2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

General

Target
2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar
Size 3.7MB
Sample261113-tp87psdv5w
SHA256 3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad
MD5 1de29e1b40e18031f34062bbb027a837
SHA1 0d4d7614188389d6785f078841ecf764bcdace70
SHA512 a3ff935b263bfe4d4bbc94f13cdd9ad03ab3dafe733abe472aa99eba76047d8edbc39a2aac6d005bc0d619a4c97cba52eb95f20c49b77fc32382c0d6ab3d2937
SSDEEP 49152:mnxXHul7f31zTeQ2JuXJkGYYZTk+T1iH7efPjrCotzDAuC:4e7fFngu4M6efPjXe
TLSH
T13306BF4AFBC6A677D83E063684662314A3B4F4454B56C7AB6AD0BB3D1C323D06E253CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

File Explorer

2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

.exe 3.7MB

2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

IMPHASH 9771ee6344923fa220489ab01239bdfd
SHA256 3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad
MD5 1de29e1b40e18031f34062bbb027a837
SHA1 0d4d7614188389d6785f078841ecf764bcdace70
SHA512 a3ff935b263bfe4d4bbc94f13cdd9ad03ab3dafe733abe472aa99eba76047d8edbc39a2aac6d005bc0d619a4c97cba52eb95f20c49b77fc32382c0d6ab3d2937
SSDEEP 49152:mnxXHul7f31zTeQ2JuXJkGYYZTk+T1iH7efPjrCotzDAuC:4e7fFngu4M6efPjXe
TLSH
T13306BF4AFBC6A677D83E063684662314A3B4F4454B56C7AB6AD0BB3D1C323D06E253CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects encrypted or obfuscated .NET executables

Digest

ad:a2:bd:43:34:e2:9d:1d:89:bd:13:87:f1:e2:b1:57:f6:42:ff:88:04:a4:98:b6:7f:0c:77:f2:b2:5c:0f:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=363504,CN=MINUTEMAN PRESS INTERNATIONAL\, INC.,O=MINUTEMAN PRESS INTERNATIONAL\, INC.,L=Farmingdale,ST=New York,C=US,1.2.840.113549.1.9.1=#0c11776f726c646871406d706968712e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 6, 2026

SERIALNUMBER=363504,CN=MINUTEMAN PRESS INTERNATIONAL\, INC.,O=MINUTEMAN PRESS INTERNATIONAL\, INC.,L=Farmingdale,ST=New York,C=US,1.2.840.113549.1.9.1=#0c11776f726c646871406d706968712e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Minor OS version

1

Major OS version

5

Entry point

5293

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb

mscoree

CorBindToRuntimeEx

kernel32

GetModuleFileNameA DecodePointer SizeofResource LockResource LoadLibraryW LoadResource FindResourceW GetProcAddress WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile CreateFileW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP CloseHandle HeapAlloc HeapFree FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap

oleaut32

VariantInit SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy VariantClear SafeArrayAccessData

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar

mscoree

kernel32

oleaut32

generic