2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 10.0MB
Sample260813-mab54awvbv
SHA256 1063f807e5cf35e2cfb01759c7c42498cf09543c96622c99f15a28376873c470
MD5 25ad3156b29d66a6dbd26316817e362c
SHA1 0ec034c4d67b7f2c721c78413c9d515b0fc218b3
SHA512 25c7b12da79850c1efc88abc0645fea73ca36ff15318a09e0fcc4a7e7493b037db218f1a91221636ffb5a9cc5027ad7ba5a03d068f24eeb2664c0598b36847c0
SSDEEP 196608:qQ9TUK1Vweb/OlYduauQO8ljwNTaszEXSItkDrHCK/oUZG:qIweb2lM1dljwNTa7PtkDriQHw
TLSH
T122B68D11B7D08035E1B315B18A7AD27AA6797D310B3185CF63D06E6E1F32AD2AE35327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 10.0MB

2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH ace9cead3de86c57057f732e344e8789
SHA256 1063f807e5cf35e2cfb01759c7c42498cf09543c96622c99f15a28376873c470
MD5 25ad3156b29d66a6dbd26316817e362c
SHA1 0ec034c4d67b7f2c721c78413c9d515b0fc218b3
SHA512 25c7b12da79850c1efc88abc0645fea73ca36ff15318a09e0fcc4a7e7493b037db218f1a91221636ffb5a9cc5027ad7ba5a03d068f24eeb2664c0598b36847c0
SSDEEP 196608:qQ9TUK1Vweb/OlYduauQO8ljwNTaszEXSItkDrHCK/oUZG:qIweb2lM1dljwNTa7PtkDriQHw
TLSH
T122B68D11B7D08035E1B315B18A7AD27AA6797D310B3185CF63D06E6E1F32AD2AE35327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

61:d4:13:ec:53:38:39:1e:bf:c8:d5:1a:40:c0:8b:2b:26:df:a9:3c:ce:bb:3f:39:22:38:71:6e:46:2f:81:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=南京思智信息科技有限公司,O=南京思智信息科技有限公司,L=南京,ST=江苏,C=CN

Chains

Aug 6, 2026

CN=南京思智信息科技有限公司,O=南京思智信息科技有限公司,L=南京,ST=江苏,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

CN=南京思智信息科技有限公司,O=南京思智信息科技有限公司,L=南京,ST=江苏,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

14:ea:26:58:49:85:e8:40:ab:2a:5e:53:97:66:18:3a:33:37:b4:65

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nanjing Sizhi Info Tech Co.\,Ltd.,O=Nanjing Sizhi Info Tech Co.\,Ltd.,L=南京市,ST=中国江苏省南京市,C=CN

Chains

Aug 6, 2026

CN=Nanjing Sizhi Info Tech Co.\,Ltd.,O=Nanjing Sizhi Info Tech Co.\,Ltd.,L=南京市,ST=中国江苏省南京市,C=CN

Subject

CN=Nanjing Sizhi Info Tech Co.\,Ltd.,O=Nanjing Sizhi Info Tech Co.\,Ltd.,L=南京市,ST=中国江苏省南京市,C=CN

Serial Number

66:7a:ad:4c:eb:22:39:62:e6:b1:b0:27:cd:68:83:1c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2015 - Jun 19, 2017

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=南京思智信息科技有限公司,O=南京思智信息科技有限公司,L=南京,ST=江苏,C=CN

Serial Number

0a:cb:0b:d8:27:00:4b:b3:d3:35:6d:26:b6:5f:49:79

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2017 - Jun 7, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

8661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Build\App\code\Tools\DebugTools\Release\AppTool.pdb

shlwapi

PathIsDirectoryW PathAppendW

kernel32

CreateDirectoryW GetSystemTimeAsFileTime GetCurrentProcessId FindResourceW GetLastError LoadResource SizeofResource LockResource CreateFileW WriteFile CloseHandle CreateProcessW OutputDebugStringW RemoveDirectoryW InterlockedExchange GetVersionExW GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW InterlockedCompareExchange Sleep

user32

EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW PostQuitMessage RegisterClassExW LoadCursorW LoadIconW LoadStringW MessageBoxW EndDialog

shell32

SHGetFolderPathW SHFileOperationW

msvcr90

_swprintf _controlfp_s _invoke_watson _except_handler4_common _decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ _crt_debugger_hook __set_app_type memset _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_25ad3156b29d66a6dbd26316817e362c_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

PE Signature issue

shlwapi

kernel32

user32

shell32

msvcr90

generic