2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop
Size 2.0MB
Sample260720-2mbsesf17q
SHA256 142cc262204c457812ec32b653409bb63d0a2d1e0b2a1086076203b0dc08da93
MD5 e4bc60adf37bd2fca9f7944f07be7c55
SHA1 4c4b28f67d69b0ee696e6ce23e8473ec625cd337
SHA512 c786bdeaf87a3a26ace55d282653852507a6ddacaae6accf5146f3c2f74b6502b5f6f7f4c52d175caefb58c56e4408667ea46bc1bc7fadea355663c35ac2f879
SSDEEP 49152:Te79+J3XmUSGLLQ+CJl6EMDWUXN3Z41XmFaPFFuX/51Sxd3kk+H:TUW3X9SGLLQtMDWUXN3Z4BmFaqPbSxM
TLSH
T18BA59E2337D1C17BE1630530A95AA36987B6BE71AE254487E3843F1E1E709D2EC39B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop

File Explorer

2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop

.exe 2.0MB

2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop

IMPHASH 3f318661bc40ad065a0df16356ace0b1
SHA256 142cc262204c457812ec32b653409bb63d0a2d1e0b2a1086076203b0dc08da93
MD5 e4bc60adf37bd2fca9f7944f07be7c55
SHA1 4c4b28f67d69b0ee696e6ce23e8473ec625cd337
SHA512 c786bdeaf87a3a26ace55d282653852507a6ddacaae6accf5146f3c2f74b6502b5f6f7f4c52d175caefb58c56e4408667ea46bc1bc7fadea355663c35ac2f879
SSDEEP 49152:Te79+J3XmUSGLLQ+CJl6EMDWUXN3Z41XmFaPFFuX/51Sxd3kk+H:TUW3X9SGLLQtMDWUXN3Z4BmFaqPbSxM
TLSH
T18BA59E2337D1C17BE1630530A95AA36987B6BE71AE254487E3843F1E1E709D2EC39B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

86:73:44:95:e6:4d:54:aa:1d:a7:ea:92:f2:f0:98:53:82:e0:98:b2:2b:22:05:cc:2e:19:7b:43:b6:dd:26:02

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 14, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1039846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\953505\out\Release\QHSafeTray.pdb

kernel32

GetModuleHandleA GetExitCodeProcess lstrcmpW CreateEventA FlushInstructionCache RaiseException GetSystemTimeAsFileTime InterlockedIncrement GetTempPathW GetTempFileNameW FileTimeToSystemTime CompareFileTime CreateRemoteThread CopyFileW lstrlenA lstrcmpiA CreateFileA GetDriveTypeA GetCommandLineW FileTimeToLocalFileTime GetSystemTimes GetPrivateProfileSectionNamesW GetPrivateProfileSectionW GetLongPathNameW GetFileAttributesExA SetFileAttributesA DeleteFileA FreeConsole CreateDirectoryW GlobalFree ReleaseSemaphore GetTimeZoneInformation MulDiv GetCurrentDirectoryW SetCurrentDirectoryW GetLocalTime LocalFileTimeToFileTime GlobalAlloc GlobalLock GlobalUnlock IsBadReadPtr OpenEventW DisconnectNamedPipe GetFileTime GetComputerNameExW IsWow64Process CreateSemaphoreW GetLogicalDrives GetNativeSystemInfo MoveFileW GetFileSizeEx ReadProcessMemory GetCurrentThread GetStartupInfoW VirtualAllocEx WriteProcessMemory VirtualFreeEx ExitProcess SetEnvironmentVariableW QueryPerformanceCounter GlobalMemoryStatus WritePrivateProfileStringW GlobalMemoryStatusEx HeapFree GetProcessHeap HeapAlloc WideCharToMultiByte GetCurrentProcess lstrcmpA CreateWaitableTimerA GetExitCodeThread OpenEventA HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW SetFilePointerEx SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle HeapCreate GetDateFormatA GetTimeFormatA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA RtlUnwind GetCPInfo ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetVolumeInformationW DuplicateHandle CreateSemaphoreA CancelIo CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapSize HeapReAlloc HeapDestroy GetBinaryTypeW CreateProcessW LocalAlloc GetWindowsDirectoryW WTSGetActiveConsoleSessionId TerminateProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetSystemWindowsDirectoryW lstrlenW SetLastError ProcessIdToSessionId LoadLibraryA GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDirectoryW LoadLibraryExW MultiByteToWideChar ReleaseMutex CreateMutexW GetCurrentProcessId SizeofResource DeviceIoControl OpenMutexW GetDiskFreeSpaceExW UnmapViewOfFile MapViewOfFileEx CreateFileMappingW GetFileSize SetEndOfFile FlushFileBuffers SetFilePointer ReadFile GetCurrentThreadId FreeResource GetPrivateProfileIntW GetModuleFileNameW GetFileAttributesExW lstrcmpiW GetSystemInfo SetWaitableTimer GetSystemPowerStatus MoveFileExW GetFileAttributesW GetPrivateProfileStringW ExpandEnvironmentStringsW SystemTimeToFileTime GetSystemTime TerminateThread CreateThread ResetEvent GetOverlappedResult ReadDirectoryChangesW GetShortPathNameW OpenProcess InterlockedDecrement FindNextFileW FindFirstFileW ResumeThread SetEvent InterlockedCompareExchange Sleep InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount LocalFree GetLastError WaitForMultipleObjects WaitForSingleObject UnlockFile LockFile GetModuleHandleW GetVersionExW CreateEventW InterlockedExchange FindClose FreeLibrary GetProcAddress LoadLibraryW WriteFile CreateFileW DeleteFileW GetVersion CloseHandle FindResourceExW FindResourceW LoadResource LockResource CreateMutexA

