vxunderground-inthewild · Index

2026-04-24_c3a3bb32e499ef2a89a88f49dadf5479_agent-tesla_amadey_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar May 6 vxunderground-inthewild

b39e99396123d09ecd9dfb605fc3604349d1e43507bbc86d834b3c7ec978a24e K(Li)O₉(CDy₃Er₂AlAsCo₂P₃PrXe)H₈(Os₁₈Cm₇Db₅F₁₂Hf₅Po₁₁TiU₄)Md₆(Bi₃BkPtSi₂)Th₂

85% Embedded malware dropper with keylogger

2026-04-25_6da6cc1ff9884b68a1399fb04e2fce30_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee May 6 vxunderground-inthewild

01517b879bb4ce9fb63af374209bfbde11306579b925fa60e3127b53efff52b1 O₂(As₃C)H₅(Cm₃DsF₃Os₃Po₄)Md₂(Bi₃)Th₂

100% Packed stealer with evasion and persistence

2026-04-24_f8269f13c854516858abf43c9c6afa41_elex_virlock May 6 vxunderground-inthewild

155e4e74146f1ec69e52817c909f24b96f4fe85a1ec0d06e3472c73a2c3c69a3 O(As)Md₂(Bi₂Si)

2026-04-25_2bed35a494d577b10b99143e899b5844_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

345437ba5caa63f905e209aef2e78e5ad809d01c556b19f27281a7d6fd745635 K(Am)O₈(As₂C₃ErAlCo₂DyPPr)H₈(Os₁₆Cm₇Db₃F₁₂Hf₅Mg₂Po₁₀U₄)Md₃(Bi₅Si₂)Th₃

100% Embedded malware with stolen signatures

2026-04-25_eb413f6f283e79c533b3e68b9a75a0d2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar May 6 vxunderground-inthewild

40125cbaa0686a5b1b861fb7703cf5d7af7e88cc20d7ac4ea3e445eef519438e K(Am)O₈(AsEr₃Al₂C₂Co₂DyP₂Pr)H₉(Os₁₈Cm₆CrDb₃F₁₃Hf₅Mg₂Po₁₀U₄)Md₅(Bi₃BkPtSi₂)Th₃

100% Hostile embedded PE with invalid cert

2026-04-25_08cd04e210744625b9ceffe324d9c094_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_vidar May 6 vxunderground-inthewild

6561f6ce60f33ee4f9870fe62c6f83808741c57c65fbcaa93a47a2d922591aba K₂(McAm₃)O₈(C₆CoEr₄I₅LaP₃Pr₃As₂)H₁₁(Cm₁₁CrDb₇DsF₁₅Hf₇Mg₃Os₂₈Po₁₂TiU₆)Md₇(Bi₉Bk₂PaPtSi₃)Th₃

99% Multi-stage dropper with AV evasion

2026-04-25_e1bc67363a8a770ea0e7d13d242ef54f_cobalt-strike_icedid_satacom_vidar_wannacry May 6 vxunderground-inthewild

6e6043d572fa0f93b136cd0c7c0115eb265226059441037dc15ae7ddb84ebff4 O₆(IAlAs₂C₂DyEr₂)H₆(Cm₂CrDb₂F₄OsPo₅)Md₂(Bi)

2026-04-25_a816d1f6ecc021f9a983cf1e0a09a1ee_amadey_coinminer_elex_smoke-loader_stop May 6 vxunderground-inthewild

9101dbac0b727c43866bebbbe49f27a5032d5f26a68e6b74d8b01fe179d02ce2 K(Li)O₄(Pr₂Er₃DyI)H₇(Cm₈CrDb₂FOs₆Po₉U₂)Md₂(Bi₂Pt)

2026-04-24_6089452a24416389c2e96c3e248ea5e7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry May 6 vxunderground-inthewild

9c2982a2a3579a76e19afded9cb44fcb2ea76c24478196ddae680fb3277fce23 K₂(AmLi)O₉(Al₃C₄ErAsCo₂Dy₅IP₂Pr)H₁₀(Os₁₈Cm₈Db₄DsF₁₀Hf₆MgPo₁₂TiU₄)Md₅(Bi₂BkSi₂)Th₃

85% Malware dropper with keylogger and evasion

2026-04-25_9de189d61470a426fabd770ce4ade8bd_destroyer_elex_glassworm_ngrbot_wannacry May 6 vxunderground-inthewild

dc3afa453c4d79884b7be98d3e1443d6efe17f378c6b771eef6b539dfa2eba55 K₃O₁₂(As₁₀C₁₆Ca₂EuI₁₁P₇CoDyEr₈Xe₃Al₂Pr)H₉(F₃HfCm₄CrMg₂Os₅Po₈Db₆U)Md₃(Bi₅Bk₂Si)

2026-04-25_6526a56cb86cf0347e7ba71fad580c10_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar May 6 vxunderground-inthewild

09aa82de07e2adbc1d46358356df2bf2093d93ae9845afd16ab7948018159bbd K(Am₂)O₅(C₂Er₅I₄LaAs₄)H₈(Cm₄Cr₂Db₆F₁₀Mg₂Os₁₆Po₁₀Ti)Md₆(Bi₁₁BkPaPtSi₃)Th

98% Multi-stage dropper with embedded malware

2026-04-24_d6eca2ad155f867a9eae9a30b576052d_elex_mafia_stealc_tofsee May 6 vxunderground-inthewild

5a0f4fd81afb729a3818c8fb9fb32bbbb828ea37669e759880b0db821916fc68 KO₈(As₁₀Dy₂Er₇AlC₃PSXe)H₇(Db₃F₃Os₃Po₃Cm₂CrDs)Md₃(Bi₇PaSi)Th

2026-04-24_3ca7ef6322559e210e65fbcbd45dea14_akira_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar May 6 vxunderground-inthewild

73caeb1be2982c088c86c93ee0f36579561529b795587854a2c9b0f7ab04fe7e O₇(As₅C₄AlIDyErPr)H₉(Cm₈Os₇Po₁₀Cr₈Db₂DsF₇Ti₂U)Md₄(Bi₃He₂Si₂)

2026-04-25_7007ec00ff463297d5775f8276265167_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar May 6 vxunderground-inthewild

fbb0a4be804fd65637787c0e7180e9f782cacf983a4ee49e3a2e9aba6d64c0f4 K₃(GaLiMc)O₇(C₃Er₂Dy₃EuIPPr)H₉(Cm₁₅Cr₁₀DbF₅Hf₂Os₁₄Po₁₃Ti₂U)Md₄(BiBk)

85% Spurdoverse loader with persistence and exfiltration

2026-04-24_8f4076b467d7ce36db62bb4ae5a43a3c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_fabookie_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_rhadamanthys_satacom_smoke-loader_vidar May 6 vxunderground-inthewild

a5e99e346c62a16349411a9614506810aa3816e59bc5b1706c97fddc861fb44d K₂(McAm)O₁₀(Al₆As₂C₄Er₃I₄Co₂Dy₃EuP₃Pr₂)H₁₁(Os₂₆Po₁₃Cm₁₃Cr₅Db₆DsF₁₃Hf₆Mg₃TiU₄)Md₆(Bi₅Bk₂PtSi₂)Th₃

85% Malware sample with embedded payloads

2026-04-24_ae213f42af4d7d64d19815fc531c7dee_elex_wannacry May 6 vxunderground-inthewild

c9be42c1180b55c55adbdb330ed1f8d07ebfcd8a86eae8c3f1f8354378e1d4e4 O₉(AlAs₈Er₄C₄Xe₂EuIP₃S)H₈(Cm₅DbF₃Po₅CrDsMg₂Os)Md₄(Bi₈HeSi)

2026-04-24_45f36f9d76832719b8816ab753ec2f1c_elex_mafia_stealc_tofsee May 6 vxunderground-inthewild

e82587bb6559826c733dc083a1b8c43c15ec421d754f01e9132b0c08c6eb59bd KO₇(As₉C₅Er₈Dy₂AlPXe)H₇(Db₂F₃Os₃Po₃Cm₂CrDs)Md₄(Bi₇PaSi)

2026-04-24_7252d34ebe9f12161342059151b1fc00_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar May 6 vxunderground-inthewild

18eeea9e291b0d428d02b27234f6034ca6a38f6e7d01fd4615d92ce01e5b7470 K(Li)O₅(AsCCoEuP)H₅(CmF₄HfOs₅Po₂)Md₂(Bi₃)

2026-04-25_999e68bdab7eff242ecf1ed095b8e0fe_amadey_coinminer_elex_smoke-loader_stop May 6 vxunderground-inthewild

20862ab90aea47145d92f5d89a21783b3aec857df5bab76d54b319fd33334363 O₆(Pr₂As₂Er₃AlCI)H₆(Cm₇Db₂FOs₇Po₁₀U)Md₂(Bi₂Pt)

2026-04-25_9519198ffcfa5ad01ba6e82078e3f8f5_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar_wannacry May 6 vxunderground-inthewild

39698edb83f50572a3293d32989942519cc2c3fd15a8c4e13a72c7263316c4e6 K(Mc)O₈(Er₃Al₄C₂Dy₂EuIP₂Pr₂)H₉(Po₈Cm₄CrDb₆F₅Hf₆MgOs₁₂U₂)Md₄(BiPt)Th

2026-04-25_42ae120740ec1f7dc80f47170b1d82a6_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar May 6 vxunderground-inthewild

5e6eed19a9efe2ecdb8e1a9f4cbf605aaf209b6c90c8ab6efec83bbf67d4297d K₂(AmLi)O₉(Al₅C₃Er₅As₂Co₃Dy₅I₂P₂Pr)H₁₁(Os₂₀Cm₉CrDb₅DsF₁₁Hf₆MgPo₁₃TiU₅)Md₅(Bi₄BkSi₂)Th₃

85% Multiple malware indicators and evasion techniques

2026-04-25_cf200ad1a9997763065bc340f1780dae_elex_wannacry May 6 vxunderground-inthewild

bbca149117d221d617a649a4d5f1b0a4b982f727cefdec540969b59ddcda0794 K(Mc)O₃(CEr₂P₂)H₆(Cm₃DbF₃MgOs₆Po₅)Md₂(Bi₄)Th

100% Storm DDoS bot with persistence

2026-04-24_1882e143f418a67afbdb651c7446b7bc_cobalt-strike_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

ca3af892e40277bfa86e22f65c49b50ea7ed6a143d67baf84f2244b0c247f300 K(Am₂)O₅(CLaEr₃I₂As₂)H₇(CmDbF₇MgOs₁₈Po₇U)Md₆(Bi₆PaPtSi₂)Th

97% Multi-stage dropper with ransomware strings

2026-04-25_d748685f4be75b389889356477efffec_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop May 6 vxunderground-inthewild

cb1255cb805ee7496f75ed0f50eea5b98e0d634fb28e8409417c04fc54aa0eae K₂(LiMc)O₇(Pr₂CEr₃AlAsEuI)H₈(Cm₈CrDb₂F₂HfOs₁₀Po₉U₂)Md₃(Bi₂Pt)

2026-04-25_61bc90688aea56b448748f6af44a4cf5_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_vidar May 6 vxunderground-inthewild

95766ffaeeb98b6222e0d5543b98eed9add0f37b3f1ab8e4aa5a0737d117add7 K₂(McAm)O₇(C₄AsErAlEuPPr₂)H₈(Po₈Cm₄Db₄F₆Hf₆MgOs₈U₂)Md₃(Bi₃Si₂)Th₂

100% Multi-PE bundle with malware strings

2026-04-25_79a46a067c755dca726e838af64e4b43_amadey_cobalt-strike_luca-stealer_njrat_satacom_vidar_wannacry May 6 vxunderground-inthewild

43b092582d721083504d7bcacd3a2b5e809f835aee3342e72e0d3d38c61c026f O₅(C₃I₂LaAsP)H₉(Cm₄Db₃F₁₅HfMgOs₁₅Po₁₀TiU₂)Md₄(Bi₇BkPaSi₂)

92% infection/filebinary/rewrite

2026-04-24_88f72880da9b87303cf6f95972b5ead4_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee May 6 vxunderground-inthewild

978b0bd0a5bb1450f3927a63f705af18e5ed13003a5a75fbc3f57d182e2b2a54 O₅(As₁₀AlC₄DyEr₃)H₆(OsDb₂Po₂CmDsF)Md₂(Bi₇Si)Th

2026-04-25_c5c155c4f0cb6bd33274bfb9e61f6ebf_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

7749ecd774325f31d20f9927f2ac2eb30c7f6586f3f73e6c39e6f186a17ec3c1 K₂(Am₄Li)O₆(C₂I₃Er₄As₃Dy₂Pr)H₁₁(Cm₁₄Cr₃Db₇DsF₁₄Hf₇Mg₃Os₃₂Po₁₇TiU₇)Md₈(Bi₁₀BkPaPt₂Si₃V)Th₃

100% Multi-stage dropper with malware payloads

2026-04-25_4b1ff68070cde45f9bc32e0b2a35e4e0_amadey_cobalt-strike_darkgate_hijackloader_luca-stealer_njrat_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

800de4826ca92aec44896d5a0e50811646fb95976e6e01d15d5ee95e6c1ec08c K(Am)O₄(CErI₃As₂)H₈(Cm₂Db₂F₄HfMg₂Os₈Po₁₀U)Md₆(Bi₉PaPtSi₂)Th

92% binary/rewriteversion-resource/security-vendor

2026-04-24_870687307688770dc49afd5c4c3e165d_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

df1d88995ad2e476360e08a9fe364729552c225c4caf6689c0725d5b94804ec1 K(Am)O₈(I₂AlCCo₂Dy₄ErP₂Pr)H₉(Cm₇Db₃F₁₄Hf₅Mg₂Os₂₁Po₁₃TiU₄)Md₅(Bi₂BkSi₂)Th₃

100% Malware dropper with ransomware and stealer components

2026-04-25_e1e7a1d9b404a602ed23e21ddd7cb21b_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry May 6 vxunderground-inthewild

e3994815a185f351696a3f9055a74f93c784074e6ce83c38074545c451c8cbf3 K(Li)O₆(IAl₂CDyP₂Pr)H₉(Cm₃CrDb₄F₅Hf₆MgOs₁₀Po₄U)Md₃(Bi)Th

2026-04-25_6f2a8cd38e7bb2273e3afa169ff9a3c2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_vidar May 6 vxunderground-inthewild

255e3c7995d40a5a974d345c2327f08e18883d3e3b5d1922e2fe71ad643c3711 K₂(AmLi)O₁₀(As₃C₃Dy₆Er₅Al₄Co₂IP₃PrXe)H₁₀(Os₂₁Cm₁₂Db₇DsF₁₃Hf₅MgPo₁₃TiU₄)Md₆(Bi₆Bk₂PtSi₂)Th₃

100% Multiple hostile indicators and embedded malware

2026-04-25_40d61aa97ca1ee887dfd3f36de9da508_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar_wannacry May 6 vxunderground-inthewild

37e768c9311bcb906cf5b64e7217e625b022eb0694ee49cb70b5cd797e8fa82c K₂(AmLi)O₁₀(C₄Dy₆Er₄Al₄As₂Co₂IP₃PrXe)H₉(Os₂₀Cm₉Db₅F₁₅Hf₅MgPo₁₄TiU₄)Md₆(Bi₅BkPtSi₂)Th₃

85% Stolen certs, keylogging, and embedded malware

2026-04-25_8124eb03fe5cbb52f80e9c6465d24edf_icedid_njrat_ryuk May 6 vxunderground-inthewild

924b785255aa3df7fae950a31065036a9c0212bb68600f685e6ace5fb7bcf98e O₁₁(As₁₂DyPr₂Al₂C₈CaCoEr₈I₃La₂P)H₉(Os₇Po₄Cm₆Cr₇F₅Ti₂DbDsMg)Md₅(Bi₈HeSi)

2026-04-24_cfc1662176b3294a843eceb58b3a0e9b_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader May 6 vxunderground-inthewild

a5cc416c5a5b54ac4f83276d2d26bcd03859d95d064924f2479ae756a15912dd KO₈(As₉C₆Er₅PrAl₂CoIP₂)H₆(Cm₃Db₂DsF₆Os₇Po₃)Md₃(Bi₇Si₂)Th₂

2026-04-25_867c9ab13a6deba21c38b05e9f3facb7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

ac76f488ce093784048386c8b757cda4b6b94278050c47b6907b8f2abe748b76 K(Li)O₆(C₂AlDyErP₂Pr)H₈(Cm₂Db₂F₆Hf₆MgOs₁₁Po₃U)Md₃(BiPt)Th

2026-04-25_2353889bf8fe737c7108a208dab381af_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar May 6 vxunderground-inthewild

ad06bdecaa56a5a48a8edbfa9f1f3af7e970fc9bcda9f876660bf4ce7ec05b87 K(Am₃)O₈(C₂LaEr₅I₃As₂DyPPr)H₁₁(Cm₁₀Cr₂Db₅DsF₁₅Hf₇Mg₃Os₂₉Po₁₃TiU₇)Md₇(Bi₇Bk₂PaPtSi₃)Th₃

100% Multi-stage dropper with embedded malware

2026-04-25_4c1498aa6aa6ebc6859944ba0308d182_amadey_cobalt-strike_darkgate_icedid_ryuk_satacom_smoke-loader_stealc_stop_vidar_xworm May 6 vxunderground-inthewild

e271d999523ed8a6e0d074f12381570e530c36181dcffa59b3c9a77186addd4f KO₁₃(As₂₁C₁₃Co₃Er₂₂P₅Al₄Dy₆I₇Pr₃CaEuSXe)H₁₀(Os₁₁Po₈Cm₁₂Db₅F₁₀Hf₂U₂CrDsMg)Md₅(Bi₈Si₃BkHe)

