General
- Target 2026-07-17_2cb4b86fcdf135cae7172de28d35ea4f_amadey_coinminer_darkgate_elex_manuscrypt_qakbot_rhadamanthys_smoke-loader_stealc_stop
- Size 1.4MB
- Sample260717-hebmxagy4t
- SHA256 88215309ed122cd6ac34d161fe2f5008cc1eb8396fa1cf6c35ebb7182ba521c6
Score
10/10
Malware Config
Targets
-
- Target 2026-07-17_2cb4b86fcdf135cae7172de28d35ea4f_amadey_coinminer_darkgate_elex_manuscrypt_qakbot_rhadamanthys_smoke-loader_stealc_stop
- Size 1.4MB
- SHA256 88215309ed122cd6ac34d161fe2f5008cc1eb8396fa1cf6c35ebb7182ba521c6
Score9/10- Custom signature
Detects Reflective DLL injection artifacts
- Custom signature
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Custom signature
UPX dump on OEP (original entry point)
Drops file in Drivers directory
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
Network Service Discovery
Attempt to gather information on host's network.
Network Share Discovery
Attempt to gather information on host network.
Enumerates processes with tasklist
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Discovery
Network Service Discovery
1Network Share Discovery
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Network Connections Discovery
1