galaxyrat | 2026-07-30_52be6c532026a31e916242ab4a2832f2_amadey_betabot_coinminer_darkgate_elex_glassworm_hijackloader_icedid_magniber_manuscrypt_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-07-30_52be6c532026a31e916242ab4a2832f2_amadey_betabot_coinminer_darkgate_elex_glassworm_hijackloader_icedid_magniber_manuscrypt_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 52.8MB
Sample260730-d2cfhabb49
SHA256 ad25aedf69156957ab6bc33c303656ac0123df325316bfa3b1783311f88c0d23
MD5 52be6c532026a31e916242ab4a2832f2
SHA1 c7cde2397efb960cdfcce7f7ce94726c2fbaddf2
SHA512 6f0208d36ca3c5c3549428d652a7b166fcc5e86a3f1b25f41c094662c1eecc6dcbdc17c58f6d881a252ecf9513d0927f551807454a563118673116d2fbbbb49e
SSDEEP 393216:ys1paQGgbzWFI3qv3A2r7zzIaf/1CPwDv3uFQxU2lvzbPH:yIgKBSRTBPH
TLSH
T1AEC7CF05AF8D4271C0561174532A9F36A53ABC11773096C7B2B8AE7DFE237C1DA3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat galaxyrat

Malware Config

Signatures

Family: GalaxyRAT
GalaxyRAT is a Windows RAT written in C#.
rat galaxyrat

Detects GalaxyRAT 1 IoCs

resource	yara_rule
sample	family_galaxyrat

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_52be6c532026a31e916242ab4a2832f2_amadey_betabot_coinminer_darkgate_elex_glassworm_hijackloader_icedid_magniber_manuscrypt_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-30_52be6c532026a31e916242ab4a2832f2_amadey_betabot_coinminer_darkgate_elex_glassworm_hijackloader_icedid_magniber_manuscrypt_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

.exe 52.8MB

2026-07-30_52be6c532026a31e916242ab4a2832f2_amadey_betabot_coinminer_darkgate_elex_glassworm_hijackloader_icedid_magniber_manuscrypt_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 9158747dc6240279afce84ac4d726c82
SHA256 ad25aedf69156957ab6bc33c303656ac0123df325316bfa3b1783311f88c0d23
MD5 52be6c532026a31e916242ab4a2832f2
SHA1 c7cde2397efb960cdfcce7f7ce94726c2fbaddf2
SHA512 6f0208d36ca3c5c3549428d652a7b166fcc5e86a3f1b25f41c094662c1eecc6dcbdc17c58f6d881a252ecf9513d0927f551807454a563118673116d2fbbbb49e
SSDEEP 393216:ys1paQGgbzWFI3qv3A2r7zzIaf/1CPwDv3uFQxU2lvzbPH:yIgKBSRTBPH
TLSH
T1AEC7CF05AF8D4271C0561174532A9F36A53ABC11773096C7B2B8AE7DFE237C1DA3A326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects GalaxyRAT
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-23148499\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtProtectVirtualMemory NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrUnloadDll RtlCreateAcl

Sharing