2026-08-07_0c20e5691faf89b6035c729c8da34540_amadey_coinminer_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

General

Target
2026-08-07_0c20e5691faf89b6035c729c8da34540_amadey_coinminer_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
Size 4.7MB
Sample260808-cczn3abb59
SHA256 08ee99e45d3ca9f79e9b48f32cfd31e34e78445b7cbe900d233225da213a18b8
MD5 0c20e5691faf89b6035c729c8da34540
SHA1 6f9aa15d4fabc086319862a1501a8e7be571ef40
SHA512 f031d0f22292fd004d27cbe67c73fbc7631aeb037876f546ce681e9e29d83e260670228dc85d8d270e999ef2974d03fbd6f225df9831f051ead3705cb322cded
SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBe:+stsF7IabjKoh9WyV2Vlx/hv7St0OgK6
TLSH
T138368E217BF48075E0B796B1A9BA8356D9727C604B7086CF6390763E5F32BD05A72323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_0c20e5691faf89b6035c729c8da34540_amadey_coinminer_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

2026-08-07_0c20e5691faf89b6035c729c8da34540_amadey_coinminer_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar

.exe 4.7MB

SHA256 08ee99e45d3ca9f79e9b48f32cfd31e34e78445b7cbe900d233225da213a18b8
MD5 0c20e5691faf89b6035c729c8da34540
SHA1 6f9aa15d4fabc086319862a1501a8e7be571ef40
SHA512 f031d0f22292fd004d27cbe67c73fbc7631aeb037876f546ce681e9e29d83e260670228dc85d8d270e999ef2974d03fbd6f225df9831f051ead3705cb322cded
SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBe:+stsF7IabjKoh9WyV2Vlx/hv7St0OgK6
TLSH
T138368E217BF48075E0B796B1A9BA8356D9727C604B7086CF6390763E5F32BD05A72323
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with ASPack
ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths