2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry
Size 4.7MB
Sample261020-wldmqscf49
SHA256 4f3a227213a1e81ae60378f0df57330606d7cc39bf22efe0765688375f932500
MD5 66a6c685681208d64c78ebd55188666e
SHA1 40c459478ecf7d83d01a8ee214a6372dd05ae561
SHA512 06a9a537e37b7e9555e51b9c41d67255e6ec708a4927b922804e4560734d5deaaea730dbcb9066af841216edeffd290899a9089575a8d2499b6d0024c2269223
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTQS7PLjeTn:erOO53z48t7eUJF3noxDNX7PLM3
TLSH
T10C368E11B7A08571D47382318991BA99E5367C119B328E8F23C57E9EBFB23D15E36332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry

File Explorer

2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry

.exe 4.7MB

2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry

IMPHASH c997d9e4f7bf98aca34adf373bd51c4f
SHA256 4f3a227213a1e81ae60378f0df57330606d7cc39bf22efe0765688375f932500
MD5 66a6c685681208d64c78ebd55188666e
SHA1 40c459478ecf7d83d01a8ee214a6372dd05ae561
SHA512 06a9a537e37b7e9555e51b9c41d67255e6ec708a4927b922804e4560734d5deaaea730dbcb9066af841216edeffd290899a9089575a8d2499b6d0024c2269223
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTQS7PLjeTn:erOO53z48t7eUJF3noxDNX7PLM3
TLSH
T10C368E11B7A08571D47382318991BA99E5367C119B328E8F23C57E9EBFB23D15E36332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetReadFile InternetCrackUrlW HttpSendRequestW InternetQueryOptionW InternetOpenW HttpOpenRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetSetStatusCallbackW InternetQueryDataAvailable

kernel32

MultiByteToWideChar FindFirstFileW FreeLibrary CompareFileTime LoadLibraryW CopyFileW GetVersionExW CreateFileW GetProcAddress FindClose FindNextFileW GetFileTime GetFileAttributesExW CloseHandle FileTimeToLocalFileTime DeleteFileW WideCharToMultiByte FindResourceW LoadResource SizeofResource LockResource GetLastError ReadFile GetModuleFileNameW Sleep GetCurrentProcess GetModuleHandleW HeapAlloc HeapFree GetProcessHeap lstrlenW InterlockedIncrement InterlockedDecrement WaitForSingleObject CreateMutexA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FindResourceExW IsProcessorFeaturePresent RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW GetUserNameW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateGuid

msvcp100

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@_WDH@std@@2V0locale@2@A ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@D@std@@QBEDD@Z ??1_Container_base12@std@@QAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?classic@locale@std@@SAABV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr100

??0exception@std@@QAE@ABV01@@Z ??8type_info@@QBE_NABV0@@Z memmove memcmp _unlock_file strlen ungetc fgetpos _fseeki64 memchr fflush fgetc tolower fsetpos setvbuf memset _lock_file ??_V@YAXPAX@Z _purecall ??3@YAXPAX@Z memcpy_s fwrite fclose ??2@YAPAXI@Z fputwc ungetwc wcslen fgetwc wcscmp memmove_s _vscwprintf wmemcpy_s wcsnlen vswprintf_s iswspace _wsopen_s _close _time32 strtok_s _getpid strftime _gmtime32_s pow signal exit sprintf_s isspace atoi ispunct _localtime64 _time64 rand srand __CxxFrameHandler3 _CxxThrowException ferror fread _errno free malloc strerror ftell fprintf _fdopen fopen sprintf _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ fputc memcpy

user32

LoadStringA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_66a6c685681208d64c78ebd55188666e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_smoke-loader_vidar_wannacry

shlwapi

wininet

kernel32

advapi32

shell32

ole32

msvcp100

msvcr100

user32

generic