2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee
Size 3.5MB
Sample260808-xntbmscl81
SHA256 fc4f90e657c7799b1f4231d5af5953590ba64272e8af16e7e0801694ae28e986
MD5 2f8e2f39a91a24a6db4cff7783c0b162
SHA1 11697392d2e646166fc6489a24dd5d655936ad74
SHA512 694a44f3b1e69bd23d80c58668846dd6138a1e958086b01225e575a714a08ce5f7c6346f8ed022e2d93eba89139aa28f5806bfc10f7aa74f5308607beca2ef15
SSDEEP 49152:dHK3ocHZd9i+Rj8HhL+BuHcoTdaYWVegnnqrSeyt4GcokGzrTrURQb0bHj5NB:MT9lRIBWuBhBgqrSeuXkurUjbjbB
TLSH
T10506D013B651C0B2D249267116F6173DAF78DF110EB1CA43EB94EEBA2D716618F2720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee

.exe 3.5MB

2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH a153bc36d0c81c18e53a59cbd1393e03
SHA256 fc4f90e657c7799b1f4231d5af5953590ba64272e8af16e7e0801694ae28e986
MD5 2f8e2f39a91a24a6db4cff7783c0b162
SHA1 11697392d2e646166fc6489a24dd5d655936ad74
SHA512 694a44f3b1e69bd23d80c58668846dd6138a1e958086b01225e575a714a08ce5f7c6346f8ed022e2d93eba89139aa28f5806bfc10f7aa74f5308607beca2ef15
SSDEEP 49152:dHK3ocHZd9i+Rj8HhL+BuHcoTdaYWVegnnqrSeyt4GcokGzrTrURQb0bHj5NB:MT9lRIBWuBhBgqrSeuXkurUjbjbB
TLSH
T10506D013B651C0B2D249267116F6173DAF78DF110EB1CA43EB94EEBA2D716618F2720E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78921

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LCMapStringA LoadLibraryA GetProcAddress FreeLibrary GetCommandLineA WriteFile FindFirstFileA RemoveDirectoryA DeleteFileA FindNextFileA FindClose FormatMessageA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID WideCharToMultiByte MultiByteToWideChar GetFileSize ReadFile CloseHandle GetTickCount Sleep IsBadReadPtr HeapFree lstrlenA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA GetVersionExA GetLastError HeapReAlloc GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom LocalAlloc LocalFree InitializeCriticalSection TlsAlloc DeleteCriticalSection GlobalHandle TlsFree LeaveCriticalSection GlobalReAlloc EnterCriticalSection TlsSetValue LocalReAlloc TlsGetValue lstrcpynA MulDiv GlobalFlags InterlockedDecrement WritePrivateProfileStringA lstrcatA lstrcpyA InterlockedIncrement SetLastError GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetVersion LockResource LoadResource FindResourceA GetProcessVersion SetErrorMode SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadCodePtr SetStdHandle HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap RtlMoveMemory SetWaitableTimer CreateWaitableTimerA GetCurrentProcessId TerminateProcess OpenProcess CreateProcessA Process32Next Process32First CreateToolhelp32Snapshot MoveFileA CreateDirectoryA GetModuleFileNameA CreateFileA GetCurrentProcess lstrcpyn

user32

IsIconic SystemParametersInfoA RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect SetFocus AdjustWindowRectEx GetSysColor MapWindowPoints UpdateWindow LoadIconA LoadCursorA GetSysColorBrush LoadStringA UnregisterClassA PostThreadMessageA DestroyMenu CreateDialogIndirectParamA EndDialog IsWindowVisible GetCursorPos SetWindowsHookExA GetWindowPlacement GetWindowLongA SetCursor SendMessageA PostMessageA PostQuitMessage SetForegroundWindow SetActiveWindow GetActiveWindow IsWindow GetForegroundWindow IsWindowEnabled GetParent EnableWindow ShowWindow SetWindowPos SetWindowLongA IsDialogMessageA SendDlgItemMessageA GetDlgItem GrayStringA DrawTextA TabbedTextOutA ReleaseDC GetDC GetMenuItemCount UnhookWindowsHookEx GetWindowTextA SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RegisterClipboardFormatA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem GetLastActivePopup GetSystemMetrics EnableMenuItem GetFocus GetNextDlgTabItem GetKeyState CallNextHookEx PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA MsgWaitForMultipleObjects ValidateRect

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx CreateBitmap ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetObjectA GetStockObject SetMapMode SetTextColor SetBkColor SelectObject RestoreDC SaveDC DeleteDC DeleteObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetDeviceCaps

advapi32

CryptGetHashParam CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun OleInitialize OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard

shlwapi

PathFileExistsA

oledlg

ord8

oleaut32

SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate RegisterTypeLi LHashValOfNameSys LoadTypeLi VarR8FromBool VarR8FromCy SysFreeString SafeArrayGetElemsize SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim VariantCopy SafeArrayAllocData SafeArrayAllocDescriptor VariantInit VariantChangeType

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comctl32

ord17

shell32

SHGetSpecialFolderPathA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_2f8e2f39a91a24a6db4cff7783c0b162_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

ole32

shlwapi

oledlg

oleaut32

winspool.drv

comctl32

shell32

generic