2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader
Size 5.5MB
Sample260805-ystcwavepb
SHA256 a199dd261b92e399a882985e258290155dc2f4cf506b490d3479e4345eaa2182
MD5 f63343e9170782659d2bd4dc44ed2796
SHA1 5cb6c995bc56e6bdb4a27f597d48e6f596dd3ca4
SHA512 7a862571e07b6c0a278b46ec44bc07e5cf57fc02b7e8b198f911a822ff55af9eb823b32f33b58fa38d479c0016d769ca7ea91630ea9e38eb1a4fc95e8e3120e7
SSDEEP 98304:f+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWu:mmAE9695ta1xPpPVo
TLSH
T11E463A15F6B88722D0B3D079C9E6AB5AFA323C451B3086CB1245B76C2E377D19936732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader

File Explorer

2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader

.exe 5.5MB

2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader

IMPHASH 2938fa2df7e806927b9ad495b8f205f3
SHA256 a199dd261b92e399a882985e258290155dc2f4cf506b490d3479e4345eaa2182
MD5 f63343e9170782659d2bd4dc44ed2796
SHA1 5cb6c995bc56e6bdb4a27f597d48e6f596dd3ca4
SHA512 7a862571e07b6c0a278b46ec44bc07e5cf57fc02b7e8b198f911a822ff55af9eb823b32f33b58fa38d479c0016d769ca7ea91630ea9e38eb1a4fc95e8e3120e7
SSDEEP 98304:f+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWu:mmAE9695ta1xPpPVo
TLSH
T11E463A15F6B88722D0B3D079C9E6AB5AFA323C451B3086CB1245B76C2E377D19936732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\toolkit\components\maintenanceservice\maintenanceservice.pdb

kernel32

SetStdHandle WriteConsoleW MoveFileW CreateToolhelp32Snapshot Process32NextW Process32FirstW WriteFile GetDriveTypeW GetTempFileNameW GetProcAddress GetCurrentProcess TerminateProcess GetExitCodeProcess LoadLibraryExW FreeLibrary DeleteFileW LocalAlloc SetLastError MultiByteToWideChar GetFileAttributesW CopyFileW LocalFree CreateFileW ReadFile CreateProcessW GetFileSize CreateThread CloseHandle lstrcmpiW CreateEventW GetLastError GetModuleFileNameW Sleep SetEvent MoveFileExW WaitForSingleObject CreateDirectoryW LCMapStringW CompareStringW HeapReAlloc OutputDebugStringW GetConsoleCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode RtlUnwind GetStringTypeW SetEnvironmentVariableW SetEnvironmentVariableA RaiseException GetCPInfo GetCommandLineW EncodePointer DecodePointer ExitProcess GetModuleHandleExW WideCharToMultiByte HeapFree HeapAlloc GetFileAttributesExW GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP SetEndOfFile

user32

LoadStringA wsprintfW

advapi32

DeleteService OpenServiceW SetServiceObjectSecurity OpenSCManagerW CloseServiceHandle CreateServiceW RegisterServiceCtrlHandlerW OpenSCManagerA QueryServiceStatusEx AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext CryptGetHashParam CreateWellKnownSid GetSecurityDescriptorDacl RegSetValueExW RegCloseKey QueryServiceConfigW ControlService BuildExplicitAccessWithNameW RegOpenKeyExW FreeSid SetEntriesInAclW ChangeServiceConfigW QueryServiceStatus LookupAccountSidW ChangeServiceConfig2W QueryServiceObjectSecurity SetSecurityDescriptorDacl StartServiceCtrlDispatcherW SetServiceStatus InitializeSecurityDescriptor

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringA CryptMsgGetParam CryptMsgClose

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathAppendW PathStripToRootW PathQuoteSpacesW PathUnquoteSpacesW PathRemoveFileSpecW

ole32

CoCreateGuid

rpcrt4

UuidToStringW RpcStringFreeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_f63343e9170782659d2bd4dc44ed2796_amadey_bkransomware_cloudeye_darkgate_elex_icedid_maze_njrat_rhadamanthys_smoke-loader

kernel32

user32

advapi32

crypt32

wintrust

version

shlwapi

ole32

rpcrt4

generic