user32

ExitWindowsEx LoadStringW PostMessageW GetWindowThreadProcessId UnregisterClassA IsWindowVisible GetSystemMetrics SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW KillTimer DestroyWindow SetTimer RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW FindWindowW SendMessageTimeoutW GetWindowPlacement ShowWindow EnableWindow GetParent SendMessageW SetWindowPos SetFocus IsWindowEnabled SetRectEmpty RegisterWindowMessageW MessageBoxW GetLastInputInfo MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW AllowSetForegroundWindow GetForegroundWindow AttachThreadInput SetForegroundWindow SetActiveWindow GetKeyboardState keybd_event GetWindowRect GetDesktopWindow WindowFromPoint MonitorFromRect InvalidateRect UpdateWindow GetActiveWindow WaitForInputIdle GetClientRect GetDC ReleaseDC IsDialogMessageW CopyRect MapWindowPoints MonitorFromWindow GetWindow GetMessageW TranslateMessage DispatchMessageW GetDlgItem DestroyIcon DrawIconEx IsRectEmpty OffsetRect SetWindowTextW DrawTextW PtInRect GetMessagePos ScreenToClient SetRect SetCursor GetClassLongW SetClassLongW SystemParametersInfoW IsWindow GetCursorPos GetAncestor GetWindowInfo GetShellWindow PostQuitMessage LoadImageW SwitchToThisWindow OpenInputDesktop CloseDesktop CharNextW wsprintfW PeekMessageW ClientToScreen FindWindowExW UpdateLayeredWindow InflateRect EnumWindows

gdi32

CreateFontW GetTextExtentPoint32W DeleteObject GetPixel DeleteDC GetObjectW GetObjectA GetDeviceCaps GetStockObject SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection GetTextMetricsW CreateRectRgnIndirect

advapi32

SetEntriesInAclW GetNamedSecurityInfoW CheckTokenMembership CreateWellKnownSid DuplicateToken RegCreateKeyA GetUserNameW LookupAccountNameW GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid RegCreateKeyW GetSidSubAuthority DuplicateTokenEx RegOpenKeyW CloseEventLog ReadEventLogW OpenEventLogW AdjustTokenPrivileges LookupPrivilegeValueW ConvertSidToStringSidW EqualSid AllocateAndInitializeSid GetTokenInformation FreeSid LookupAccountSidW ConvertStringSidToSidW OpenProcessToken CryptAcquireContextW CryptReleaseContext RegEnumValueW RegNotifyChangeKeyValue RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW StartServiceW QueryServiceStatus QueryServiceConfig2W ImpersonateLoggedOnUser RevertToSelf RegQueryInfoKeyW OpenThreadToken CryptGenRandom InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExA RegEnumKeyExA RegOpenKeyExA SetNamedSecurityInfoW

shell32

SHGetDataFromIDListW SHBindToParent SHParseDisplayName SHGetSpecialFolderPathW SHGetFolderPathW ord165 ShellExecuteExW SHGetFileInfoW ExtractIconExW CommandLineToArgvW Shell_NotifyIconW SHCreateDirectoryExW ShellExecuteW ord680

ole32

CoTaskMemAlloc CoTaskMemRealloc CoInitializeSecurity CoInitializeEx GetHGlobalFromStream StringFromGUID2 CreateStreamOnHGlobal CoUninitialize CoCreateInstance CoInitialize CoTaskMemFree

oleaut32

VarUI4FromStr VarBstrCmp SafeArrayUnlock SafeArrayLock SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound VariantCopy SafeArrayCopy SafeArrayGetVartype DispCallFunc SafeArrayPutElement SafeArrayCreate SysAllocStringByteLen SysAllocString SysFreeString VariantClear VariantInit

shlwapi

StrStrW StrRStrIW StrFormatByteSizeW PathFileExistsW SHGetValueW PathFindExtensionW PathFindFileNameW StrStrIW StrCmpIW PathAppendW PathCombineW PathRemoveFileSpecW PathIsDirectoryW wnsprintfW SHSetValueW SHDeleteValueW StrStrIA PathRemoveExtensionW AssocQueryStringW PathUnquoteSpacesW SHDeleteKeyW SHGetValueA SHDeleteValueA SHSetValueA PathRemoveBackslashW PathFileExistsA PathCombineA PathStripToRootW ord437 PathStripPathW PathCompactPathW PathFindFileNameA ColorRGBToHLS ColorHLSToRGB PathIsPrefixW

comctl32

InitCommonControlsEx

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData LsaEnumerateLogonSessions

gdiplus

GdipSaveImageToFile GdipGetImageEncoders GdipGetImageEncodersSize GdipSetInterpolationMode GdipCreateBitmapFromStream GdipResetWorldTransform GdipRotateWorldTransform GdipTranslateWorldTransform GdipPrivateAddMemoryFont GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipDrawImageRectRectI GdipDrawLine GdipAddPathEllipseI GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateFromHWND GdipGetFontHeight GdipResetClip GdipSetClipRectI GdipSetTextRenderingHint GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipSetLinePresetBlend GdipCreatePen2 GdipDrawRectangleI GdipCreateLineBrushFromRect GdipAddPathRectangleI GdipGetPixelOffsetMode GdipSetPenWidth GdipDrawEllipseI GdipSetPenDashOffset GdipAddPathLineI GdipSetPixelOffsetMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipDrawPath GdipFillPath GdipSetSmoothingMode GdipGetSmoothingMode GdipDeletePath GdipCreatePath GdipFillRectangleI GdipCreateLineBrushFromRectI GdipClosePathFigure GdipAddPathArcI GdipResetPath GdipDrawString GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipFillRectangle GdipMeasureString GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawRectangle GdipDrawLineI GdipSetPenDashStyle GdipDeletePen GdipCreatePen1 GdipDeleteGraphics GdipCreateFromHDC GdipBitmapSetPixel GdipBitmapGetPixel GdipGetImageHeight GdipGetImageWidth GdipCreateBitmapFromFile GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipCreateFont

winmm

timeGetTime

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetGetConnectedState InternetCrackUrlA

powrprof

GetPwrCapabilities

wtsapi32

WTSUnRegisterSessionNotification WTSQuerySessionInformationW WTSFreeMemory WTSRegisterSessionNotification

userenv

GetUserProfileDirectoryW

dnsapi

DnsQuery_A DnsFree

ws2_32

inet_ntoa htons ntohs htonl ntohl

rpcrt4

RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcStringFreeW RpcBindingFree NdrAsyncClientCall NdrClientCall2 RpcAsyncCompleteCall RpcStringBindingComposeW

crypt32

CryptProtectData CryptUnprotectData

imm32

ImmDisableIME

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_e4bc60adf37bd2fca9f7944f07be7c55_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_stop

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

secur32

gdiplus

winmm

version

wininet

powrprof

wtsapi32

userenv

dnsapi

ws2_32

rpcrt4

crypt32

imm32

generic