2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry
Size 2.5MB
Sample260818-adyr2sed42
SHA256 553ff2c04a7d3eed7b6533d036bceaa7942290bdfced74a0e25634c7b81e6925
MD5 9b39f58931d9c5d5e4755bee50ebe4da
SHA1 22138f7904e09c8a9763bf44ad5a7e6d12b6d85d
SHA512 ec6b44c0cefc68171b2f222f495deb4bdfdf8155096ae8e34c28e8d8f9cac7bf9d9fa5890b3a5f78ae2db1a81a0de798a1631fad58abcf83aded9752113d9637
SSDEEP 49152:NoMl8D1Ssmb4dHzxDVO88UKqAsadP0QiPzEz0AVISNT1JtMyu:NoMl8D1jmb2zxA/UKI+P0PQQAVIxR
TLSH
T1FBC5E026F2554076D07242B08596A67AC334BD61033195DB93C0DE29BFB7AD3EA3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

File Explorer

2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

.exe 2.5MB

2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

IMPHASH 02a9c3810ff5453d372b495c1db94607
SHA256 553ff2c04a7d3eed7b6533d036bceaa7942290bdfced74a0e25634c7b81e6925
MD5 9b39f58931d9c5d5e4755bee50ebe4da
SHA1 22138f7904e09c8a9763bf44ad5a7e6d12b6d85d
SHA512 ec6b44c0cefc68171b2f222f495deb4bdfdf8155096ae8e34c28e8d8f9cac7bf9d9fa5890b3a5f78ae2db1a81a0de798a1631fad58abcf83aded9752113d9637
SSDEEP 49152:NoMl8D1Ssmb4dHzxDVO88UKqAsadP0QiPzEz0AVISNT1JtMyu:NoMl8D1jmb2zxA/UKI+P0PQQAVIxR
TLSH
T1FBC5E026F2554076D07242B08596A67AC334BD61033195DB93C0DE29BFB7AD3EA3A733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_DEBUG_STRIPPED

PDB paths

iphlpapi

GetNetworkParams

ws2_32

WSAEventSelect WSAGetLastError WSAStartup accept bind closesocket connect gethostbyname htonl htons inet_addr ioctlsocket listen recv send socket

advapi32

RegCloseKey RegCreateKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateEventA CreateFileA CreateFileMappingA CreateMutexA CreateThread ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindAtomA FindClose FindFirstFileA FindNextFileA FreeLibrary GetAtomNameA GetCommandLineA GetCurrentThreadId GetDriveTypeA GetFileSize GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount GetTimeZoneInformation GetVersionExA GetWindowsDirectoryA GlobalAlloc GlobalFree InterlockedIncrement LoadLibraryA MapViewOfFile OpenProcess ReadFile ReleaseMutex ResetEvent SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WinExec WriteFile lstrcatA lstrcmpA lstrcpyA lstrcpynA lstrlenA

msvcrt

_fdopen _fileno _fstat _isatty _strdup _write __getmainargs __mb_cur_max __p__environ __p__fmode __set_app_type _assert _cexit _ctype _errno _iob _isctype _onexit _pctype _setmode _strnicmp _vsnprintf abort atexit atoi fclose fflush fgetc fopen fprintf fread free fscanf fseek ftell fwrite getc getenv isdigit islower localeconv malloc memchr memcpy memmove memset puts rand realloc rewind setlocale setvbuf signal sprintf srand strcat strchr strcmp strcoll strcpy strftime strlen strncpy strstr strtod strtol strtoul strxfrm toupper ungetc

shell32

ShellExecuteA

user32

CharLowerA CloseWindow FindWindowA MessageBoxA wsprintfA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_9b39f58931d9c5d5e4755bee50ebe4da_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

iphlpapi

ws2_32

advapi32

kernel32

msvcrt

shell32

user32

generic