2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry
Size 15.8MB
Sample260924-11btxatarc
SHA256 24f81441ad693464a8ec9cb27f867578128e3885749a137539af1249b5e7eb3b
MD5 cde4890e3281042437cde7994b986e98
SHA1 ea496ac8d274173520b717ea1cd53ce1121bd269
SHA512 5e51358a601941dc14b002fd533bdf495390f1240a5fcc74c84727fe5b0ecb92db27c95e8d812c49e040e722db56122a0430b8be096411626eb234e7702287e4
SSDEEP 393216:b3foCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzhZ:bPRkdObGXYztU5eyAzH
TLSH
T1F5F6AE11FBC300B0F663527185AAD33BC63B7A114532DDAFF74C9949BB33691592A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry
unpack001/$EXEDIR/OInstall.exe
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry

.exe 15.8MB
$EXEDIR/OInstall.exe

.exe 15.7MB
$PLUGINSDIR/INetC.dll

.dll 25KB
$PLUGINSDIR/nsExec.dll

.dll 7KB

2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 24f81441ad693464a8ec9cb27f867578128e3885749a137539af1249b5e7eb3b
MD5 cde4890e3281042437cde7994b986e98
SHA1 ea496ac8d274173520b717ea1cd53ce1121bd269
SHA512 5e51358a601941dc14b002fd533bdf495390f1240a5fcc74c84727fe5b0ecb92db27c95e8d812c49e040e722db56122a0430b8be096411626eb234e7702287e4
SSDEEP 393216:b3foCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzhZ:bPRkdObGXYztU5eyAzH
TLSH
T1F5F6AE11FBC300B0F663527185AAD33BC63B7A114532DDAFF74C9949BB33691592A32A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$EXEDIR/OInstall.exe

IMPHASH 4f5bd8c41170d44583a1b0a0ac96a54c
SHA256 2954dd074ed64fc3f99e84d4db4bd609aed6fd7e5c1e15353eb6d73ff6052c42
MD5 b7d95fe69642a95d87ef68947727413d
SHA1 83e0ddba434cc00d818c496599f4b1c0c2453a96
SHA512 a5eaf656349f5e2488101512eae902b92b7d23498b0435a4e6ca8efef2e5b81a81cc75273fa7ee9b014a2a786f293f5fc02db1e82450bc4c6821bb9bbc509b08
SSDEEP 393216:QfoCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzh:iRkdObGXYztU5eyAz
TLSH
T16CF6AE11FBC300B0F663527185AAD33BC6377A114532DEAFF74C9949BB33691592A32A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset setlocale wcsncpy wcslen malloc free memmove memcpy strncmp isdigit wcscmp wcscpy wcscat sprintf _wstat _wcsdup strcmp ??3@YAXPAX@Z ??2@YAPAXI@Z rand fwrite strncpy floor _CIcos _CIsin log10 _wfopen fseek fclose _CIfmod fread longjmp _setjmp3 _wcsnicmp _wcsicmp wcsncmp _snwprintf tolower localtime mktime _itow _wtoi gmtime abs sqrt fmod ftell pow wcsstr swscanf _close calloc _lseeki64 _errno realloc _snprintf abort _wopen _setmode exit wcschr _open_osfhandle _strdup strrchr wctomb _get_osfhandle _open toupper mbstowcs strchr frexp modf _CIpow fopen strerror atof fflush _vsnwprintf _onexit __dllonexit cos sin ceil

kernel32

GetModuleHandleW HeapCreate GetEnvironmentVariableW GetUserDefaultLangID HeapDestroy ExitProcess GetShortPathNameW Sleep GetCurrentThreadId CreateToolhelp32Snapshot CloseHandle GetCurrentProcess CreateProcessW GetExitCodeThread GetCurrentProcessId OpenProcess Process32FirstW Process32NextW GetLastError LocalFree SetLastError TerminateProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject DeleteCriticalSection TryEnterCriticalSection CreateThread TerminateThread HeapFree HeapAlloc MultiByteToWideChar GetModuleFileNameW SetEnvironmentVariableW DuplicateHandle CreatePipe GetStdHandle GetCommandLineW PeekNamedPipe GetExitCodeProcess ReadFile HeapReAlloc CreateFileW GetFileSize DeleteFileW WriteFile GlobalAlloc GlobalLock GlobalHandle GlobalUnlock GlobalFree lstrcpyA lstrcpynA FreeLibrary LoadLibraryExW GetProcAddress TlsAlloc TlsSetValue GetTickCount TlsGetValue LoadLibraryW WideCharToMultiByte GetVersionExW SetFileAttributesW GetDriveTypeW FindFirstFileW FindClose GetFileAttributesW CopyFileW GetTempPathW GetLongPathNameW FindNextFileW RemoveDirectoryW CreateDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW SetFilePointer MulDiv GetLocalTime TlsFree InterlockedCompareExchange InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetFileType GetFileInformationByHandle GetFileAttributesA CreateFileA GetFullPathNameW UnregisterWait GetCurrentThread RegisterWaitForSingleObject

