2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry
Size 4.3MB
Sample261020-yk91navvez
SHA256 38be443865a1b5b1f1d203799ff8e615571f0c22259fdfdec9bed66baf9029ab
MD5 5734b0b052e4bb63c5e8d9a2ef9b0472
SHA1 f9c98134c59a225640b87bbd7d99980bfd2a26f7
SHA512 f02ec5afaf67e07c118f53f92c6f4de921bad452f305071da40ea6c56d2b7efe480b06d7c49842cd9c6cea5ea57eb753b24782bbe07502ff241b497d1eabb593
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTcvRpYq6Qf:erOO53z48t7eUJF3noxDNy64
TLSH
T163266D11B6608572D433C231C591FA9DE5367C509B328E8B2385BE9EBFB27D19936332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry

File Explorer

2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry

.exe 4.3MB

2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry

IMPHASH c997d9e4f7bf98aca34adf373bd51c4f
SHA256 38be443865a1b5b1f1d203799ff8e615571f0c22259fdfdec9bed66baf9029ab
MD5 5734b0b052e4bb63c5e8d9a2ef9b0472
SHA1 f9c98134c59a225640b87bbd7d99980bfd2a26f7
SHA512 f02ec5afaf67e07c118f53f92c6f4de921bad452f305071da40ea6c56d2b7efe480b06d7c49842cd9c6cea5ea57eb753b24782bbe07502ff241b497d1eabb593
SSDEEP 49152:erOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTcvRpYq6Qf:erOO53z48t7eUJF3noxDNy64
TLSH
T163266D11B6608572D433C231C591FA9DE5367C509B328E8B2385BE9EBFB27D19936332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetReadFile InternetCrackUrlW HttpSendRequestW InternetQueryOptionW InternetOpenW HttpOpenRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetSetStatusCallbackW InternetQueryDataAvailable

kernel32

MultiByteToWideChar FindFirstFileW FreeLibrary CompareFileTime LoadLibraryW CopyFileW GetVersionExW CreateFileW GetProcAddress FindClose FindNextFileW GetFileTime GetFileAttributesExW CloseHandle FileTimeToLocalFileTime DeleteFileW WideCharToMultiByte FindResourceW LoadResource SizeofResource LockResource GetLastError ReadFile GetModuleFileNameW Sleep GetCurrentProcess GetModuleHandleW HeapAlloc HeapFree GetProcessHeap lstrlenW InterlockedIncrement InterlockedDecrement WaitForSingleObject CreateMutexA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FindResourceExW IsProcessorFeaturePresent RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW GetUserNameW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateGuid

msvcp100

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@_WDH@std@@2V0locale@2@A ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@D@std@@QBEDD@Z ??1_Container_base12@std@@QAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?classic@locale@std@@SAABV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr100

??0exception@std@@QAE@ABV01@@Z ??8type_info@@QBE_NABV0@@Z memmove memcmp _unlock_file strlen ungetc fgetpos _fseeki64 memchr fflush fgetc tolower fsetpos setvbuf memset _lock_file ??_V@YAXPAX@Z _purecall ??3@YAXPAX@Z memcpy_s fwrite fclose ??2@YAPAXI@Z fputwc ungetwc wcslen fgetwc wcscmp memmove_s _vscwprintf wmemcpy_s wcsnlen vswprintf_s iswspace _wsopen_s _close _time32 strtok_s _getpid strftime _gmtime32_s pow signal exit sprintf_s isspace atoi ispunct _localtime64 _time64 rand srand __CxxFrameHandler3 _CxxThrowException ferror fread _errno free malloc strerror ftell fprintf _fdopen fopen sprintf _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ fputc memcpy

user32

LoadStringA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_5734b0b052e4bb63c5e8d9a2ef9b0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_smoke-loader_vidar_wannacry

shlwapi

wininet

kernel32

advapi32

shell32

ole32

msvcp100

msvcr100

user32

generic