2026-09-30_08bf94f7ae29e5656fa9aaf27928a98b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_vidar_wannacry
Multi-malware dropper with evasion
Disables Task Manager and Command PromptHuge binary with minimal imports
SHA-2564129b2f7abf4c4aa0761169a367804c1e2c0ba2e754dc6412158ee4b332919c9
Evidence
0x1e146e646ffff6ffff77735c43757272656endo....ws\Curren
0x1e247456657273696f6e5c556e177374616ctVersion\Un.stal
0x1e346c5c65198cedb7440e6b657932300000l\e....D.key20..
0x1e449f0f580c28992016175fb021cd09752b..X.(. .._.!..u+
0x1e54135c20b8e76812aa25372343f20a79ec.\ ..h..%7#C..y.
0x1e643e003f3832901c923f503f0124af9017>.?82...?P?.$...
0x1e74643ff33eff1f800c2d4d6f7270686575d?.>....-Morpheu
0x1e847320322ef8ff8692300a174e57495345s 2.....0..NWISE
0x1e942e455845fbdb7f4e23114d7920536861.EXE...N#.My Sha
0x1ea45f6420466f6c646213ba67410fc95100_d Foldb..gA..Q.
0x1ed4098375367068a819291ebb1191f49a68..u6ph..)......h
0x1ee4b40ff8ba04e1c226239ff858204f1520.......&#..X O.
0x1ef4b22d38f0dc64ec48762198405f4cf04c.-8..d.Hv!.@_L.L
0x1f043248d7233ceb0fc285cd3f07736f66742H.#<.....?.soft
0x1f14775c58066f78330985234c731b64697aw\X.ox3..#Ls.diz
0x1f2433040c0bcd074455768b3fbc969c9d7c3.....DUv.?....|
0x1f34001b0872e17d882547bdd8bfb24f9f06...r.}.%G....O..
0x1f445af2b6414b07b101a3d0cfdcbacc180dZ..AK...........
0x1f548433f68d2955c13e9c6ec6fe2c40f441.3..)U.>.n..,@.A
0x1f64dba0081f8546675e0762034a391a0510.....Fg^.b.J9...
0x1f749682d88737040f7ec36b2f681042574a....7..~.k/h.BWJ
0x1f848a7790f0f06822f767ee215848cd2020.w...h".g.!XH.
0x1f940db49b41 ...A
⋯7 more rows
0xe0f0360035003200620066003500630033006.5.2.b.f.5.c.3.
0xe100300038003000350035006400610039000.8.0.5.5.d.a.9.
0xe11082d2500072006500730065006e007400..P.r.e.s.e.n.t.
⋯15 more rows
⋯7 more rows
0x39189dcccccccccccccccccccccccccccccccc................
0x3918ad657870616e642033322d62797465206bexpand 32-byte k
0x3918bd657870616e642033322d62797465206bexpand 32-byte k
0x3918cd03000102070405060b08090a0f0c0d0e................
⋯15 more rows
⋯3 more rows
0xbddb406765745f4b6579007365745f4b657900get_Key.set_Key.
0xbddb504372656174655375624b65790044656cCreateSubKey.Del
0xbddb606574655375624b6579004772616e7446eteSubKey.GrantF
⋯9 more rows
0xbddc00744b6579004973496e7075744b657900tKey.IsInputKey.
0xbddc1052656d6f766542794b65790052656769RemoveByKey.Regi
0xbddc20737472794b6579007265676973747279stryKey.registry
0xbddc304b6579006765745f7475726b65790067Key.get_turkey.g
⋯6 more rows
0xbddca02e43727970746f677261706879006765.Cryptography.ge
0xbddcb0745f6974616c79006765745f41737365t_italy.get_Asse
0xbddcc06d626c7900456d626564646564417373mbly.EmbeddedAss
0xbddcd0656d626c790047657443616c6c696e67embly.GetCalling
⋯8 more rows
⋯3 more rows
0xbfb184740061007400650020006f006e000015t.a.t.e. .o.n...
0xbfb194440069007300610062006c0065004300D.i.s.a.b.l.e.C.
0xbfb1a44d004400001d4e006f0043006f006e00M.D...N.o.C.o.n.
0xbfb1b4740072006f006c00500061006e006500t.r.o.l.P.a.n.e.
0xbfb1c46c00001f4e006f0046006f006c006400l...N.o.F.o.l.d.
0xbfb1d4650072004f007000740069006f006e00e.r.O.p.t.i.o.n.
0xbfb1e47300000b4e006f00520075006e000023s...N.o.R.u.n..#
⋯8 more rows
0xbfb27463006900650073005c00530079007300c.i.e.s.\.S.y.s.
0xbfb284740065006d00001d4400690073006100t.e.m...D.i.s.a.
0xbfb29462006c0065005400610073006b004d00b.l.e.T.a.s.k.M.
0xbfb2a467007200002944006900730061006200g.r..)D.i.s.a.b.
0xbfb2b46c006500520065006700690073007400l.e.R.e.g.i.s.t.
0xbfb2c47200790054006f006f006c007300000fr.y.T.o.o.l.s...
0xbfb2d463006d0064002e006500780065000007c.m.d...e.x.e...
0xbfb2e42f004300200000295500740069006c00/.C. ..)U.t.i.l.
0xbfb2f4690074006900650073002e0052007500i.t.i.e.s...R.u.
0xbfb3046e0043006f006d006d0061006e006400n.C.o.m.m.a.n.d.
0xbfb31400152f00730065006c00650063007400../.s.e.l.e.c.t.
0xbfb3242c0020002200001d6500780070006c00,. ."...e.x.p.l.
0xbfb3346f007200650072002e00650078006500o.r.e.r...e.x.e.
0xbfb34420002200004931003300370030003900 ."..I1.3.7.0.9.
⋯15 more rows