2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop
Size 2.7MB
Sample260924-nesjbacc92
SHA256 4f52646752d6a6803a6f5a06df335ccce42b4bba89cab62155470642979bfcb9
MD5 31e8659c509d38fd72f257f10883dea8
SHA1 efa0e795a6f69079e514ca9e33e6b1719cf0d57d
SHA512 a07754703ebb74dacb420ffd81607ac98b5a520aadb6f00e5ef6f0a7190e267239ed4647297fa6a82208783ae822da9cffea42533564a239e08eb1bbebbe2c93
SSDEEP 49152:7KPzvoS7SBQCKMN7pXRKNnpOEzXWSytLdu:CzwsM9NnYTstJu
TLSH
T1BFD55C2166944035EDBE0E31A934E630FD3DBD6F7E2DB01A6E80761E19779C1AA72313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop

File Explorer

2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop

.exe 2.7MB

2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop

IMPHASH 2dfc2c74864b84f5530ab40a343c56d8
SHA256 4f52646752d6a6803a6f5a06df335ccce42b4bba89cab62155470642979bfcb9
MD5 31e8659c509d38fd72f257f10883dea8
SHA1 efa0e795a6f69079e514ca9e33e6b1719cf0d57d
SHA512 a07754703ebb74dacb420ffd81607ac98b5a520aadb6f00e5ef6f0a7190e267239ed4647297fa6a82208783ae822da9cffea42533564a239e08eb1bbebbe2c93
SSDEEP 49152:7KPzvoS7SBQCKMN7pXRKNnpOEzXWSytLdu:CzwsM9NnYTstJu
TLSH
T1BFD55C2166944035EDBE0E31A934E630FD3DBD6F7E2DB01A6E80761E19779C1AA72313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

t:\setupexe\x86\ship\0\setup.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

advapi32

RegQueryValueExA RegFlushKey RegCloseKey RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegOpenKeyExA

kernel32

lstrcmpW GetCommandLineW SetCurrentDirectoryW GlobalFree GetModuleFileNameW TlsFree LoadLibraryExW TlsSetValue TlsGetValue DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection HeapFree GetProcessHeap HeapAlloc HeapReAlloc VerifyVersionInfoW VerSetConditionMask RemoveDirectoryW GetTempPathW GetFullPathNameW CopyFileW DeleteFileW SetFileAttributesW GetFileAttributesW lstrlenW GetThreadLocale FreeLibrary GetModuleHandleW GetProcAddress lstrlenA WriteFile CreateFileW SetFilePointer FindFirstFileW FindClose IsProcessorFeaturePresent GlobalMemoryStatus GetCurrentProcess CompareStringW CompareStringA FormatMessageW ExpandEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte GetVersion CloseHandle LocalFree GetTimeZoneInformation GetSystemTime SystemTimeToTzSpecificLocalTime GetCurrentProcessId GetTickCount GetCurrentThreadId SetErrorMode GetVersionExW GetLastError FindNextFileW SetLastError TlsAlloc GetCommandLineA GetVersionExA GetStartupInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetSystemTimeAsFileTime GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType InterlockedIncrement InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter Sleep HeapSize GetCPInfo GetACP GetOEMCP VirtualAlloc InterlockedExchange LoadLibraryA InitializeCriticalSection GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA OutputDebugStringA GetSystemInfo

ole32

CoUninitialize CoCreateInstance CLSIDFromString CLSIDFromProgID OleRun CoInitializeEx

shell32

CommandLineToArgvW SHCreateDirectoryExW

user32

CharNextA MessageBoxW CharUpperA CharUpperW CharLowerA CharLowerW

shlwapi

PathGetCharTypeW

wintrust

WinVerifyTrust

dbghelp

SymGetSymFromAddr64 SymInitialize SymGetLineFromAddr64

oleaut32

GetErrorInfo VariantChangeType SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString VariantInit VariantClear

msi

ord8 ord159 ord160 ord110 ord117 ord91 ord67 ord172 ord180 ord95 ord31 ord65 ord71 ord141

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_31e8659c509d38fd72f257f10883dea8_amadey_coinminer_darkgate_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_rugmi_smoke-loader_stealc_stop

version

advapi32

kernel32

ole32

shell32

user32

shlwapi

wintrust

dbghelp

oleaut32

msi

generic