General
- Target 2026-08-23_ab07d56a6e7f65c7da9f0578448a73fb_amadey_coinminer_darkgate_elex_emotet_glassworm_luca-stealer_magniber_njrat_remcos_zxxz
- Size 81.9MB
- Sample260824-cd8ncsxvcw
- SHA256 071aea549e741ccbae9482fb9105436cfd5e6b2b7cf67b5d367fc5c81a35395b
- MD5 ab07d56a6e7f65c7da9f0578448a73fb
- SHA1 a7107cb8299773db1a165dfa19b1d58dd84913ed
- SHA512 0318772a57bac2a87d0138c563705c4ad2f4be1d30f0b0b56c6b492ac563374a3ef7c38ce50cd4edffeb2d73794a21b6ec9d88422349832ae8c57d66dffdcb53
- SSDEEP 1572864:pP42K32e9wRRisCXrgtBaAxtoP4J/hlm1e1+J5iL6:pBKgSPO/q8+OL6
- TLSH T1B218BF02D021A179D44B22B1395EF73DAA3847478B298EC7E7DC5CD06FB91F1267E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_ab07d56a6e7f65c7da9f0578448a73fb_amadey_coinminer_darkgate_elex_emotet_glassworm_luca-ste.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_ab07d56a6e7f65c7da9f0578448a73fb_amadey_coinminer_darkgate_elex_emotet_glassworm_luca-ste.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_ab07d56a6e7f65c7da9f0578448a73fb_amadey_coinminer_darkgate_elex_emotet_glassworm_luca-stealer_magniber_njrat_remcos_zxxz
- Size 81.9MB
- SHA256 071aea549e741ccbae9482fb9105436cfd5e6b2b7cf67b5d367fc5c81a35395b
- MD5 ab07d56a6e7f65c7da9f0578448a73fb
- SHA1 a7107cb8299773db1a165dfa19b1d58dd84913ed
- SHA512 0318772a57bac2a87d0138c563705c4ad2f4be1d30f0b0b56c6b492ac563374a3ef7c38ce50cd4edffeb2d73794a21b6ec9d88422349832ae8c57d66dffdcb53
- SSDEEP 1572864:pP42K32e9wRRisCXrgtBaAxtoP4J/hlm1e1+J5iL6:pBKgSPO/q8+OL6
- TLSH T1B218BF02D021A179D44B22B1395EF73DAA3847478B298EC7E7DC5CD06FB91F1267E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Rhadamanthys Payload
-
Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess