW SetLayeredWindowAttributes GetMenu GetMenuItemCount LoadMenuW RemoveMenu InsertMenuW InvalidateRect GetDlgItemTextW EndDialog FillRect RedrawWindow CallWindowProcW GetKeyState EnumDisplaySettingsW GetSubMenu GetMenuItemID GetMenuStringW ModifyMenuW UnregisterHotKey RegisterHotKey PostMessageW SendMessageW SetTimer KillTimer LoadImageW DestroyCursor MsgWaitForMultipleObjects UnhookWindowsHookEx SetWindowsHookExW GetAsyncKeyState PostQuitMessage CallNextHookEx GetKeyboardState keybd_event RegisterDeviceNotificationW SendMessageTimeoutW CharUpperW IsWindow ScreenToClient GetWindowTextLengthW OffsetRect OpenDesktopW SetThreadDesktop SwitchDesktop CloseDesktop GetCursorPos CreatePopupMenu TrackPopupMenu DestroyMenu wsprintfA LoadStringW AppendMenuW RegisterClipboardFormatW FindWindowA GetLastInputInfo PeekMessageW TranslateMessage DispatchMessageW SystemParametersInfoW WaitForInputIdle GetSystemMenu EnableMenuItem GetWindowLongW SetWindowLongW GetClientRect wsprintfW DrawTextW GetSystemMetrics ShowScrollBar EnableWindow GetDesktopWindow SetActiveWindow SetForegroundWindow BringWindowToTop GetWindowTextW SetWindowTextW ClientToScreen MoveWindow CreateWindowExW SetWindowLongPtrW GetDlgCtrlID GetParent LoadIconW ReleaseDC GetDC SetDlgItemTextW DestroyWindow GetDlgItem SetWindowPos ShowWindow GetWindowRect LoadBitmapW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry

advapi32

gdi32

kernel32

ntdll

oleaut32

setupapi

cfgmgr32

shell32

shlwapi

user32

version

generic