user32

SetForegroundWindow GetKeyState OemToCharW GetSysColor GetDlgCtrlID CallWindowProcW SetWindowLongW GetWindowLongW GetClientRect FillRect GetClassNameW GetWindow SetWindowPos InvalidateRect FindWindowW BeginPaint EndPaint UpdateWindow SendMessageW GetCursorPos WindowFromPoint CallNextHookEx PeekMessageW TranslateMessage DispatchMessageW IsWindowEnabled RedrawWindow SetClassLongW GetClassLongW GetWindowRect OffsetRect IsRectEmpty MapWindowPoints SubtractRect IsWindow GetParent GetDC ReleaseDC DefWindowProcW GetAsyncKeyState KillTimer ScreenToClient SetTimer DrawTextW FrameRect InflateRect SetWindowsHookExW UnhookWindowsHookEx FindWindowExW DrawFrameControl GetWindowTextW MessageBoxW PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnableWindow EnumWindows wsprintfA LoadIconW RegisterClassExW CreateWindowExW DestroyWindow SystemParametersInfoW ShowWindow GetWindowTextLengthW GetSystemMetrics GetSysColorBrush SetRect SetPropW GetPropW RemovePropW SetWindowTextW GetIconInfo DrawStateW GetFocus DrawFocusRect ValidateRect ReleaseCapture SetCapture MoveWindow ClientToScreen LoadCursorW IntersectRect SetFocus GetUpdateRect SetScrollPos GetWindowDC SetCursor GetMessagePos GetScrollPos EnumPropsExW SetActiveWindow DestroyIcon IsZoomed IsIconic RegisterClassW AdjustWindowRectEx UnregisterClassW CreateAcceleratorTableW MsgWaitForMultipleObjects GetMessageW GetActiveWindow TranslateAcceleratorW GetMenu DefFrameProcW DestroyAcceleratorTable EnumChildWindows IsChild RegisterWindowMessageW EnumDisplayDevicesW EnumDisplaySettingsW DrawIconEx CopyImage CreateIconFromResourceEx CreateIconFromResource CharLowerW CharUpperW

gdi32

CreatePen CreateSolidBrush SelectObject DeleteDC DeleteObject CreatePatternBrush CreateRoundRectRgn GetPixel CreateCompatibleDC SelectClipRgn BitBlt GetStockObject RoundRect SetBkMode SetTextColor SetDCBrushColor SetBrushOrgEx CreateFontIndirectW GetTextExtentPoint32W SetBkColor CreateRectRgn GetObjectW GetObjectType CreateCompatibleBitmap OffsetViewportOrgEx SetViewportOrgEx ExcludeClipRect CreateRectRgnIndirect TextOutW MoveToEx LineTo CreateDCW CreateDIBSection GetClipRgn ExtSelectClipRgn GetDeviceCaps SelectPalette RealizePalette GetDIBits SetPixelV Rectangle Ellipse SetStretchBltMode StretchDIBits StretchBlt SetROP2 ExtFloodFill SetTextAlign GetTextMetricsW GdiGetBatchLimit GdiSetBatchLimit CreateBitmap SetPixel CreateFontW

advapi32

RegOpenKeyExW RegOpenKeyW RegConnectRegistryW RegQueryValueExW RegCloseKey RegDeleteKeyW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation LookupAccountSidW IsValidSid GetSidSubAuthorityCount GetSidSubAuthority CloseServiceHandle CreateProcessAsUserW DuplicateTokenEx GetLengthSid GetSecurityInfo ImpersonateLoggedOnUser OpenSCManagerW OpenServiceW QueryServiceStatus RegSetValueExW RevertToSelf SetSecurityInfo SetTokenInformation CryptAcquireContextW CryptGenRandom CryptReleaseContext

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree RevokeDragDrop

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFolderLocation

shlwapi

PathMatchSpecW

winmm

timeBeginPeriod

msimg32

AlphaBlend

gdiplus

GdipDeleteFont GdipDeleteGraphics GdipDeletePath GdipDeleteMatrix GdipDeletePen GdipDeleteStringFormat GdipFree GdipGetDpiX GdipGetDpiY

imagehlp

MapFileAndCheckSumW

uxtheme

SetWindowTheme

comctl32

InitCommonControlsEx ImageList_Replace ImageList_Add ImageList_ReplaceIcon ImageList_Remove ImageList_AddMasked ImageList_Destroy ImageList_Create ImageList_GetIconSize

Name

.code

Size

333KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

734KB

Virtual Size

733KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

'.text'

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14.4MB

Virtual Size

14.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.modplug

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/INetC.dll

IMPHASH 163fdad7b5f915e3a0ca7ad1d08b4ff8
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcpyW CreateThread LocalAlloc lstrcpynW SleepEx MulDiv GetModuleHandleW GetTickCount ReadFile CreateFileA CreateFileW GetFileSize lstrcmpiW lstrcatW LoadLibraryA lstrcmpW lstrlenA MultiByteToWideChar WriteFile lstrlenW CloseHandle GetLastError DeleteFileW GetProcAddress WideCharToMultiByte LocalFree TerminateThread GlobalAlloc GlobalFree SetFilePointer WaitForSingleObject

user32

wsprintfA FindWindowExW GetWindowLongW IsWindow CreateDialogParamW ShowWindow GetParent DispatchMessageW LoadIconW KillTimer PostMessageW IsDialogMessageW SetWindowPos SetWindowTextW GetMessageW SendDlgItemMessageW TranslateMessage EnableWindow RedrawWindow UpdateWindow GetWindowRect SendMessageW SetTimer SetWindowLongW wsprintfW SetDlgItemTextW GetDlgItem IsWindowVisible MessageBoxW GetClientRect DestroyWindow SystemParametersInfoW GetWindowTextW

comctl32

ord17

wininet

HttpSendRequestExW InternetErrorDlg InternetWriteFile HttpSendRequestW InternetSetFilePointer HttpAddRequestHeadersA FtpCreateDirectoryW InternetCrackUrlW FtpOpenFileW InternetSetOptionW InternetOpenW InternetGetLastResponseInfoW HttpEndRequestW InternetReadFile HttpAddRequestHeadersW HttpQueryInfoW InternetCloseHandle InternetConnectW InternetQueryOptionW HttpOpenRequestW

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$EXEDIR/OInstall.exe

msvcrt

kernel32

user32

gdi32

advapi32

ole32

shell32

shlwapi

winmm

msimg32

gdiplus

imagehlp

uxtheme

comctl32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic