2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader
Size 5.9MB
Sample260916-tryhzsxt2p
SHA256 8751822bb4ba4a741515fefdb466b7db69114ada5b43b21169b70f456d2fef87
MD5 ddddea3c8a2c6b5822ac5b063ec46723
SHA1 3820216742c1a8f6f7898c1ef725b795c6349178
SHA512 e9d73b6e7abdf73f84a5f11f7dd22270513d6fecbe9103e73903f5d2411ab75c569cbada62b8346a133567aa49aadca2505a147f2b2222c5efa9532b8f7195d3
SSDEEP 98304:9BfsY00OdtvkUOnJO8JucgbgT2OyxomPb4IPs0HkJG/NTvISHPt7G0m6RjHs0:EYKvkUOnJfKk7yamj4IPsDUxISvtJnR7
TLSH
T15D567B61B696C17ADA923131C93DF6FF101A5F22CF2664C3A2983D6BF8712C36635607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader

File Explorer

2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader

.exe 5.9MB

2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader

IMPHASH 9290471f53c1de66427ab3bd5e42350a
SHA256 8751822bb4ba4a741515fefdb466b7db69114ada5b43b21169b70f456d2fef87
MD5 ddddea3c8a2c6b5822ac5b063ec46723
SHA1 3820216742c1a8f6f7898c1ef725b795c6349178
SHA512 e9d73b6e7abdf73f84a5f11f7dd22270513d6fecbe9103e73903f5d2411ab75c569cbada62b8346a133567aa49aadca2505a147f2b2222c5efa9532b8f7195d3
SSDEEP 98304:9BfsY00OdtvkUOnJO8JucgbgT2OyxomPb4IPs0HkJG/NTvISHPt7G0m6RjHs0:EYKvkUOnJfKk7yamj4IPsDUxISvtJnR7
TLSH
T15D567B61B696C17ADA923131C93DF6FF101A5F22CF2664C3A2983D6BF8712C36635607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

d9:b2:c4:93:e9:1f:3c:fe:ee:49:76:71:bc:5b:67:73:c5:71:c1:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=LLC SysDev Laboratories,O=LLC SysDev Laboratories,L=Kyiv,C=UA

Chains

Feb 15, 2022

CN=LLC SysDev Laboratories,O=LLC SysDev Laboratories,L=Kyiv,C=UA

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=LLC SysDev Laboratories,O=LLC SysDev Laboratories,L=Kyiv,C=UA

Serial Number

70:19:99:29:5e:35:cd:82:32:e9:b2:63:e9:49:80:ce

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2019 - Oct 30, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2014 - Jul 21, 2024

Minor OS version

Major OS version

Entry point

2204530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\sysdev\src\rexplorer\Release\rsaver.pdb

kernel32

GetLocaleInfoW SystemTimeToTzSpecificLocalTime QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime FileTimeToSystemTime QueryPerformanceFrequency FileTimeToLocalFileTime LocalFileTimeToFileTime GlobalSize GlobalLock SetThreadExecutionState GlobalAlloc GlobalUnlock GetVolumePathNameW LoadLibraryW GetVolumeInformationW GetDriveTypeW QueryDosDeviceW DeviceIoControl CreateHardLinkW SetFileAttributesW GetDiskFreeSpaceExW DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW ExitThread GetCurrentThreadId CreateThread RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc GetStdHandle GetModuleFileNameW HeapFree ExitProcess GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate GetCurrentProcessId HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers DeleteFileW LockFileEx GetLastError CreateFileW ReadFile WriteFile SetFileTime MoveFileExW SystemTimeToFileTime SetEndOfFile SetFilePointer GetFileSize DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection TryEnterCriticalSection GetDevicePowerState FindFirstVolumeW FindNextVolumeW FindVolumeClose GetSystemTime GlobalFree VirtualAlloc VirtualFree GetFileAttributesExW FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW FindFirstFileExW CreateDirectoryW GetEnvironmentVariableW CreateProcessW CreateEventW ResetEvent SetEvent WaitForSingleObject ResumeThread SuspendThread CloseHandle GetSystemInfo GetExitCodeThread GetProcAddress Sleep GetCurrentProcess SetThreadContext GetThreadContext GetModuleHandleW EnumResourceNamesW GetFileType GetCommandLineW

shell32

ShellExecuteExW CommandLineToArgvW

user32

DestroyWindow SetCursor CloseClipboard MapVirtualKeyW GetWindowRect IsIconic SetCapture PostMessageW GetTitleBarInfo GetFocus IsClipboardFormatAvailable GetParent LoadCursorW GetWindowInfo SetFocus EnumClipboardFormats GetKeyboardState LoadIconW GetAsyncKeyState InvalidateRect GetClipboardData SetClassLongW EmptyClipboard SendMessageW DispatchMessageW DefWindowProcW CallWindowProcW RegisterClassW CreateWindowExW GetWindowLongW TranslateMessage GetUpdateRect GetClassInfoW BeginPaint GetClientRect TrackMouseEvent DialogBoxIndirectParamW FillRect GetMessageW ScreenToClient EndPaint SetWindowLongW EndDialog GetDesktopWindow ShowWindow GetCursor OpenClipboard ReleaseCapture GetSystemMetrics RegisterClipboardFormatW SetClipboardData SetWindowTextW ToUnicode GetMonitorInfoW MonitorFromRect MoveWindow GetUpdateRgn GetDC ReleaseDC ValidateRect

gdi32

SetTextColor LineTo GetTextExtentPoint32A GetTextExtentPoint32W DeleteDC CreateSolidBrush CreateFontW CreatePenIndirect TextOutW CreateRectRgn GetTextExtentExPointA GetTextExtentExPointW Rectangle RectInRegion CombineRgn CreateCompatibleDC GetDeviceCaps MoveToEx SelectClipRgn SelectObject DeleteObject BitBlt CreateDIBSection SetBkColor

setupapi

SetupDiEnumDeviceInfo CM_Get_Parent SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW CM_Get_Device_IDW

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_ddddea3c8a2c6b5822ac5b063ec46723_amadey_coinminer_darkgate_elex_redline-stealer_smoke-loader

kernel32

shell32

user32

gdi32

setupapi

advapi32

generic