General
- Target 2026-08-12_8a4e4fc3c25692addfd9391f8b69bc04_amadey_coinminer_darkgate_elex_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop
- Size 742KB
- Sample260812-rssm1swzhv
- SHA256 92e495884ca1c0272e61a3e03de85e7c8b6cc398b48301e9234099f5b1631d67
- MD5 8a4e4fc3c25692addfd9391f8b69bc04
- SHA1 ff8ababb74dc5111d7f63f7c0623c98e19f82aae
- SHA512 855554e53a5fe72fb28184dc2324d2245c4bc9d97311fec1f07569c1d1d36b2efe0cf5e850d1f75a2cdb25f51d6e16c8ba55bdd339ce5b0558be76240e97372c
- SSDEEP 12288:QmhjkdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxvB:nhgalj3DSudvGM3MXTVhtSQWGtx5
- TLSH T158F40211B2E58032F46A52344979D7614B3EBD529BA4D0DF7BC824AE2E726D1CF3036B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-12_8a4e4fc3c25692addfd9391f8b69bc04_amadey_coinminer_darkgate_elex_manuscrypt_njrat_rhadaman.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_8a4e4fc3c25692addfd9391f8b69bc04_amadey_coinminer_darkgate_elex_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop
- Size 742KB
- SHA256 92e495884ca1c0272e61a3e03de85e7c8b6cc398b48301e9234099f5b1631d67
- MD5 8a4e4fc3c25692addfd9391f8b69bc04
- SHA1 ff8ababb74dc5111d7f63f7c0623c98e19f82aae
- SHA512 855554e53a5fe72fb28184dc2324d2245c4bc9d97311fec1f07569c1d1d36b2efe0cf5e850d1f75a2cdb25f51d6e16c8ba55bdd339ce5b0558be76240e97372c
- SSDEEP 12288:QmhjkdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxvB:nhgalj3DSudvGM3MXTVhtSQWGtx5
- TLSH T158F40211B2E58032F46A52344979D7614B3EBD529BA4D0DF7BC824AE2E726D1CF3036B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Reflective DLL injection artifacts
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory