General
- Target 2026-08-09_3a3d27fb8e157c61cde7d13fd8d8a5a9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.0MB
- Sample260809-ryl3eszdjh
- SHA256 c7adafdc08103c7e561b3877db45f0e364c18ca31e200aeeafd10da8aae352e3
- MD5 3a3d27fb8e157c61cde7d13fd8d8a5a9
- SHA1 01e9f982c23da5423d17381b58758bd6ebdf418e
- SHA512 a4ee1be4fb918643c1f38769b698f973f5a34b5065135825f5ebcdbea05ee01f3a17af26650dc8bb51c2b5f22a3699aa4280e27685ca9ca88b56c82807cc4cb7
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx91Dhizz+ig:1hLoBdqTDtSQWGtzP1
- TLSH T12135D011F3E44831F1B6867869FAD7218A3EBD011B36D6DF6B84575E1E32694CA31323
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_3a3d27fb8e157c61cde7d13fd8d8a5a9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_3a3d27fb8e157c61cde7d13fd8d8a5a9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.0MB
- SHA256 c7adafdc08103c7e561b3877db45f0e364c18ca31e200aeeafd10da8aae352e3
- MD5 3a3d27fb8e157c61cde7d13fd8d8a5a9
- SHA1 01e9f982c23da5423d17381b58758bd6ebdf418e
- SHA512 a4ee1be4fb918643c1f38769b698f973f5a34b5065135825f5ebcdbea05ee01f3a17af26650dc8bb51c2b5f22a3699aa4280e27685ca9ca88b56c82807cc4cb7
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx91Dhizz+ig:1hLoBdqTDtSQWGtzP1
- TLSH T12135D011F3E44831F1B6867869FAD7218A3EBD011B36D6DF6B84575E1E32694CA31323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Reflective DLL injection artifacts
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory