2026-07-06_44ac825d76f41e72da8265bd750738fd_amadey_bkransomware_coinminer_darkgate_elex_glassworm_maze_remcos_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_44ac825d76f41e72da8265bd750738fd_amadey_bkransomware_coinminer_darkgate_elex_glassworm_maze_remcos_smoke-loader_stealc
Size 11.2MB
Sample260707-epe7ashv81
SHA256 ebf233b04d47b9d1487e9f9ae47561e31235a09904823f387bff91626c1ad70a
MD5 44ac825d76f41e72da8265bd750738fd
SHA1 426dd74133bee590dfd43abc54baa96ef936ba1d
SHA512 599b8628f533487793499bd39890f4497d1937f1848f3598a63351f4b2523af3bfaf564b4009c989a6812b1d6e1f638c2bb71a5ec3b1a44ee120b1151dc9003c
SSDEEP 196608:1yMOvdkKfr+EFb0CiQWj5kTwGs4jUMVB8KUgCi:dUfqEFbR7OVMb85i
TLSH
T1C5C69D53E29141E5EC9211F92166233A7D3AE7264319B1C3D7D129B2AA700D2F93F78F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_44ac825d76f41e72da8265bd750738fd_amadey_bkransomware_coinminer_darkgate_elex_glassworm_maze_remcos_smoke-loader_stealc

File Explorer

2026-07-06_44ac825d76f41e72da8265bd750738fd_amadey_bkransomware_coinminer_darkgate_elex_glassworm_maze_remcos_smoke-loader_stealc

.exe 11.2MB

2026-07-06_44ac825d76f41e72da8265bd750738fd_amadey_bkransomware_coinminer_darkgate_elex_glassworm_maze_remcos_smoke-loader_stealc

IMPHASH 9acfe09561f165039e735f7ec856bb31
SHA256 ebf233b04d47b9d1487e9f9ae47561e31235a09904823f387bff91626c1ad70a
MD5 44ac825d76f41e72da8265bd750738fd
SHA1 426dd74133bee590dfd43abc54baa96ef936ba1d
SHA512 599b8628f533487793499bd39890f4497d1937f1848f3598a63351f4b2523af3bfaf564b4009c989a6812b1d6e1f638c2bb71a5ec3b1a44ee120b1151dc9003c
SSDEEP 196608:1yMOvdkKfr+EFb0CiQWj5kTwGs4jUMVB8KUgCi:dUfqEFbR7OVMb85i
TLSH
T1C5C69D53E29141E5EC9211F92166233A7D3AE7264319B1C3D7D129B2AA700D2F93F78F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3066018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\ccmaster\q_v2023.09\software_dev\silver\tools\SilverRemoteModule\x86\silverremotemodule.pdb

dbghelp

ImageDirectoryEntryToData

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

user32

MessageBoxA MessageBoxW GetSystemMetrics ShowWindow DialogBoxIndirectParamA CreateDialogIndirectParamA wsprintfA GetProcessWindowStation GetUserObjectInformationW GetClientRect ScreenToClient GetActiveWindow EnableWindow GetWindowRect GetDlgItem SendMessageA GetWindowLongA MessageBeep SetDlgItemTextA GetDlgItemTextW GetDlgItemTextA EndDialog GetParent GetFocus SetFocus SetWindowTextA MoveWindow

shell32

SHCreateDirectoryExW ord680 SHGetFolderPathA

psapi

GetModuleBaseNameA EnumProcesses EnumProcessModules

iphlpapi

GetAdaptersAddresses GetAdaptersInfo SendARP

ws2_32

accept getpeername bind getsockname WSASetLastError setsockopt ioctlsocket __WSAFDIsSet getsockopt inet_addr getnameinfo WSASocketW listen inet_ntoa ntohs ntohl htons htonl recvfrom freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send select recv connect closesocket gethostname shutdown getservbyport getservbyname gethostbyname gethostbyaddr inet_ntop sendto WSAIoctl

msi

ord70 ord246

crypt32

CertOpenStore CertEnumCertificatesInStore CertGetNameStringA CryptQueryObject CertFindCertificateInStore CertFreeCertificateContext CertCloseStore CryptMsgClose CryptUnprotectData CryptMsgGetParam CertGetCertificateContextProperty CertDuplicateCertificateContext