2026-04-24_a7326bbf206ac42153a00270856ebbb3_amadey_coinminer_elex_smoke-loader_stop May 6 vxunderground-inthewild

f783184dadc8eb36a9e012c662dc54956c3f44b70cdc4a633b568d4e55d5779f K(Li)O₄(Er₄Pr₂DyI)H₈(Cm₉CrDb₂FMgOs₆Po₉U₂)Md₂(Bi₄Pt)

85% Amadey coinminer with process injection

2026-04-25_db92ae907f6ca966bbf167e68cc56010_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_icedid_njrat_remcos_satacom_stealc_vidar May 6 vxunderground-inthewild

2999b30422b8ff635505c51094816641240db322e0e7af7d5f91a85eb682c9da K₂(McAm)O₇(C₄As₂ErAl₂Co₂EuPr₂)H₈(Os₁₆Po₁₀Cm₇Db₄F₁₃Hf₆MgU₄)Md₃(Bi₃Si₂)Th₃

85% Multi-PE bundle with malware strings and injectors

2026-04-25_14136c08901cfac131ffbd04acf86792_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_njrat_remcos_satacom_vidar May 6 vxunderground-inthewild

9516f395fd9a26e95a0ac33f078d77e4e8c6b687fa818d03bdc7fcb0b55d42b3 K(Am₂)O₅(CLaAs₃ErI)H₉(Cm₂DbDsF₁₀Hf₄MgOs₅Po₁₁U₂)Md₅(Bi₅PaPtSi₂)Th₂

100% Multi-stage dropper with embedded payloads

2026-04-25_f3794ffae4d451d7e1323f7cb4c533ab_akira_cloudeye_elex_hijackloader_rhadamanthys May 6 vxunderground-inthewild

b6755d0d70ca122b6f742defcfc5818fbad26dc67964e212277f5b7392deab4f K₃(McAmLi)O₃(I₂PAs₂)H₉(CmCrDb₂DsF₉MgOs₈Po₆U)Md₅(Bi₇BkPaSi₃)

99% Multi-stage dropper with embedded PEs

2026-04-25_6b846c5918dfb34d2c4ff10e77e15e7f_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

04028a75568063458db4f806ec84e9abc9a0208dc1efd534aa361b7c7c603c35 K₂(AmLi)O₉(Al₃As₂C₃Co₃Dy₅ErI₂P₂Pr)H₁₁(Os₂₁Cm₉CrDb₅DsF₁₁Hf₆Mg₂Po₁₃TiU₅)Md₅(Bi₅BkSi₂)Th₃

100% Malware dropper with stolen signatures

2026-04-24_4e7221abc454f740a67b9734bdb15997_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee May 6 vxunderground-inthewild

087f07b944baf5d43c73ed502d68b2d011fbfeb5db1d874351f165b5c3e9eff6 O₆(Pr₂As₂Er₃AlCI)H₆(Cm₈Db₂FOs₇Po₁₀U)Md₂(Bi₂Pt)

2026-04-25_05dc261a12b7b1e328870947e71cbe3b_elex_rhadamanthys_stealc_stop May 6 vxunderground-inthewild

87e772fdd4eaeb8e4e9ab5f90b5dfc2bd8fa045e95340c5138a2dd85073371d0 KO₁₀(Er₁₁Pr₂C₁₁Al₂As₁₃CoDyI₃P₃Xe)H₉(Os₅Cm₅F₅HfPo₁₀U₂CrDb₂Ds)Md₅(Bi₆BkHe₂SiPa)

2026-04-25_01c46f605bffb32e50a4bf62b8d1854b_coinminer_elex_wannacry May 6 vxunderground-inthewild

a10feafa6e012b167cc4c0e4d8758f1543dfd349810aadb1c61b430f6b943e32 KO₉(C₅Er₆AlAs₉EuIP₂SXe)H₆(Cm₄F₅Po₄CrDsMg₂)Md₄(Bi₇HeSi)

2026-04-25_dfa2d4827e187c9237637cc597df7fdc_elex_wannacry May 6 vxunderground-inthewild

a1d63cbafecf6728b24fb3020657aad17ebc2e376b13711f045d328afa4f784b KO₇(C₄Er₇P₂AlAs₇IS)H₅(DbFOs₃Po₆Ds)Md₄(Bi₁₁HeSi)Th

2026-04-25_0b68a0d5b0f889f7546ff4908b6a4115_elex_stop May 6 vxunderground-inthewild

bca8d68f4b9246721baba35c28c0b21862f368935eaa82b95f351c18af784194 KO₁₂(As₁₃C₈Co₃Al₄Er₉I₃PrCaDy₂P₂SXe)H₉(Cm₃Os₁₃Db₄DsF₁₁Hf₅Po₈U₃Cr)Md₃(Bi₉SiHe)Th

2026-04-24_097eae0be2f3d1208747be3a6e02672a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar May 6 vxunderground-inthewild

ca913b21740e8d780e4ec230b262c9130511fdec141c3283074fe33acf7d7779 K₂O₁₃(Er₁₄As₁₄I₈C₁₃Co₅Dy₇P₄Al₆Ca₂EuLa₂PrXe)H₈(F₁₁Os₉Cm₇Cr₉Db₅DsPo₆Ti)Md₆(Bi₈BkHe₂Si)

2026-04-25_3ab8ebd8899fe2eb69850451d60b076a_elex_floxif_remcos_stealc_stop May 6 vxunderground-inthewild

dd4577217ed16eb7ed1c6879c01a2d7c641769d85d8f043e32f3ac2eacb8e6a7 KO₆(C₇As₁₁Er₄I₂P₂S)H₆(Os₆Po₂Cm₃DbDsF)Md₄(Bi₉SiHe)Th₂

2026-04-25_af21cf53f7406d67b0c350ec17697656_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar May 6 vxunderground-inthewild

e884b58eb901cd586cbaef983dc1d31579548a05be50015d9252ea435e0799b5 K(Am)O₈(As₂C₃ErAl₂Co₂Dy₂P₂Pr)H₈(Os₁₈Cm₇Db₃F₁₂Hf₅Mg₂Po₁₀U₄)Md₅(Bi₄BkSi₂)Th₃

100% Embedded malware with stolen certificates

2026-04-25_68b8f6c82347c2d6729c452fa7ce7c5d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

057c88a017bf253f1f1eac8c3ec2c3b15509d146398cb608fc9563f9a1b24fe4 K₂(Am₂Li)O₁₀(C₃Dy₆Er₅Al₆As₅Co₃I₂P₃PrXe)H₁₀(Os₂₂Cm₁₀CrDb₅F₁₄Hf₅Mg₂Po₁₃TiU₅)Md₆(Bi₅BkPtSi₂)Th₃

85% Multiple malware indicators and evasion

2026-04-25_fe8a5d51246669d048badc2bf35ec768_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

0c500710c7353cb2a4ccfb5c2894e8abaf202ea6ecc0fd50b0769d0ac08b65af K(Am₂)O₇(CLaEr₄I₂As₂DyPr)H₁₁(Cm₈CrDb₄DsF₁₅Hf₇Mg₃Os₂₆Po₁₄TiU₆)Md₆(Bi₈PaPtSi₂)Th₃

97% Malware dropper with embedded payloads

2026-04-24_c6dcb2d33eaa762c4af4adc9a56c21a4_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry May 6 vxunderground-inthewild

2223de4b6898d6aad1f45c037756d7c270719117a2cdf7586bf586c49a2e7eed K₂(AmLi)O₉(Al₂C₃ErAsCo₂Dy₅IP₂Pr)H₁₀(Os₁₉Cm₈Db₄DsF₁₀Hf₆MgPo₁₂TiU₄)Md₅(Bi₃BkSi₂)Th₃

100% Malware dropper with embedded payloads

2026-04-25_6161371ae4ed6a4fc1a99c35a23c2f12_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

2e6b92d266de4a0d798c2e4e1be1c4e15eebc9931d4aa08f1e9ff9a02461580c K(Am)O₇(AlCCo₂Dy₄IP₂Pr)H₁₀(Cm₆CrDb₃F₁₂Hf₅MgOs₁₈Po₁₂TiU₄)Md₅(Bi₃PtSi₂)Th₃

85% Embedded malware with keylogging and evasion

2026-04-24_6e4027ecdd1091f9383c865b571a0ec9_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar May 6 vxunderground-inthewild

9a7e7491c805cfe6d542e92a69035c749a087eb9dcabafb4d7c2cc7f19b1e206 K₂(AmLi)O₁₀(Al₄C₄Dy₆Er₃As₂Co₃I₂P₃PrXe)H₁₀(Os₂₁Cm₁₀CrDb₇DsF₁₄Hf₆Po₁₃TiU₅)Md₆(Bi₄BkPtSi₂)Th₃

85% Stolen certificate, malware signatures, keylogging

2026-04-24_329eba449bcc8a986c605c5e385e36d0_amadey_coinminer_elex_smoke-loader_stop May 6 vxunderground-inthewild

b4aba1f2c083dff88c5efd0a88acfecfdbd928739e3bd2256fca3c2fb3f146e2 O₆(C₂Er₅Pr₂As₂EuAl)H₇(Cm₁₄Db₂FMg₃Os₁₀Po₁₄U)Md₃(Bi₆PaPt)

100% Amadey coinminer loader with injection

2026-04-24_404759b5e5d9ce9585328a32e107d5be_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm May 6 vxunderground-inthewild

43ecdc117ed4dac0a3674aa5a5a810ef202e20cbc773962dc8c834938ff10b9b K(Mc)O₈(Er₄C₃P₃AlDy₃EuIXe)H₇(Hf₃Cm₃Db₃F₈MgOs₅Po₆)Md₅(PtBi₄Bk₂Si₂)Th₇

100% XWorm RAT with embedded malicious PE

2026-04-24_397703af6cd1a2c6ce99f2c924b88553_amadey_elex_smoke-loader May 6 vxunderground-inthewild

c2ea3f1fde53a240aa8d1c84ab0e7ba14fa964f77db37e861731910a2605de79 O₇(C₃Al₂As₁₄CoEr₅PXe)H₇(CrDb₃F₃Os₇Po₄CmDs)Md₄(PaBi₇Si)

2026-04-24_facb5d648cd34c344686296f4b08d30c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

e2b6eebe4f9d6110910e926cea932986aa650e6272ab0f712ea8481b51efd7de K₂(AmLi)O₇(Al₂As₂C₃Co₂Dy₅IPr)H₁₀(Os₁₉Cm₅Db₃DsF₁₁Hf₆Mg₂Po₁₂TiU₄)Md₅(Bi₄BkSi₂)Th₃

100% Malware sample with embedded malicious payloads

2026-04-25_a65650e8c1799815788a69795bb01ad4_cobalt-strike_icedid_njrat_satacom_stealc_vidar_wannacry May 6 vxunderground-inthewild

32292eebaa8d21b71effd81f62ede21e453a62eccabec24087b3651a12113ce5 K(Am)O₆(CEr₅I₃LaAs₂P)H₆(Cm₂Db₂F₁₀MgOs₁₄Po₁₀)Md₅(Bi₇PaPt₂Si₂)Th

92% anti-av/signatureinfection/file

2026-04-25_0cd3b1e937e877c9081ca5895a982373_elex_manuscrypt_rhadamanthys_stop May 6 vxunderground-inthewild

3659ef55d7905a2565daa4bd93ebd9b44907ed86df906981270dde9adbb6fc36 KO₇(C₆Al₃As₈ErEuPS)H₂(F₃Cm₂)Md₂(Bi₇Si)

2026-04-24_39e59b70981e7ecf8bac3329c770ffa3_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee May 6 vxunderground-inthewild

622df34d2f3b3e1bb5ada582905de56fa465d0131f89df06c588e590d02f5cb7 KO₈(Al₂As₁₈C₇CoEr₉I₂PrS)H₈(Db₃Cm₃DsF₅Os₅Po₅UCr)Md₄(Bi₈BkPtSi)

2026-04-25_3e94ff4926690c896a9e4adb0c10536f_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop May 6 vxunderground-inthewild

70101a1f295dd7f236aa00bfadf21948e7885a3979f5e5d142f168b800ffae8c O₃(ErIAs)H₉(Cm₄Db₂F₇Hf₄Mg₃Os₁₅Po₁₄Ti₂U₂)Md₃(Bi₄BkPa)Th

