2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar

General

Target
2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar
Size 55.2MB
Sample260820-161efswfkd
SHA256 d1a88ad6b1c9ea37fee1845ca3c8a5545a333bfa9894ff27c6e08cc97b87872e
MD5 106875b4429e3c32895f2e57ce56b127
SHA1 4eedf078ae77309784b9f6f314ef4f7edecd7c96
SHA512 12c80446dee101c82bdd319c3c349b967d492301a114f46e6022517b5b34959e9eef7db41d792bd4a040d252d4629b4c851b8f6b8e1187e3a0cefbe11e0059d8
SSDEEP 786432:nJaYwHhbp1YDNaPjXqOpcEk3WZ8jqsGpmaOJPu+UUHvOJzm:nwxhbpmDNqqqcwyRGpYJPfUUP2m
TLSH
T172C7D026B2E54077E5FBC6308DB35686FE3339B757A099DB01A452280F237C09E7A719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar

File Explorer

2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar

.exe 55.2MB

2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar

IMPHASH 4ff73005de4182db4b8810c301e6b83d
SHA256 d1a88ad6b1c9ea37fee1845ca3c8a5545a333bfa9894ff27c6e08cc97b87872e
MD5 106875b4429e3c32895f2e57ce56b127
SHA1 4eedf078ae77309784b9f6f314ef4f7edecd7c96
SHA512 12c80446dee101c82bdd319c3c349b967d492301a114f46e6022517b5b34959e9eef7db41d792bd4a040d252d4629b4c851b8f6b8e1187e3a0cefbe11e0059d8
SSDEEP 786432:nJaYwHhbp1YDNaPjXqOpcEk3WZ8jqsGpmaOJPu+UUHvOJzm:nwxhbpmDNqqqcwyRGpYJPfUUP2m
TLSH
T172C7D026B2E54077E5FBC6308DB35686FE3339B757A099DB01A452280F237C09E7A719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

5356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-18278582\vos3\thinstall\modules\boot_loader64.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlCreateAcl RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess NtQueryInformationProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtWriteVirtualMemory LdrUnloadDll LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtOpenSection NtProtectVirtualMemory NtUnmapViewOfSection NtClose RtlNtStatusToDosError NtCreateEvent RtlAddAccessAllowedAce

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_106875b4429e3c32895f2e57ce56b127_coinminer_darkgate_gcleaner_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_vidar

kernel32

user32

ntdll

generic