wininet

HttpSendRequestW InternetQueryOptionA InternetQueryDataAvailable InternetReadFile InternetOpenW InternetCloseHandle InternetConnectW HttpOpenRequestW

userenv

GetProfilesDirectoryA

comctl32

ord17

comdlg32

GetOpenFileNameA

wintrust

WinVerifyTrust

dhcpcsvc

DhcpRequestParams

kernel32

ReadConsoleInputA ReadConsoleW GetConsoleMode GetConsoleCP RtlUnwind SetConsoleMode SetStdHandle EncodePointer DecodePointer IsProcessorFeaturePresent MoveFileExW SetConsoleCtrlHandler ExitThread RaiseException GetCurrentProcessId CloseHandle DuplicateHandle GetCurrentProcess OpenProcess VirtualQuery MapViewOfFile CreateFileMappingA GetLastError UnmapViewOfFile FlushViewOfFile SetUnhandledExceptionFilter GetModuleFileNameW GetModuleHandleExW GetCurrentThread GetEnvironmentVariableA GetCurrentDirectoryA GetFileAttributesA OutputDebugStringA SetLastError GetCurrentThreadId SuspendThread ResumeThread GetThreadId GetThreadContext GetVersionExA ReadProcessMemory FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA SetEnvironmentVariableW ExpandEnvironmentStringsW Sleep TerminateProcess CreateProcessA SetThreadStackGuarantee GetProcessId GetTickCount GetModuleHandleA GetModuleHandleW LoadLibraryExW LoadLibraryW VirtualProtect WriteProcessMemory GetFileAttributesW GetFileAttributesExW CreateProcessW FindClose FindFirstFileA FindNextFileA LoadResource LockResource SizeofResource FindResourceA SetEvent ReleaseMutex FindFirstFileExW CreateMutexA CreateEventA WaitForMultipleObjects OpenMutexA OpenFileMappingA GetTempPathA GetEnvironmentVariableW LocalFree FormatMessageA CreateFileW DeviceIoControl GetVersion LocalAlloc GetComputerNameW GetVersionExW DeleteFileW MoveFileW FileTimeToLocalFileTime GetCommandLineW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency GetProcessTimes ExitProcess GetExitCodeProcess GetSystemTimeAsFileTime FormatMessageW CreateThread OpenThread K32GetProcessMemoryInfo MultiByteToWideChar WideCharToMultiByte GetStdHandle SetHandleInformation InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentDirectoryW FindFirstFileW FindNextFileW LockFile ReadFile SetFilePointer SetFilePointerEx CreateFileMappingW OpenFileMappingW ReleaseSemaphore CreateSemaphoreW CreateSemaphoreA GetFileSize WriteFile IsDebuggerPresent DebugBreak GetLocalTime GetComputerNameExW GetLocaleInfoW CreateMutexW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime DeleteFileA AreFileApisANSI GetSystemTime GetSystemInfo GetDiskFreeSpaceA GetDiskFreeSpaceW HeapSize FlushFileBuffers HeapValidate HeapCreate HeapDestroy GetProcessHeap UnlockFileEx OutputDebugStringW WaitForSingleObjectEx UnlockFile HeapFree SystemTimeToFileTime HeapAlloc SetEndOfFile HeapCompact CreateFileA HeapReAlloc GetFullPathNameA FreeEnvironmentStringsA lstrlenA GetEnvironmentStrings GetWindowsDirectoryA SetErrorMode GetTimeZoneInformation ResetEvent GetVolumeInformationA GetDriveTypeA VirtualAlloc VirtualFree GetFileType GetSystemWindowsDirectoryA GetSystemDirectoryA VerifyVersionInfoA VerSetConditionMask SleepEx GlobalMemoryStatusEx GetPhysicallyInstalledSystemMemory VerifyVersionInfoW TzSpecificLocalTimeToSystemTime GetSystemPowerStatus SetNamedPipeHandleState WaitNamedPipeA ExpandEnvironmentStringsA PeekNamedPipe CreateEventW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueEx GlobalMemoryStatus FlushConsoleInputBuffer GetPrivateProfileStringA GetPrivateProfileSectionNamesA GetDriveTypeW UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW CreatePipe SetEnvironmentVariableA GetFileInformationByHandle GetFullPathNameW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW GetOverlappedResult CancelIo GetModuleHandleExA CreateNamedPipeA InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS WaitForSingleObject LockFileEx

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance OleUninitialize OleInitialize CoUninitialize CoQueryProxyBlanket

oleaut32

SysFreeString VariantClear SafeArrayCreate SafeArrayPutElement SysStringLen SysAllocString SysAllocStringByteLen SysStringByteLen VariantInit SysAllocStringLen

netapi32

Netbios

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

shlwapi

PathCombineW PathIsUNCW PathRemoveBackslashW PathIsRelativeW PathIsRelativeA

advapi32

RegDeleteValueW RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor GetUserNameA RegOpenKeyExW RegQueryValueExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptExportKey CryptImportKey CryptEncrypt CryptDecrypt CryptCreateHash CryptDestroyHash GetUserNameW OpenProcessToken CheckTokenMembership CreateWellKnownSid DuplicateToken GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation RegDeleteValueA RegEnumValueA RegOpenKeyExA RegCreateKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA DeregisterEventSource ReportEventA RegisterEventSourceA RegCreateKeyExW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW CloseServiceHandle QueryServiceStatus OpenServiceA OpenSCManagerA StartServiceA RegOpenKeyA CryptEnumProvidersA CryptGetProvParam CryptAcquireContextA CryptGetUserKey CryptSignHashA CryptSetHashParam CredEnumerateW CredFree

componentName configureLogFunction configureSimpleLogFunction getSilverFlavourImpl getSilverPidImpl internalLog lm_checkServerIsUp snps_23121968 snps_26041968 snps_4025085 snps_4025086 snps_4025087 snps_4595026 snps_4595123 snps_4595135 snps_4639353 snps_5045988 snps_5049383 snps_5050897 snps_5050898 snps_5050901 snps_5050910 snps_5052332 snps_5053462 snps_5053472 snps_5056973 snps_5057024 snps_5057119 snps_5057194 snps_5057214 snps_5057633 snps_5060500 snps_5065158 snps_5995943 snps_5995962 snps_H319771106timer8ebcn snps_H419771106clock8ebcn snps_H4wdooiulw1nsukKsmsdnfoi snps_axsbdgtewB0Bo0m0mf snps_axsbdgtewB0Bo0m0mfclockgenerator snps_axsbdgtewB0Bo0m0mmultiplex snps_blowfish_decipher snps_bypass_master_control_program__ snps_checkout_flexlm_license snps_decrypt_runtime_code snps_decrypt_runtime_codes snps_dgtbewBo0mB00mfaxs snps_dgtbewBo0mB00mfaxsdemultiplex snps_dgtbewBo0mB00mmodem snps_dp03ff2356jhkl88xe24 snps_dp03ff23rsthkl88xe24 snps_fa2celdgul1dTHR3WEdUNMDDhjh snps_fasR43dUW5206Edfgs52ce snps_gdtwebB00mBO0mdaxe snps_h4wdooiulw1nsuKKsmsdnfoi snps_h4wdooiulw1nsukKsmsdnfoi snps_hkjf034lkjlasdk3 snps_iuladasd snps_kjdkdueuuueuuueuuphawku snps_kljhsdkfhskdfhklhfakjhfk snps_lkdgulEKTHROWEIUNMDDjhj snps_lkjlsdfuliwerpuvclxnvdsdd snps_lksdoisdf092434kwef0k1dssd snps_lksdoisdf092434kwef0kldssd snps_ndkjsfda932kwekjsdfkinqwevs snps_ndkjsfda932kwekjsdfkjnqwevs snps_overflow_in_heap_alloc snps_pgp_sign_and_verify snps_urewmdfsdrwerwefas snps_urewmnmv0erkjsdfp3

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.textidx

Size

893KB

Virtual Size

893KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

jkl.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

jkl.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

682KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.7MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jkl.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jkl.rdat

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=5, id=225, version=20806,

count=6, id=206, version=65501,

count=73, id=225, productName=VS2013 build 21005, version=21005,

count=76, id=223, productName=VS2013 build 21005, version=21005,

count=285, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=170, productName=VS2010 build 30319, version=30319,

count=10, id=257, version=26213,

count=3, id=208, version=65501,

count=1, id=259, version=29912,

count=43, id=260, version=29912,

count=39, id=203, version=65501,

count=477, id=1, productName=Unmarked objects,

count=21, id=199, version=41118,

count=140, id=109, productName=VS2005 build 50727, version=50727,

count=960, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=38, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=47, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=90, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,