2026-07-28_9655e80db40d1e7aa518497fc2d6ef75_amadey_coinminer_darkgate_elex_maze_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_9655e80db40d1e7aa518497fc2d6ef75_amadey_coinminer_darkgate_elex_maze_remcos_smoke-loader_stop
Size 6.5MB
Sample260728-e83fyayand
SHA256 5c4d7c3146db8c5d3369af94fe0bbd12b773ede11959800fb0c43bfcaca43b58
MD5 9655e80db40d1e7aa518497fc2d6ef75
SHA1 be07ff32d6bf620166f4ce392aa632a361823289
SHA512 662a72ac957886ca83e5aa7de23f6744e088f1dd479221afe5ea6bcb1c6eb77204070186b5f8c98d35a66374ac60c3186006168ff2357587f717f8b6943509f6
SSDEEP 98304:5uIvRXGNq9I13NpDBRYhdLyFfqZ8d/E71XZ8gfMfA0AE+MKoRNKsedAnC+:AIvRWN02NlLYrLAhEYPaoRMbdd+
TLSH
T16466F121F7A9C071D69A04314539AF3A007DFE26472198C7B3C46F2FFE319D2AA35A56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-28_9655e80db40d1e7aa518497fc2d6ef75_amadey_coinminer_darkgate_elex_maze_remcos_smoke-loader_stop

.exe 6.5MB

2026-07-28_9655e80db40d1e7aa518497fc2d6ef75_amadey_coinminer_darkgate_elex_maze_remcos_smoke-loader_stop

IMPHASH a7334470dc3819101c1ccb812b85fb31
SHA256 5c4d7c3146db8c5d3369af94fe0bbd12b773ede11959800fb0c43bfcaca43b58
MD5 9655e80db40d1e7aa518497fc2d6ef75
SHA1 be07ff32d6bf620166f4ce392aa632a361823289
SHA512 662a72ac957886ca83e5aa7de23f6744e088f1dd479221afe5ea6bcb1c6eb77204070186b5f8c98d35a66374ac60c3186006168ff2357587f717f8b6943509f6
SSDEEP 98304:5uIvRXGNq9I13NpDBRYhdLyFfqZ8d/E71XZ8gfMfA0AE+MKoRNKsedAnC+:AIvRWN02NlLYrLAhEYPaoRMbdd+
TLSH
T16466F121F7A9C071D69A04314539AF3A007DFE26472198C7B3C46F2FFE319D2AA35A56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f6:e8:10:2d:bf:11:a9:7d:0f:32:5f:73:b3:97:3f:0f:df:b5:ae:3c:82:8a:7d:0a:14:0b:9a:95:a5:83:7b:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 30, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

77:d9:12:68:10:b4:7a:d8:41:65:66:51

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 8, 2024 - Feb 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

573055

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\code\360GameWd\bin\Release\360GameWDDownLoader.pdb

kernel32

DeleteFileW FlushInstructionCache MoveFileW Sleep GetTempPathW GetTempFileNameW lstrlenW CopyFileW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW CreateDirectoryW RemoveDirectoryW MoveFileExW GetVersionExW TerminateProcess WaitForMultipleObjects LoadLibraryExA DecodePointer InterlockedIncrement LoadLibraryExW lstrcmpiW WriteProcessMemory VirtualAllocEx DuplicateHandle OpenProcess ReadProcessMemory VirtualFreeEx InterlockedDecrement SetCurrentDirectoryW GlobalUnlock GlobalSize GlobalLock FindClose FindNextFileW FindFirstFileW RaiseException GetTickCount GetCurrentThreadId LeaveCriticalSection EnterCriticalSection FreeLibrary DeleteCriticalSection InitializeCriticalSection CreateProcessW GetModuleFileNameW GetCurrentProcessId DeviceIoControl SuspendThread ResumeThread TerminateThread SetThreadPriority WaitForSingleObject SetEvent CreateEventW GetPrivateProfileStringW WritePrivateProfileStringW GetFileSize GetPrivateProfileStringA WritePrivateProfileStringA ReleaseSemaphore GetCurrentProcess SetLastError GetProcAddress GetCurrentThread LoadLibraryW GetModuleHandleW ReadFile GetFileSizeEx LocalFree WideCharToMultiByte MultiByteToWideChar FindResourceExW FindResourceW LoadResource LockResource SizeofResource WriteFile CreateFileW SetFileAttributesW GetFileAttributesW WaitForSingleObjectEx ReleaseMutex GetSystemInfo GlobalMemoryStatusEx FreeResource VerSetConditionMask VerifyVersionInfoW MulDiv GlobalFree GlobalAlloc lstrcmpW InterlockedExchange SetFileTime SetFilePointer HeapWalk HeapLock OpenThread HeapUnlock GetSystemTime FormatMessageW SetEndOfFile LocalFileTimeToFileTime SystemTimeToFileTime CreateFileA SetThreadContext GetThreadContext InterlockedCompareExchange VirtualProtect VirtualQuery SetEnvironmentVariableA FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP FreeEnvironmentStringsW CreateMutexW CloseHandle GetLastError InitializeCriticalSectionAndSpinCount GetProcessHeap HeapAlloc GetEnvironmentStringsW QueryPerformanceCounter GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation CreateSemaphoreW GetStartupInfoW TlsFree HeapFree HeapReAlloc HeapSize HeapDestroy TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleHandleExW ExitProcess RtlUnwind GetCommandLineW GetFileAttributesExW GetSystemTimeAsFileTime ExitThread CreateThread EncodePointer VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent ReadConsoleW

user32

GetWindowLongW PostMessageW DefWindowProcW IsWindow MsgWaitForMultipleObjects PeekMessageW GetMessageW TranslateMessage RegisterClassExW CreateWindowExW SetWindowLongW DestroyWindow UnregisterClassW MapWindowPoints GetClientRect GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow ShowWindow GetKeyState GetFocus SetParent CharNextW PostQuitMessage CallWindowProcW GetClassInfoExW LoadCursorW KillTimer SetWindowPos OffsetRect GetParent SendMessageW DispatchMessageW SetTimer PostThreadMessageW GetDC ReleaseDC DrawTextW SetCapture ReleaseCapture GetForegroundWindow AttachThreadInput SetForegroundWindow BringWindowToTop SwitchToThisWindow SetFocus BeginPaint EndPaint UpdateLayeredWindow ScreenToClient IsZoomed SystemParametersInfoW GetMessagePos SetWindowRgn SetClassLongW DrawIcon DrawIconEx GetIconInfo FillRect CopyRect RedrawWindow ClientToScreen TrackMouseEvent IsRectEmpty IntersectRect InflateRect SubtractRect SetRect RegisterClipboardFormatW HideCaret SetCursor GetSysColor PtInRect GetCursorPos GetCaretBlinkTime GetAsyncKeyState UnionRect IsGUIThread AnimateWindow GetSystemMetrics SetWindowTextW LoadImageW InvalidateRect GetWindowThreadProcessId MessageBoxW

gdi32

DeleteDC SelectObject SetBkMode GetTextExtentPoint32W DeleteObject CreateCompatibleDC CreateRoundRectRgn CreateRectRgn CombineRgn CreatePen MoveToEx LineTo GetObjectA CreateSolidBrush Rectangle RoundRect GetObjectW CreateDCW CreateFontW CreateCompatibleBitmap GetBitmapBits SetBitmapBits SetTextColor BitBlt StretchBlt CreateFontIndirectW SetStretchBltMode SetViewportOrgEx GetDeviceCaps SetDIBColorTable GetStockObject CreateDIBSection GetDIBits

advapi32

RegQueryValueExA RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetMalloc ShellExecuteW ord165 SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderPathW SHGetSpecialFolderLocation

ole32

CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoInitialize CoCreateInstance GetHGlobalFromStream CoMarshalInterface CreateStreamOnHGlobal OleCreate OleSetContainedObject OleInitialize OleUninitialize CoTaskMemFree StringFromCLSID CoCreateGuid

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantInit VariantClear VariantCopy VarUI4FromStr

shlwapi

PathBuildRootW PathIsRootW PathMatchSpecW SHDeleteKeyW PathFindExtensionW PathGetDriveNumberW SHSetValueW StrCmpNIW SHGetValueW PathCombineW PathFindFileNameW SHRegGetPathW SHDeleteValueW PathAddBackslashW PathIsDirectoryW PathFileExistsW PathAppendW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CryptUnprotectData CryptProtectData

psapi

EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW EnumProcesses

gdiplus

GdiplusShutdown GdipAddPathLineI GdipAddPathArcI GdipClonePath GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipSetInterpolationMode GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDrawImageI GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipGetImagePixelFormat GdiplusStartup GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectI GdipReleaseDC GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorKeys GdipDrawImageRectRectI GdipGetImageHeight GdipGetImageWidth GdipCreateTexture2I GdipDeleteBrush GdipTranslateTextureTransform GdipFillRectangleI GdipCreatePen1 GdipDeletePen GdipDrawLineI GdipCreateSolidFill GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipMeasureString GdipDrawRectangleI GdipFillPath GdipDrawPath GdipDeletePath GdipCreateBitmapFromFile GdipCreatePath

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetSetStatusCallbackW InternetGetCookieW InternetSetCookieW InternetOpenW InternetCloseHandle InternetReadFile HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW DeleteUrlCacheEntryW HttpSendRequestExA InternetCrackUrlW InternetSetOptionW InternetOpenA HttpQueryInfoW HttpAddRequestHeadersA InternetSetCookieA HttpQueryInfoA InternetQueryOptionA InternetWriteFile InternetReadFileExA InternetConnectW HttpEndRequestW

msimg32

TransparentBlt AlphaBlend

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_9655e80db40d1e7aa518497fc2d6ef75_amadey_coinminer_darkgate_elex_maze_remcos_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

psapi

gdiplus

imm32

version

wininet

msimg32

generic