Win/Blackmoonsystem/crash

2026-04-24_4b2359bca3bf86818f0a9d5bcf974212_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee May 6 vxunderground-inthewild

8448e88c709853af314f8dd440b2ac085aee26a72664c448091fbaa82a511ffc O₃(As₃PC)H₅(Cm₃DsF₄Os₅Po₃)Md₂(Bi₃)Th₃

100% Packed dropper with embedded PE and C2

2026-04-25_35cbb096587b3e04362e382e4a6feb2d_akira_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys May 6 vxunderground-inthewild

b347b954933953acbd284ca6c42dffad4d38700564f32059a981415f664b4b5f K₂(McLi)O₃(IAs₂C)H₃(F₃OsPo₆)Md₂(Bi₃)

binary/rewritevirus/shodi

2026-04-25_5ea99bbe4e6105188de7d839f622f074_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_remcos_stealc_stop_vidar_wannacry May 6 vxunderground-inthewild

eef6ec20dca3912e2b4f1d46b0119dc096c58d22090763beabd523726d4ad9a6 K(Li)O₆(C₂As₂DyEr₂P₂Pr)H₆(DbF₅Hf₆Os₁₁Po₃U)Md₄(Bi₂Pt)Th

2026-04-25_73f493348c4446119e0809609a874d9a_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

f34356b30421561a60c74d8dafa7f8e0a3d62fd127c8428eb458f998a6510f15 K₂(McAm₂)O₁₀(As₃C₄ErAl₇Co₃Dy₂EuIP₂Pr₂)H₉(Os₂₅Po₁₂Cm₁₀CrDb₆F₁₃Hf₆Mg₂U₅)Md₅(Bi₄BkSi₂)Th₂

85% Malware dropper with embedded payloads

2026-04-24_170c354019ed5d4c2a629a9803976126_cobalt-strike_icedid_njrat_satacom_vidar_wannacry May 6 vxunderground-inthewild

8327170c9b3b4c9e82bc520370215795d3603cc4b1d04ee4681df567ab750e71 K(Am₃)O₈(CLaAs₄Er₅ICaDy₂Pr)H₉(Cm₆Cr₂Db₆F₁₁MgOs₁₆Po₁₁TiU)Md₆(Bi₈BkHePaSi₄)Th

100% Multi-malware dropper with ransomware taunt

2026-04-25_f7d27f28ffaac6b39dd5e12cbe85bb98_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop May 6 vxunderground-inthewild

03c510879afb0b0380ec89490a1456041bf0d14b9f002027fa0bc37f8f8a4730 K₂(AmLi)O₉(C₃Dy₄Al₄AsCo₂Er₂P₃PrXe)H₁₀(Os₂₀Cm₉CrDb₆F₁₃Hf₅MgPo₁₂TiU₄)Md₆(Bi₃BkPtSi₂)Th₃

85% Malware sample with keylogging and evasion

2026-04-24_ba92343ad39a427149bfb79cca708f05_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop May 6 vxunderground-inthewild

0ea715d680f2d9577925087aedb0947463181323b2fd1369a0ca89d8b0da5557 O₃(Er₄Pr₂Eu)H₈(Cm₁₃CrDb₂FMg₃Os₁₁Po₁₂U)Md₃(Bi₄PaPt)

100% coinminer loader with injection

2026-04-25_13a6f27c522490f24e315b86a93508c0_amadey_elex_hawkeye_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop May 6 vxunderground-inthewild

1a2dd6d15faf8fd1fa411a772f4e2078d4a81cae5e14cdec9d1404fec98906cb KO₁₂(C₁₄Al₄As₂₀P₆CoDy₃Er₁₇Pr₂EuI₄SXe)H₉(Cm₅Os₁₀Db₇DsF₆Po₆UCrMg)Md₃(Bi₈Si₃He)Th

2026-04-25_49b405ce40a2487b00a512393cd3c13c_elex_emotet_glassworm_neshta_smoke-loader_stop May 6 vxunderground-inthewild

1b0be27b65f5c621b6c026cacbfc8d4d0203e27c63f84f0d31a8dc2981dd28ed KO₁₁(As₁₄Co₃P₃Al₄C₁₂Er₄I₃La₂PrSXe)H₁₀(Cm₇F₅Hf₂Os₄Po₅U₂CrDb₄DsMg)Md₆(Bi₅Bk₂Pt₂SiPa)Th₃

2026-04-25_87d24472df1e119b897fda6732e642aa_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_stop_vidar May 6 vxunderground-inthewild

51a2ad6bd5ebb49b90970e70c68d6a11de0abb405790dfd97c7e637ef94ceacc K₂O₁₄(As₂₆C₂₂Er₂₈Al₁₃Co₆La₃P₇Pr₄Dy₈I₁₂Ca₂EuS₃Xe)H₁₁(Cm₁₆Os₂₄Po₁₄Cr₃Db₁₃DsF₁₄Hf₅Mg₃TiU₃)Md₇(Bi₁₂Si₃HePaPt)Th₂

2026-04-25_2f88a1a3068cd3b7961426c90d17eab4_agent-tesla_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

75b21c00d174218ad7c3bde40226c178abc88b50ef30ef48f33f400b398aa273 K₂(AmLi)O₈(As₃Al₃C₄Er₂Co₂Dy₅IPr)H₁₀(Os₁₉Cm₇Db₃DsF₁₃Hf₆MgPo₁₄TiU₄)Md₅(Bi₄BkSi₂)Th₃

85% Multiple malware indicators and stolen signatures

2026-04-24_892b15a44451df95ba681de247c519c3_amadey_elex_glassworm_smoke-loader May 6 vxunderground-inthewild

8e1c0cdfaac3d11ec4fdedf223a785797b4e2ade68d084f30d826d8e1e99db01 KO₁₃(Co₄Er₁₂C₁₀Dy₄EuAl₂As₁₄I₅PrXe₂CaLaP)H₉(Os₁₂Cm₇Db₆F₁₂Hf₄Po₈U₂CrDs)Md₆(Bi₈BkSiHe)

2026-04-25_a9419db1504409365f2670e3c5cf568c_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar May 6 vxunderground-inthewild

c09d6a453ee0827b8a7dcbb1970ed7490d05f795e21895be42fba381c1e5be2c O₄(ICErAs₂)H₈(Cm₂DbF₁₀Hf₆MgOs₇Po₉U₃)Md₅(Bi₅PaPt)Th

80% binary/rewriteversion-resource/security-vendor

2026-04-25_f2422c382d74348deb6da07f4b7397cd_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_stop_vidar_wannacry May 6 vxunderground-inthewild

8a3c317178168999caef707069fe2a4f7f2c89297367ac80acdf8c91d9c5f291 K(Am₂)O₇(C₂Er₄IAs₃DyPPr)H₁₀(Cm₁₀Cr₂Db₄F₁₁Hf₇Mg₂Os₂₄Po₁₄TiU₅)Md₇(Bi₁₂BkPaPtSi₃)Th₃

92% version-resource/security-vendorstaging/temp

2026-04-24_f618925af562ad9e3cf5ebb3e18a4636_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_wannacry May 6 vxunderground-inthewild

c99eb76470bc3e26103df30ddb354887cc0fb9d8d6614263d915594782373ad0 K₂(Am₃Li)O₆(C₂Er₃IAs₃DyPr)H₁₀(Cm₁₀CrDb₅F₁₅Hf₇Mg₂Os₂₇Po₁₆TiU₆)Md₈(Bi₉BkPaPt₂Si₃)Th₃

98% Malware filename, embedded PEs, evasion

2026-04-25_f8861e58d90ff50508cac20cb3ceb793_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry May 6 vxunderground-inthewild

1798187733297c9add27fa0454809a857121415d2de75a55e8cdebda4c8ce9b3 K₂(McAm₃)O₈(C₆CoEr₃I₂P₂Pr₃As₃Dy)H₁₁(Db₈Cm₁₅Cr₂DsF₁₄Hf₇Mg₂Os₃₀Po₁₆TiU₅)Md₇(Bi₈BkPaPtSi₃)Th₃

99% Multi-stage dropper with embedded malware

2026-04-24_cfe2e3d8887148755b36c47b8833514f_elex_wannacry May 6 vxunderground-inthewild

5218b06413f688e3469ffee7ff613fc8272add2c87b6c2a0af9700538aca0e51 K(Mc)O₃(CP₂Er₂)H₆(Cm₃DbF₃MgOs₆Po₅)Md₂(Bi₄)Th

100% 20180208/Mal1botnet/stormattack

2026-04-24_ea42ff9b180d73c595cddf592d7a7e52_elex_mafia_stealc_tofsee May 6 vxunderground-inthewild

5ef430f405142ae31b4e46f50b59ee8fe0f779e65abaeb55c3fbaa92f15527c5 KO₈(As₁₀Er₇Dy₂AlC₃CoPXe)H₆(Cr₂Db₂F₃Os₆Po₄Cm₂)Md₃(PaSiBi₆)

2026-04-24_70296fa8b8030e72abee420c9ed2a3e9_blankgrabber_coinminer_icedid_luca-stealer_njrat May 6 vxunderground-inthewild

825f0fc6a76c6157fb018ecf77b481c77b004cbe3d63e01dffdc24e530ea64e2 O₆(C₃As₁₃Al₈DyEr₅P₂)H₆(Db₃F₂Po₃CmCrOs)Md₃(Bi₇SiPa₂)

2026-04-25_5afb7a1213748fad6004b414d2a42964_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_satacom_smoke-loader May 6 vxunderground-inthewild

950e960717d9d4b60cb3a7403c22016a7696edefc718989523d88cc79a5e993a K₂(LiTe)O₂(AsEr₃)H₇(Cm₄F₉Hf₂Mg₃Os₁₄Po₁₁U)Md₇(Bi₈BkPaPtSi₃)

80% brand/wrapperanomaly/rewrite

2026-04-25_70418e273342ead9fb54878bc27d4ba9_akira_elex_glassworm May 6 vxunderground-inthewild

a1eeae2ed77e6897b1adc872b2985ae2cd6d3717677279fa85eb956cae7b3994 K₂O₅(Er₇As₉DyAl₂C)H₈(Os₂Po₅TiCm₃CrDbDsF)Md₅(BkSi₂PtBi₅Pa)

2026-04-25_6cb7ed1e7844b3f66d2b6ad2e5c0389e_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry May 6 vxunderground-inthewild

138de16a80f2c841d0b72712f890b5c824f2d58436d57f1360e4bdc4f99ca014 K₂(AmLi)O₉(Al₅C₄Er₂AsCo₃Dy₅I₂P₂Pr)H₁₁(Os₂₁Cm₁₀CrDb₇DsF₁₁Hf₆MgPo₁₃TiU₅)Md₅(Bi₃BkSi₂)Th₃

85% Malware dropper with keylogger and evasion

2026-04-25_470e36e1a700cdb536ac8508bd712eb1_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_stop_vidar May 6 vxunderground-inthewild

30cb0c75f6d630622180f51056aa952d190895328148e436eb69c3a6429650fe K(Am)O₉(C₅Er₄Al₅As₂Co₂Dy₅I₂P₂Pr)H₉(Os₂₁Cm₈Db₆F₁₅Hf₅MgPo₁₂TiU₄)Md₅(Bi₃Bk₂Si₂)Th₂

85% Malware sample with embedded payloads

2026-04-25_f8b3e721418b60eb11d08b803d255648_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_hawkeye_hellokitty_icedid_luca-stealer_njrat_poet-rat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar_wannacry May 6 vxunderground-inthewild

484cc4dfc856824a4f37cf37bfea722f2f83de13f1b649ec8512789090908641 K₂(AmLi)O₉(C₃ErAl₂As₃Co₂Dy₅IPPr)H₉(Os₂₀Cm₁₃Cr₄Db₄F₁₂Hf₆Po₁₂Ti₂U₄)Md₅(Bi₄Bk₂Si₂)Th₃

