2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry
Size 9.1MB
Sample261020-w42saagx9p
SHA256 452ea1ca21bf3c8cabe77df78e173f4358bc87332d1fc7568c9f37d0ba22a99b
MD5 63ee56c0cde4ac098a4991820c415da9
SHA1 501c628778957678588a4395444800fe67b6c95f
SHA512 322d9ee23f97e42df2128bd47b80eb7e84c08a896622ed76c91617f01d1f401c2d0299c9f9de91c13099357e7eff4dbb67e333f0b1d9183dbabdfb3d6b6560d3
SSDEEP 196608:NoMl8D1jv1A/koMl8D1jMf2S9+ULdNPtbuPZOOmnqogHh/G:k2Y2SlLdNPt6ROOmqZA
TLSH
T133A6BE2EE745C076C5260172C859A2F6D66DFC20D3258BC77388FF19BB716C36A36262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

File Explorer

2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

.exe 9.1MB

2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

IMPHASH 02a9c3810ff5453d372b495c1db94607
SHA256 452ea1ca21bf3c8cabe77df78e173f4358bc87332d1fc7568c9f37d0ba22a99b
MD5 63ee56c0cde4ac098a4991820c415da9
SHA1 501c628778957678588a4395444800fe67b6c95f
SHA512 322d9ee23f97e42df2128bd47b80eb7e84c08a896622ed76c91617f01d1f401c2d0299c9f9de91c13099357e7eff4dbb67e333f0b1d9183dbabdfb3d6b6560d3
SSDEEP 196608:NoMl8D1jv1A/koMl8D1jMf2S9+ULdNPtbuPZOOmnqogHh/G:k2Y2SlLdNPt6ROOmqZA
TLSH
T133A6BE2EE745C076C5260172C859A2F6D66DFC20D3258BC77388FF19BB716C36A36262
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_DEBUG_STRIPPED

PDB paths

iphlpapi

GetNetworkParams

ws2_32

WSAEventSelect WSAGetLastError WSAStartup accept bind closesocket connect gethostbyname htonl htons inet_addr ioctlsocket listen recv send socket

advapi32

RegCloseKey RegCreateKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateEventA CreateFileA CreateFileMappingA CreateMutexA CreateThread ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindAtomA FindClose FindFirstFileA FindNextFileA FreeLibrary GetAtomNameA GetCommandLineA GetCurrentThreadId GetDriveTypeA GetFileSize GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount GetTimeZoneInformation GetVersionExA GetWindowsDirectoryA GlobalAlloc GlobalFree InterlockedIncrement LoadLibraryA MapViewOfFile OpenProcess ReadFile ReleaseMutex ResetEvent SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WinExec WriteFile lstrcatA lstrcmpA lstrcpyA lstrcpynA lstrlenA

msvcrt

_fdopen _fileno _fstat _isatty _strdup _write __getmainargs __mb_cur_max __p__environ __p__fmode __set_app_type _assert _cexit _ctype _errno _iob _isctype _onexit _pctype _setmode _strnicmp _vsnprintf abort atexit atoi fclose fflush fgetc fopen fprintf fread free fscanf fseek ftell fwrite getc getenv isdigit islower localeconv malloc memchr memcpy memmove memset puts rand realloc rewind setlocale setvbuf signal sprintf srand strcat strchr strcmp strcoll strcpy strftime strlen strncpy strstr strtod strtol strtoul strxfrm toupper ungetc

shell32

ShellExecuteA

user32

CharLowerA CloseWindow FindWindowA MessageBoxA wsprintfA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_63ee56c0cde4ac098a4991820c415da9_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry

iphlpapi

ws2_32

advapi32

kernel32

msvcrt

shell32

user32

generic