2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry
Size 4.3MB
Sample261020-mgpd1aba89
SHA256 9cab82a157fc7b0006d29cddfa33bde270d6a1186ecec1f6e95edd296e75a9fc
MD5 b81492b6b817044ecb5637a53ea38ce5
SHA1 aa0358a8805949956a428c9fee147600669ce713
SHA512 fde1f953327031225d678e6d7446460cb368406530ee5ab15a591684ca1000e2ff24d5aefc72487eba1aa938b1e4f62a31e722b6632a12929fe5c94104b09a14
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTSfU4UjwEr:erOO53z48t7eUJF3noxDNcfUbtYa
TLSH
T156268E11B6608531D47282318951FA9DA53A7D209B328E8F73C5BE9EBFF12D15A37332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry

File Explorer

2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry

.exe 4.3MB

2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry

IMPHASH c997d9e4f7bf98aca34adf373bd51c4f
SHA256 9cab82a157fc7b0006d29cddfa33bde270d6a1186ecec1f6e95edd296e75a9fc
MD5 b81492b6b817044ecb5637a53ea38ce5
SHA1 aa0358a8805949956a428c9fee147600669ce713
SHA512 fde1f953327031225d678e6d7446460cb368406530ee5ab15a591684ca1000e2ff24d5aefc72487eba1aa938b1e4f62a31e722b6632a12929fe5c94104b09a14
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTSfU4UjwEr:erOO53z48t7eUJF3noxDNcfUbtYa
TLSH
T156268E11B6608531D47282318951FA9DA53A7D209B328E8F73C5BE9EBFF12D15A37332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetReadFile InternetCrackUrlW HttpSendRequestW InternetQueryOptionW InternetOpenW HttpOpenRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetSetStatusCallbackW InternetQueryDataAvailable

kernel32

MultiByteToWideChar FindFirstFileW FreeLibrary CompareFileTime LoadLibraryW CopyFileW GetVersionExW CreateFileW GetProcAddress FindClose FindNextFileW GetFileTime GetFileAttributesExW CloseHandle FileTimeToLocalFileTime DeleteFileW WideCharToMultiByte FindResourceW LoadResource SizeofResource LockResource GetLastError ReadFile GetModuleFileNameW Sleep GetCurrentProcess GetModuleHandleW HeapAlloc HeapFree GetProcessHeap lstrlenW InterlockedIncrement InterlockedDecrement WaitForSingleObject CreateMutexA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FindResourceExW IsProcessorFeaturePresent RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW GetUserNameW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateGuid

msvcp100

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@_WDH@std@@2V0locale@2@A ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@D@std@@QBEDD@Z ??1_Container_base12@std@@QAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?classic@locale@std@@SAABV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr100

??0exception@std@@QAE@ABV01@@Z ??8type_info@@QBE_NABV0@@Z memmove memcmp _unlock_file strlen ungetc fgetpos _fseeki64 memchr fflush fgetc tolower fsetpos setvbuf memset _lock_file ??_V@YAXPAX@Z _purecall ??3@YAXPAX@Z memcpy_s fwrite fclose ??2@YAPAXI@Z fputwc ungetwc wcslen fgetwc wcscmp memmove_s _vscwprintf wmemcpy_s wcsnlen vswprintf_s iswspace _wsopen_s _close _time32 strtok_s _getpid strftime _gmtime32_s pow signal exit sprintf_s isspace atoi ispunct _localtime64 _time64 rand srand __CxxFrameHandler3 _CxxThrowException ferror fread _errno free malloc strerror ftell fprintf _fdopen fopen sprintf _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ fputc memcpy

user32

LoadStringA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_b81492b6b817044ecb5637a53ea38ce5_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader_vidar_wannacry

shlwapi

wininet

kernel32

advapi32

shell32

ole32

msvcp100

msvcr100

user32

generic