85% Stolen cert, keylogger, multiple malware families

2026-04-25_40d96a6fc6163e983bfb0a691c3d3999_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

cc55b63e813f4aa30d04babf875b468896832b26b5c0344d7696f95002c30240 K₂(AmLi)O₉(Al₄C₄ErAsCo₂Dy₅IP₂Pr)H₁₀(Os₁₉Cm₉Db₆DsF₁₀Hf₆Mg₂Po₁₂TiU₄)Md₅(Bi₃Bk₂Si₂)Th₃

85% Multiple malware families, keylogging, and evasion

2026-04-25_6e79dd9710c59dcc64b9022172ee3213_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar May 6 vxunderground-inthewild

1ac441c452d2a7f45cf6dfd2a9a29c13515a1f207487d242f2cfb998861c5117 K(Am₅)O₆(C₂Er₂I₂As₃DyPr)H₁₁(Cm₁₀Cr₂Db₅DsF₁₁Hf₇Mg₃Os₂₃Po₁₅TiU₅)Md₇(Bi₁₀BkPaPtSi₃)Th₃

100% Multi-malware dropper with embedded payloads

2026-04-25_92a5d73e502866b727416ceeedc7f3ce_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar May 6 vxunderground-inthewild

3ddeed45630a6e21193ee71c8ceff9b632b150f15a65bb346a0a878fa1eb2e8c K₂(AmLi)O₈(Al₂As₂C₃Co₂Dy₅IPPr)H₁₀(Os₁₉Cm₆Db₃DsF₁₁Hf₆MgPo₁₂TiU₄)Md₅(Bi₃BkSi₂)Th₃

100% Embedded malware with stolen signatures

2026-04-24_e8acf9a40a5889ff832d87f480bbf0b1_akira_vidar May 6 vxunderground-inthewild

9aa6039f25d32aa31339d005b27392d67a3e42d6676323cf7590440bb1044f7e O(As₂)H₇(CmCrDb₂FMgOs₄Po)Md₃(Bi₄PaSi₂)

99% Embedded PE, overlay, no imports

2026-04-25_4e988246a7ec62e1401e6d8d2f6b8707_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry May 6 vxunderground-inthewild

a3c5202123a5cf58cbafcf618eb46c3757925601eda3f957092f3aab621a8cd5 K₂(AmLi)O₁₀(C₃Dy₆Er₅Al₄As₃Co₂IP₃PrXe)H₉(Os₁₉Cm₉Db₆F₁₃Hf₆Mg₂Po₁₂TiU₄)Md₆(Bi₄BkPtSi₂)Th₃

85% Malware sample with keylogging and evasion

2026-04-25_92de935d66d5bf1b28703df8ec1e67ee_amadey_cobalt-strike_satacom_vidar_wannacry May 6 vxunderground-inthewild

cb6017e8a42314a41fe97bbe3b34579fb3a08f0bad1b587c5b34457488ead7de K(Am₂)O₆(C₂LaAs₃Er₂I₂P)H₇(CmDb₂F₁₀Mg₂Os₁₁Po₈U)Md₆(Bi₄BkPaPtSi₃)Th

100% Multi-stage ransomware dropper

2026-04-24_a2d14ff67d2a9f261fffb28a0ce3a0d6_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar May 6 vxunderground-inthewild

9d833f4f1c567362341a1f758f3d477bc8b47960fa31d7533c2f115d95dcaac8 O₅(As₁₁C₂CoDyEr₅)H₇(DbDsFMgOs₄Po₂Ti)Md₅(Bi₁₅HePaSi)

100% UPX-packed masquerading malware

2026-04-24_e8c8313a2a26c840b57515681b72c252_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader May 6 vxunderground-inthewild

2a84bd6181ef3913df6ee6a02cfd4ecf6df23b8577f840220175ee923e354b26 O₇(Ca₂LaAl₂Co₂DyIPr)H₇(Os₁₂Cm₇Db₂F₁₁Hf₅Po₉U₄)Md₂(BiPa)Th₅

100% Netwire RAT with keylogger and evasion

2026-04-25_02267e8d3c38b6d19e1e646b3f5e0faa_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_smoke-loader_stop_vidar May 6 vxunderground-inthewild

0ab7ce917d043052bd49853b6c5d92bf988cebe49c5ed9cb7ffe731c4a5cda52 K(Am₃)O₈(C₃CoEr₅PPr₂I₂As₂Dy)H₁₁(Cm₁₈Cr₇Db₈DsF₁₃Hf₇Mg₃Os₂₅Po₁₄TiU₅)Md₇(Bi₉Bk₂PaPt₂Si₃)Th₃

92% execution/injectversion-resource/security-vendor

2026-04-25_5b632befe6a1ca127461d596acfc0bf9_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_luca-stealer_njrat_remcos_satacom May 6 vxunderground-inthewild

7fa99e940e7e3d909f5a455e22ade1c3180953801e28fbcd0a028f9abb1d9885 K(Am)O₄(ICErAs₃)H₉(Cm₃Cr₂Db₃F₉Hf₆MgOs₁₂Po₁₀U₃)Md₅(Bi₅PaPt)Th

98% Multi-stage malware with injection

2026-04-25_a3150b99b7f4ce284ae28333de7cc1be_amadey_darkgate_elex_gcleaner_smoke-loader May 6 vxunderground-inthewild

5bb7ec59c42446b976213fcb5de08900fb0bea875dfa4faade86ba5d3276b3c4 O₆(CLaCoErPAs₂)H₉(CmDb₂DsF₉Hf₃Mg₂Os₈Po₆U₃)Md(Bi₅)

97% Amadey loader with injection and persistence

2026-04-25_af0fa310a241b9d5eacfb7c8c3e06531_amadey_elex_glassworm_smoke-loader May 6 vxunderground-inthewild

a59e60e42bbfd7f47937ee63dfedc60f10f47acbd14ee1617cbc256b108be861 KO₁₃(Co₄Er₁₂C₁₀Dy₄EuAl₂As₁₄I₅PrXe₂CaLaP)H₉(Os₁₂Cm₇Db₆F₁₂Hf₄Po₈U₂CrDs)Md₆(Bi₈BkSiHe)