2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop
Size 2.9MB
Sample260416-s8a9caes6m
SHA256 77c138ffeeb253008d1bb5153846ad9c8f64482db929671d46090b3d6fdcd9b4
MD5 aff236f57b7f55b9edf4b6953e7f0cbc
SHA1 8c64fc1d6f5ff46529b191ec3ea9a1a432c7b49b
SHA512 65dd634a1dfe509d0853d8a765e2cc0580349923edb919a7497cb8f26f7df42e76956ced65f253c9d311ff1b01e3a63877cd36dfd1c2f75dabb8d4e198a7e4d6
SSDEEP 24576:d6BHxI7Hh9ZBXfEXcRrxmN3lYrnk5+PIGpkLOBc2XkmqEKP6AjVrItgcSNk0DD/M:YBHO7Hhp88xmN3Aek03noj45wlDTA1O
TLSH
T1B9E54C0FEE5D4C66D16F3D308C25E7DC02647E609922B9166EC43D89FAB1FC1782E266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop

.exe 2.9MB

2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 193b654ecb38f71ffa2fa47fac4c2bf7
SHA256 77c138ffeeb253008d1bb5153846ad9c8f64482db929671d46090b3d6fdcd9b4
MD5 aff236f57b7f55b9edf4b6953e7f0cbc
SHA1 8c64fc1d6f5ff46529b191ec3ea9a1a432c7b49b
SHA512 65dd634a1dfe509d0853d8a765e2cc0580349923edb919a7497cb8f26f7df42e76956ced65f253c9d311ff1b01e3a63877cd36dfd1c2f75dabb8d4e198a7e4d6
SSDEEP 24576:d6BHxI7Hh9ZBXfEXcRrxmN3lYrnk5+PIGpkLOBc2XkmqEKP6AjVrItgcSNk0DD/M:YBHO7Hhp88xmN3Aek03noj45wlDTA1O
TLSH
T1B9E54C0FEE5D4C66D16F3D308C25E7DC02647E609922B9166EC43D89FAB1FC1782E266
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c8:ab:83:e5:57:dc:66:03:9a:0e:09:42:31:04:49:40:85:b4:58:a4:6d:00:74:9d:1c:af:78:58:36:a8:3c:ca

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

Chains

Apr 15, 2026

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

Serial Number

42:f7:ce:c0:08:6a:c8:87:bb:81:ba:16

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2018 - Jul 4, 2020

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

13:b7:74:ee:59:e3:5e:c6:06:26:16:89

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 28, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

25348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

kernel32

GlobalUnlock FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW HeapReAlloc LoadLibraryExW LCMapStringW RtlUnwind SetFilePointerEx GetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap HeapSize GetModuleHandleExW ExitProcess WideCharToMultiByte GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter HeapFree GetLastError RaiseException HeapAlloc GetCommandLineW DecodePointer EncodePointer IsProcessorFeaturePresent IsDebuggerPresent CloseHandle VirtualFreeEx ReadProcessMemory VirtualAllocEx OpenProcess CreateFileW GlobalLock GlobalAlloc FreeLibrary GetProcAddress GetModuleHandleW MulDiv MultiByteToWideChar GetCurrentThreadId

user32

GetClassNameW SendMessageTimeoutW AttachThreadInput GetWindowThreadProcessId GetWindowLongW GetParent SendMessageW GetCursor GetDesktopWindow RedrawWindow GetWindowDC IsWindow GetWindow ChildWindowFromPointEx ClientToScreen EnumChildWindows GetWindowTextW GetDlgCtrlID GetForegroundWindow WindowFromPoint CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ReleaseCapture SendDlgItemMessageW SetCapture SetCursor EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DefWindowProcW MessageBoxW DestroyWindow KillTimer PostQuitMessage GetWindowPlacement RegisterClassExW LoadIconW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW SetTimer GetClientRect SetWindowTextW SetWindowPos GetMenu CheckMenuItem LoadCursorW LoadImageW RegisterWindowMessageW RegisterHotKey CreateWindowExW DestroyIcon ReleaseDC GetDC GetCursorPos IsWindowVisible ShowWindow EnableWindow MoveWindow ScreenToClient GetWindowRect InvalidateRect

gdi32

DeleteDC BitBlt LineTo MoveToEx StretchBlt PatBlt CreateCompatibleBitmap CreateCompatibleDC Rectangle SetROP2 GetStockObject SelectObject CreatePen GetPixel DeleteObject CreateFontW

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_aff236f57b7f55b9edf4b6953e7f0cbc_amadey_bkransomware_coinminer_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader_stop

PE Signature issue

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

generic