2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry
Size 4.1MB
Sample261026-qdvy6ad151
SHA256 e213116a6eb80e80f79d9ee2e562a1dbd51b1cd6e6fd0e75c982782163ea002e
MD5 c3e40d9d3810de25e7257f1cb97acec8
SHA1 a1eed5339542e098ee8f2ffa33ea3f3b834c9fc7
SHA512 e6a8fba21588576ff8e7f862b06917e72051ae7cf8bc3246124a8abd13444b1c6a7589b03eb4a5da16e9c2312c4e72d4bf61c0d174aca5bf8bcc1146cd06c678
SSDEEP 98304:N94wkAjSOTjNfs+utdr5Jq2MUrqNY1TK90DJo:N9/Thfsd1Jq2MUrqNSi
TLSH
T1CC16BF02FAD1C5B6C1AB06344AB6AB194A7AEB910730CBE7379CB81C5F316D03D79359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry

File Explorer

2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry

.exe 4.1MB

2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry

IMPHASH ca693519786fae7cdeb8d7cc3391106b
SHA256 e213116a6eb80e80f79d9ee2e562a1dbd51b1cd6e6fd0e75c982782163ea002e
MD5 c3e40d9d3810de25e7257f1cb97acec8
SHA1 a1eed5339542e098ee8f2ffa33ea3f3b834c9fc7
SHA512 e6a8fba21588576ff8e7f862b06917e72051ae7cf8bc3246124a8abd13444b1c6a7589b03eb4a5da16e9c2312c4e72d4bf61c0d174aca5bf8bcc1146cd06c678
SSDEEP 98304:N94wkAjSOTjNfs+utdr5Jq2MUrqNY1TK90DJo:N9/Thfsd1Jq2MUrqNSi
TLSH
T1CC16BF02FAD1C5B6C1AB06344AB6AB194A7AEB910730CBE7379CB81C5F316D03D79359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessA SetFileAttributesA CopyFileA Sleep CloseHandle GetFileSize CreateFileA GetWindowsDirectoryA GetCommandLineA WriteFile DeleteFileA GetExitCodeProcess WaitForSingleObject SetFilePointer CreateMutexA FindClose FindNextFileA FindFirstFileA PeekNamedPipe GetStartupInfoA CreatePipe GetModuleHandleA GetLastError GetLogicalDriveStringsA ReadFile GetDriveTypeA

user32

DispatchMessageA TranslateMessage TranslateAcceleratorA GetMessageA LoadAcceleratorsA PostQuitMessage MessageBoxA BeginPaint EndPaint DefWindowProcA wsprintfA DestroyWindow CreateWindowExA LoadIconA LoadCursorA RegisterClassExA LoadStringA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA

shell32

ShellExecuteA

msvcrt

_CxxThrowException _endthread fclose fwrite fseek fopen fread __dllonexit _onexit ??1type_info@@UAE@XZ _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv ??2@YAPAXI@Z __p__fmode __set_app_type _except_handler3 _controlfp __CxxFrameHandler memmove exit _beginthread ??3@YAXPAX@Z rename __p__commode

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ?_Xlen@std@@YAXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

ws2_32

htons inet_addr socket inet_ntoa gethostbyname WSAStartup closesocket recv send connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_c3e40d9d3810de25e7257f1cb97acec8_amadey_darkgate_elex_glassworm_redline-stealer_remcos_smoke-loader_wannacry

kernel32

user32

advapi32

shell32

msvcrt

msvcp60

ws2_32

generic