2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

General

Target
2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar
Size 3.7MB
Sample261110-rl11tabs6v
SHA256 267cf6fcb7fa36ceb1972dc907050427eb60e516fb0f65c75134b5a0631c58c7
MD5 82818b20e7d508359d82fdda5034b71f
SHA1 9277fe3e6908befdb682eeab77dcc442a9c0a46d
SHA512 3cbeb6455330a679c2f009ca84b1b779e0d20cdda3389b0ad55ab7208bac85becc43f3e675fe30a1db28069373c31fb9804ef8ba958d5ab1fc71a7a6ba771620
SSDEEP 49152:oAUrgszC/lMKByJ/Q0yHlJkGYYZTk+T1iH7efPcMwMLEeCKV:H2C/l6JieM6efPcMLoM
TLSH
T1DD06C04AFBC6A677C53F063584B57314A7B0B8454762C7AB6AD0BB3E1C323D06E25389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

File Explorer

2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

.exe 3.7MB

2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

IMPHASH 9771ee6344923fa220489ab01239bdfd
SHA256 267cf6fcb7fa36ceb1972dc907050427eb60e516fb0f65c75134b5a0631c58c7
MD5 82818b20e7d508359d82fdda5034b71f
SHA1 9277fe3e6908befdb682eeab77dcc442a9c0a46d
SHA512 3cbeb6455330a679c2f009ca84b1b779e0d20cdda3389b0ad55ab7208bac85becc43f3e675fe30a1db28069373c31fb9804ef8ba958d5ab1fc71a7a6ba771620
SSDEEP 49152:oAUrgszC/lMKByJ/Q0yHlJkGYYZTk+T1iH7efPcMwMLEeCKV:H2C/l6JieM6efPcMLoM
TLSH
T1DD06C04AFBC6A677C53F063584B57314A7B0B8454762C7AB6AD0BB3E1C323D06E25389
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects encrypted or obfuscated .NET executables

Digest

d4:4e:f4:32:55:7d:be:8a:e4:78:03:ac:8d:f0:9a:33:e8:0b:d9:1b:81:3e:0b:e5:ba:a7:08:67:53:7e:35:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=363504,CN=MINUTEMAN PRESS INTERNATIONAL\, INC.,O=MINUTEMAN PRESS INTERNATIONAL\, INC.,L=Farmingdale,ST=New York,C=US,1.2.840.113549.1.9.1=#0c11776f726c646871406d706968712e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 6, 2026

SERIALNUMBER=363504,CN=MINUTEMAN PRESS INTERNATIONAL\, INC.,O=MINUTEMAN PRESS INTERNATIONAL\, INC.,L=Farmingdale,ST=New York,C=US,1.2.840.113549.1.9.1=#0c11776f726c646871406d706968712e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Minor OS version

1

Major OS version

5

Entry point

5293

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb

mscoree

CorBindToRuntimeEx

kernel32

GetModuleFileNameA DecodePointer SizeofResource LockResource LoadLibraryW LoadResource FindResourceW GetProcAddress WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile CreateFileW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP CloseHandle HeapAlloc HeapFree FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap

oleaut32

VariantInit SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy VariantClear SafeArrayAccessData

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

mscoree

kernel32

oleaut32

generic