General
- Target 2026-08-09_d2060dfe2fc4dc1df8c532316b62ad3a_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.0MB
- Sample260809-qw6hlsfp6t
- SHA256 c66a2e4aab0f2f721fdee1eb0e22149d31d006ecec443842cccda03dc61f5703
- MD5 d2060dfe2fc4dc1df8c532316b62ad3a
- SHA1 f1bd9aa582c5d9c11fe65fd94fa44f30742f74f7
- SHA512 2c79df8498167fedb27a63258dc59d14cbf4c20c93d8082f725ce75251cb9553900bd0155a5c2d74a5f7361ffbcd5d26cb44aafeba530c08600ea33db0f3b3e9
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxnm4SxYHA22KRSao+:1hLoBdqTDtSQWGth9SxYp2t+
- TLSH T1B935E110B3C08971E2AB86B895F9D721973EBA410731D6CF7B849BAA2D317D0DA31357
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_d2060dfe2fc4dc1df8c532316b62ad3a_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_d2060dfe2fc4dc1df8c532316b62ad3a_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.0MB
- SHA256 c66a2e4aab0f2f721fdee1eb0e22149d31d006ecec443842cccda03dc61f5703
- MD5 d2060dfe2fc4dc1df8c532316b62ad3a
- SHA1 f1bd9aa582c5d9c11fe65fd94fa44f30742f74f7
- SHA512 2c79df8498167fedb27a63258dc59d14cbf4c20c93d8082f725ce75251cb9553900bd0155a5c2d74a5f7361ffbcd5d26cb44aafeba530c08600ea33db0f3b3e9
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxnm4SxYHA22KRSao+:1hLoBdqTDtSQWGth9SxYp2t+
- TLSH T1B935E110B3C08971E2AB86B895F9D721973EBA410731D6CF7B849BAA2D317D0DA31357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Reflective DLL injection artifacts
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory