2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry
Size 4.1MB
Sample261020-138xeswxft
SHA256 2e5cbcfccdc187e2b3e05c44c421b6102ed252fc621c5fbf3b874a07d36048e8
MD5 43c15228525731f981d0c75a36d2233b
SHA1 d9c0c3f9b13c6f8074ec0766f24716d697bca841
SHA512 f5da0c0ea0baf1cd52f396aac3207c1e5c31bd75cdb154f723d5d781e7470cad8d93f94c257ef9d644814008443158b441949f53124993ea09c3e66d3f549f4f
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2Is:erOO53z48t7eUJF3noxDN4v
TLSH
T149166C11B6608631D473C231C591FA9DA5363C519B328ECB6386BE9DBFB23D19936332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry

File Explorer

2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry

.exe 4.1MB

2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry

IMPHASH c997d9e4f7bf98aca34adf373bd51c4f
SHA256 2e5cbcfccdc187e2b3e05c44c421b6102ed252fc621c5fbf3b874a07d36048e8
MD5 43c15228525731f981d0c75a36d2233b
SHA1 d9c0c3f9b13c6f8074ec0766f24716d697bca841
SHA512 f5da0c0ea0baf1cd52f396aac3207c1e5c31bd75cdb154f723d5d781e7470cad8d93f94c257ef9d644814008443158b441949f53124993ea09c3e66d3f549f4f
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2Is:erOO53z48t7eUJF3noxDN4v
TLSH
T149166C11B6608631D473C231C591FA9DA5363C519B328ECB6386BE9DBFB23D19936332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetReadFile InternetCrackUrlW HttpSendRequestW InternetQueryOptionW InternetOpenW HttpOpenRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetSetStatusCallbackW InternetQueryDataAvailable

kernel32

MultiByteToWideChar FindFirstFileW FreeLibrary CompareFileTime LoadLibraryW CopyFileW GetVersionExW CreateFileW GetProcAddress FindClose FindNextFileW GetFileTime GetFileAttributesExW CloseHandle FileTimeToLocalFileTime DeleteFileW WideCharToMultiByte FindResourceW LoadResource SizeofResource LockResource GetLastError ReadFile GetModuleFileNameW Sleep GetCurrentProcess GetModuleHandleW HeapAlloc HeapFree GetProcessHeap lstrlenW InterlockedIncrement InterlockedDecrement WaitForSingleObject CreateMutexA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FindResourceExW IsProcessorFeaturePresent RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW GetUserNameW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateGuid

msvcp100

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@_WDH@std@@2V0locale@2@A ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@D@std@@QBEDD@Z ??1_Container_base12@std@@QAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?classic@locale@std@@SAABV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr100

??0exception@std@@QAE@ABV01@@Z ??8type_info@@QBE_NABV0@@Z memmove memcmp _unlock_file strlen ungetc fgetpos _fseeki64 memchr fflush fgetc tolower fsetpos setvbuf memset _lock_file ??_V@YAXPAX@Z _purecall ??3@YAXPAX@Z memcpy_s fwrite fclose ??2@YAPAXI@Z fputwc ungetwc wcslen fgetwc wcscmp memmove_s _vscwprintf wmemcpy_s wcsnlen vswprintf_s iswspace _wsopen_s _close _time32 strtok_s _getpid strftime _gmtime32_s pow signal exit sprintf_s isspace atoi ispunct _localtime64 _time64 rand srand __CxxFrameHandler3 _CxxThrowException ferror fread _errno free malloc strerror ftell fprintf _fdopen fopen sprintf _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ fputc memcpy

user32

LoadStringA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_43c15228525731f981d0c75a36d2233b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_smoke-loader_vidar_wannacry

shlwapi

wininet

kernel32

advapi32

shell32

ole32

msvcp100

msvcr100

user32

generic