2026-08-08_31631a40e80f203244ebbd3ff53185ec_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_rhadamanthys_stop_vidar

resource
2026-08-08_31631a40e80f203244ebbd3ff53185ec_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_rhadamanthys_stop_vidar

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/.data	nsis_installer_2

IMPHASH b1a57b635b23ffd553b3fd1e0960b2bd
SHA256 529466311e9e335d9e1e6a286c53e4c2cda6b498aa585cfd38f13bd86aebb05b
MD5 31631a40e80f203244ebbd3ff53185ec
SHA1 46aa91bf0105823badb06a290ec38dd064c562c1
SHA512 c0061f2166f2201985fb57449395c20ba8b142546d8198918f01933beb0bb71d187b1e00af5cb728c59b44f56747625430a708b8aaa58691ac458917195885f6
SSDEEP 49152:gOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJf5O2k56rnqatglE:9pGfQJdXN0B7+sithO+rjn
TLSH
T188E57B1A76D889B5E07B413489668316D672BC311F3193CF63909A3D2F736D19E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA Sleep lstrcmpiA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetCommandLineA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

.data

SHA256 4a63c7ca63538039a0213c12377fc6b0d36530bb0eecc9d4d24728c851334352
MD5 75d996f724e5e900c022f56b3df3ae1b
SHA1 7b247661a46a3527556a9637ece6c600bf6777ec
SHA512 51b05dce03e28316e85e20cbac2bd746b38a61e4e3926b0220b212fd30a8d7ce70d999fb8580b02a3c0479ceda6c1e6a06bf54bb4855752fc069bdcf27a39ceb
TLSH
T12131214B73668065F28153F81C9F192A4A863BCD9BE0F4174AB258B525BB80B1B3F1A5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rdata

SHA256 3575075347d3cfff06e9f5c296d8c71c30f2fbcc62228eef437e236010397471
MD5 4c84e530bf8db37146334e6c487170bf
SHA1 076dcc532f1c101e21550e104a20a7f8e4c30781
SHA512 e8c06cb81e698ea12a4dc8470af98c74c2a21456d6d602bc686d472ea804630a6c456171938eabbb06448b43f500f2e8b299be513aa06e5de617518cfc5d2ce1
SSDEEP 96:OeejZRTq5Woxp8HqeejZR/2a18fY0UUZRhsAGlk4xbSO7sfB:CjjHox3jvj1+UEXGRxbRsfB
TLSH
T14C91A55610E91DEFC1D7473A36B7EE2E4D77C0E9812901801BB8A14B6F6A10782693D2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

.rsrc/0/version.txt

SHA256 3c7cd26bab116c8e0fec339ac6d21b5b34ce72a993bf3eb2024024646068c665
MD5 d46177434da9ca1497f22e8d36e8999b
SHA1 a2b4865fb77ebea35e9bb37f380d0a2133293cfc
SHA512 c9bf6b1e10daf68232b16a0d369a925034defaa5abcb3fdf499ea5c82e067a83524c5eaed540345076885999fad853e2d8b1126b6b7db13973a9f690a9454fe4
TLSH
T1A611060BA0F7219890A7B6894FEA883643633D01043DD61E98CC7F4D4FC300115027F7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/BITMAP/110.bmp

SHA256 5ac685bb79e6fe75e6e54b9fd4e9524d8da6bc8acb269f50c42bf372af671570
MD5 60d2a10c7daac29b36ca1c303f13d0a2
SHA1 20d4acba22f5f106bbef22fa3e70166fff9fb9b6
SHA512 c56f59c8ec1dc653cc69953ebdde2786e0fb6e327d34b9c3107f50a3302e9c709733156e29b52b1ce4fe7352585a11a5b8c62843608746422ab5f6d2d2d3a0e3
TLSH
T17031722ABA5FB08CDF90507159F8E878816937FD9B8FC9BB4024C515DDE60C91F92485
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/102

SHA256 b29c7a1301ddb0e896faf944d8ea8f4e57ff4f3d5fc3e5dc5bf3e64ed6be2fdd
MD5 7add80697358fcc3e63354d269ea5ac9
SHA1 72c0a1363b9b4fee0a4acb42b31cd9b5e0664c4c
SHA512 c0826f21e262803b7eebf016d5db7234dcd8016d47f6e61ab12a4e724eade3ffce99013048d94ea8fbf85019d2ed5ceee72fff13550ee49abccbb0126c649a32
TLSH
T156C092A012DAC5A9EC448430BF8ACA63A623B802415CA687BAC4136B4512E08CD25296
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/103

SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA512 4f0c2d1b5ebbb6760c43b9369dd90fdac6ab5e2280db9288ba9eb106642b4aa7076cb942718ae9f93cc97af79de1ef85d07e2aa4823a882956d46f5e03ff0872
TLSH
T180D08C4583D2DF95E4048C382AFECBF33A3570411624948BFD04AB637020A30EE660E9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/104

SHA256 a9915b533449c6415914dcb0688c8a67906bbf6391e466668723132a9f8f95fe
MD5 8787162f2e6ba74c06cadcf17b68f0c5
SHA1 7d83ee04bbcb75a6be4b1f3fff07120e694175cb
SHA512 e2664f0520e9ddf25500d9757b1a6f76f44652ea8fa34b41842713251dd3faf56340efa18d3da3386179300a467786a67c5705739b5b0889a4ddf5da96c13c0e
TLSH
T1F9E0220447C1CD1CF02C94302BEBC7DF2033B0420820007BFDA857130024A0CDBB91C4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/105

SHA256 15663576584c947d634dab9848defcc7d8f05eb0b7e7c6d52d81eca695fc7a6e
MD5 d1a92272fbd597e1aa19021483110d5a
SHA1 9f75072682b37c6c52361d8c988ebd06dd003f63
SHA512 367ebf76b9e39454afc064094b82df47177e533b3532dc24eb92aa6b5ec6393f228337cb093a73eb2f05516fed200d4a26fc74b9588fca19b0ff352736c4dd99
TLSH
T1D7F0EC596744C41BE00D4B7847E2C3E77633B01816482A53FF89B38B9550EDCFD2DA86
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/106

SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA512 d97885f9c2846a042ec3c0d01a756d22fda7a989d55cd61efbc945abcdcfd74ca0284c745cf8bebf2d2fab82718f7b57ab0b701f67d2319ca6b5f55bce663c07
TLSH
T118D0800987D0C068F4704C34643BC5672914F5420C1471CFBDD583BB0824D00EF76241
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/107

SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023
MD5 6ffba239dcfcab2080195f23947b70aa
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843
SHA512 93ff2629f63c0600d9169a650b56c2c61eee210b5be7302201de9cca378e10eae85e922b6c2241462ca3abe063fbcdd6183a6e9d6136560eacaf20ede5b2285b
TLSH
T1E0C0126007DBC07DF8044030AEEACBB3B113B080013C5473BD2553531014904CF29282
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/111

SHA256 18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01
MD5 5dfa289639a3bcc0497da8db163f01fe
SHA1 6e2c6ea1e2594b66f563fb589276642c127e875f
SHA512 e281e9122569c837f11bdde960f4cf3f6000e82eea6288c5337d9e5c69c078989d1d4d8a1956cac0b6a4506250f406e77576a96ae6772e77d472a01640d42314
TLSH
T12DD012553AE6C50CF5B52DB1BEB2E2D71331F810D530C66F6AC0220D00F5900C919B86
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/GROUP_ICON/103

SHA256 fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584
MD5 e624f041c921d299a6da3a8c5f48f989
SHA1 ffa07c86ac3dac45398ee07b26610dfb5c99d8ea
SHA512 67e0f898f0fdfc20871764af8cd456154f7f4b6c3051199b27c543f9ed64d4778d1a757e1a99b762d00c32fb241befc4c22349d670b2a4098c8131bf7b8e50a7
TLSH
T1B9B01201530C5609C2EC0F34004E0772C018C00442B23503011F01646D031201A34E40
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/1.ico

SHA256 b3a2423d5af7c9ecb031a29356c5119a0cbfab9c5a031911c1772916dc1a6a2b
MD5 a29f586089277845ba16743f7ecc546a
SHA1 5795b1799aa016aec63588b35423925d808f35a3
SHA512 6dff9e49d30e9939b259bb851995f102485453bc55c44501e2026784f796bef8a30e34fab9c25fb47fff1313c51024d8e403412e15fb89f7bb05c1a72638737e
SSDEEP 96:Ze0JchdssNrPZkpdg6SeXovDDpNs9sGkwByxz8rKU:40JMmMFkk8uDbs9sTwAVO
TLSH
T1CE912961B10C50E8D77C1974DA8F9F010752CD7AC2B4A8C81586B6A3F8936AF0E142FF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

.rsrc/1033/ICON/2.ico

SHA256 36285e644ece9f2a0b42c904bd6981c3c469812d863c6677fe1f0a815de0bb05
MD5 3472aeec6c50324e54387cdf8cbfe71b
SHA1 0feb3e6d46ec92dfe8af92992da899102207b1d5
SHA512 7f789b077d93875619434dfae2d9355a6787cbd9df321413043a472f793050869bcc31076891cd62e923786199c8d4a50053090fe5d364fc863c3d03fa50fd77
TLSH
T10E71095183C8AD9DC05C5275EC2FCEBC1DB60DA26C0B53EF1B616D0F64E8B21E49806A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/3.ico

SHA256 016d625739e775bc54414046cdda6d31de30ef5a0a9af082a89788ac89751cf6
MD5 0564972525aee23d55da38f2855bd051
SHA1 d7bfd8360dc7d3633ae9d62c1042d21374a1b3fa
SHA512 6f73cb555fc565295836f43214bff062a0bc458aaed27b8c81bf2fa2e3493a9f139f2c3204bf178d89cc363c471bdcf524734a47ceea82cb16a4edea74e91ad5
TLSH
T1F441E8D71B76C1F4FC060A74624B1F1B60AAA6E27409F5D071A7250B0D36AF906E10BC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/4.ico

SHA256 b977d7ab97ace15cbbf70934f431e50ada5643934ee202eb7596bdff79176d57
MD5 5d5e478a195a134e8cf19f47b566d23d
SHA1 d1fdcfad42b86db87b5c706be70a6109dd95bba0
SHA512 a83767f010cf129e51b2859dfdb9b84b1dc21158dcd5dc419516bd6c15a46605c7668f0a88ebe5a1e833e57a8f080b8fcf52c5ff1b1cefc7b8518e600e177ad8
TLSH
T1F921B5643150F4AAC3230EF0C633376EA251A401C9B1676385C81180BE1565E3C73994
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/5.ico

SHA256 97d818940b8a6c62bdd1f660b347412ccb3567f76b22e085d97f1a357c34d46a
MD5 0edb91dbde07a5657ad3413b4c0b05ec
SHA1 79311cd7d5347542b4e77cb3e0f892208b19bb3d
SHA512 d996440fd251c166b4d7d7537ff728d963998754961fc2ff159ceec377c30b6475f3d2d5a54c8a2c78942c6dfbe3104c6847b050a905ebd4c34029fbc0c97595
TLSH
T16E2165D59500A584C4BF843480036E206693F512C0EC3DD289D092971D7E997B179376
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/6.ico

SHA256 a06e4a7bab17b9067fee43944cca2eacad4cabd461906ffb9cda415fd853fd2f
MD5 edca8ea50d0dd7a3e76b1fd367bc57da
SHA1 74031001f9323865e14750275acc735a19d0df60
SHA512 eeb2ed5673b273ecfe5c538e15c1d3a9d1afe3ab308ff4800ad741d720b20a109f2e136327df12fde3c14f26651b180b417c1e7b5ffaa8efe6908e9044a54eee
TLSH
T1CA01EC1B250883ADEDDC0A37CFA7A7BCAC2045775950C973D593FB9B58602123F4286E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/7.ico

SHA256 a39018c66ae35d18c5a5aa47a5ae51d8cce7d5f5a94fefacb05187e3ac847adc
MD5 49405ca061a889ac0f715438006b573a
SHA1 81e84f9b35b77983a2776a20118ebd0f2a2ed6d5
SHA512 29329d8f387bbc63e1e8a3787038aa1a7ee9297a89a2208c727007d20bd5eaf99437837f59bec775f8e2728f58533594846fe77c99ea10bd22b055adb5c1523a
TLSH
T109E05E133016C4A8E06D40BDC92BCBAC48002C57B4836353AAF1FE8FBC30125EB959D4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/MANIFEST/1

SHA256 5ab55ea1740dfd7dbd3104bc63e3c22f2c7ced0ac1b58e0be2535573d55f8402
MD5 9c3b88e938f953ecc735c511d7a8facc
SHA1 0d23fc04046aa1fea468a9007ec9909c44667045
SHA512 c45b734c321b0a2d32115ce5a8ac2b6191c519631653e166b58d1c47bfc44f5676ca2392ea401ebbed519e028f610d1b06249c073f18f2a588d9b8b57f7671c7
TLSH
T15A111481D054E526E71202E33E75F55C15BEA32B04CC46EDC4C2D97EA7477CA87421A1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc_1

SHA256 40d06ba2c266c1a8f37ebf6d015de6993179241afaa9994b703f84ca6889bd9a
MD5 3fa5c5b9d110eb4177172fdc81cbcb2b
SHA1 043002b0653c42060928c5ccdc306f64816e182d
SHA512 f78d531e5719f133a111b4b23598cbb32507371275aee500513d6bcaf1ad36018528443cb389288f4e0ac6806b9137e575ea0b822d1314cea5a44bfec7a83408
MD5 SHA1 SHA512

NSIS installer

installer

.text

SHA256 3f5f7b309092988af8c9e92567926a5e523cad3af0051c20bdf29aad00a33510
MD5 51e2544a6971f687f7a1241f613014c1
SHA1 1dc9b7d6bb158fee5b9f3b28181b389987a1c350
SHA512 ba80c630fc92ccca498fc0158ad1bb3713e1e43d84064e3d23ceac251e312f496ce4cb09f2408460aae384f8603959793e0a146018b671fb47a18facfc88a9a4
SSDEEP 384:rhBMNBJCQ4xKSV68YqH6r96WQPdcYVvjjCWz533t3s49RMR7UZrGhmxhjfeQLGyO:rHxbDnYqH656WQ1cYVvjn93t3s4H21k9
TLSH
T102B27E3635D0C4B3EA635AB18EF5A3F5F3FB92000222BA9B57605FB574301D6D90A507
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

[0]

SHA256 76028d808ac50154cccc407d464f42196c52d39c9801b8a3a83425cc5211765c
MD5 4d50b03b482c3a7f8f0925b416f3724f
SHA1 9d7be4731aa7c0a20819a91be853c5e4ed138d61
SHA512 5742ef71a1c136a770644e75932428a0d14dbd6067f1b20d413d93bfe67e3ba9779406ddae3839c12a9dcb0c9d0487add15981695c0b92e532d0a814cfd54b8f
SSDEEP 49152:/pL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJf5O2k56rnqatglE:/pGfQJdXN0B7+sithO+rjn
TLSH
T180D56B1A76E849B5E07B413489668216D672BC311F3193CF63909A3D2F736D19E3AF23
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer