General
- Target 2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 782KB
- Sample260823-d67gfaxtcy
- SHA256 9452f98e1f6eae18fbef56a876aa8daa02fcd372e8e4b404f6a2b71a84183034
- MD5 a1846893e866b8cc9192bb0d30489a8f
- SHA1 cbbb5b88277e7833c83305a1fd467192208e491f
- SHA512 45d115f31a0bb5ed110c39cefbbd2e9c296024baab0e4d7ac682aa4271ee579787b888b36d2a12acbabfdf6c7bbb28c298f29a26746377ee9d0473465c43f85b
- SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx+cXh:1hLalj3DSudvGM3MXTVhtSQWGtx+cXh
- TLSH T1B7051221B5D18032F06351308AB9DBB29B2FBD625BB480CF678845AE1E716E1DF3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 782KB
- SHA256 9452f98e1f6eae18fbef56a876aa8daa02fcd372e8e4b404f6a2b71a84183034
- MD5 a1846893e866b8cc9192bb0d30489a8f
- SHA1 cbbb5b88277e7833c83305a1fd467192208e491f
- SHA512 45d115f31a0bb5ed110c39cefbbd2e9c296024baab0e4d7ac682aa4271ee579787b888b36d2a12acbabfdf6c7bbb28c298f29a26746377ee9d0473465c43f85b
- SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx+cXh:1hLalj3DSudvGM3MXTVhtSQWGtx+cXh
- TLSH T1B7051221B5D18032F06351308AB9DBB29B2FBD625BB480CF678845AE1E716E1DF3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Reflective DLL injection artifacts
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory