2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop
Size 2.8MB
Sample260925-xpke5avamb
SHA256 550e3603cfd51841398ac798c75a494c391c67ad8c5b18d8849b3f8f57e7096e
MD5 d757c130685a32d1c775ca12dd8e8120
SHA1 93ae9b7f69aac8d52f6082fa901c7f7932dab579
SHA512 c098928d1d956257445c4386260ed234585b2f388a41dcd94e097b53b7252cc6dfb1b54490e28557e5e3efa61e65bf6c7b15ca5cce215ad7a6a418653b0427ce
SSDEEP 49152:Coxt7WW04W8PE8+puqrgLvJ6ahLFdO8dF9ZT0dYpwdguY6w8d5:zxt7WW049Pb+pXrovTLFd3dFgdrau
TLSH
T1D5D59E42B7C6C0B2E8561275516793BB5E3AAF108324D5C3EBA13E796D302D16E3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop

File Explorer

2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop

.exe 2.8MB

2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop

IMPHASH e975c29958bdeb3567d002e1ecc3c336
SHA256 550e3603cfd51841398ac798c75a494c391c67ad8c5b18d8849b3f8f57e7096e
MD5 d757c130685a32d1c775ca12dd8e8120
SHA1 93ae9b7f69aac8d52f6082fa901c7f7932dab579
SHA512 c098928d1d956257445c4386260ed234585b2f388a41dcd94e097b53b7252cc6dfb1b54490e28557e5e3efa61e65bf6c7b15ca5cce215ad7a6a418653b0427ce
SSDEEP 49152:Coxt7WW04W8PE8+puqrgLvJ6ahLFdO8dF9ZT0dYpwdguY6w8d5:zxt7WW049Pb+pXrovTLFd3dFgdrau
TLSH
T1D5D59E42B7C6C0B2E8561275516793BB5E3AAF108324D5C3EBA13E796D302D16E3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1794772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Upgrade\Release\Upgrade.pdb

i8_playsdk

I8_MP4Play_PlaySoundEX I8_MP4Play_CloseStream I8_MP4Play_Stop I8_MP4Play_StopSoundEX I8_MP4Play_GetFreePort I8_MP4Play_SetStreamOpenMode I8_MP4Play_OpenStream I8_MP4Play_SetPlayerBufNumber I8_MP4Play_Play I8_MP4Play_InputAudioEX I8_MP4Play_InputData

i8_netsdk

I8_NET_DVR_Init I8_NET_DVR_Cleanup I8_NET_DVR_ModifyIPC

i8h_sdk

I8H_SDK_Login I8H_SDK_StartVoiceComv2 Ants_RTSPClient_Close I8H_SDK_StopVoiceCom I8H_SDK_Logout Ants_RTSPClient_Init Ants_RTSPClient_Open_V2 I8H_SDK_Initv2 I8H_SDK_SetConnectTime I8H_SDK_Cleanup I8H_SDK_VoiceComSendDatav2

iphlpapi

GetAdaptersInfo SendARP

ws2_32

getaddrinfo connect closesocket select __WSAFDIsSet getsockopt htonl WSACleanup WSAStartup htons WSAIoctl ioctlsocket sendto recv send inet_addr freeaddrinfo recvfrom setsockopt bind inet_ntoa ntohs WSAGetLastError getsockname socket

crypt32

CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateContextProperty

advapi32

CryptDecrypt CryptCreateHash CryptSetHashParam CryptSignHashW CryptDestroyHash CryptExportKey CryptGetUserKey CryptGetProvParam CryptDestroyKey CryptEnumProvidersW CryptAcquireContextW CryptGenRandom CryptReleaseContext RegisterEventSourceW ReportEventW DeregisterEventSource RegCloseKey RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyA RegQueryValueA RegCreateKeyExA RegSetValueExA

user32

SetCapture UnregisterClassA LoadCursorA ReleaseCapture GetClientRect GetSysColorBrush CharUpperA SetWindowContextHelpId MapDialogRect EnableWindow SendMessageA SetWindowTextA GetWindow AppendMenuA GetSystemMenu BringWindowToTop ScreenToClient SetCursor UpdateWindow InvalidateRect GetFocus GetCursorPos ReleaseDC GetDC GetDesktopWindow SetWindowLongA CreatePopupMenu GetMessageA ValidateRect PostQuitMessage GetWindowThreadProcessId DestroyMenu EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA ShowWindow MoveWindow IsDialogMessageA GetDlgItemInt SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA EnableMenuItem CheckMenuItem RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture CallNextHookEx GetClassLongA ModifyMenuA GetWindowRect IsWindowVisible MessageBoxA GetKeyState SetWindowsHookExA UnhookWindowsHookEx SetDlgItemTextA SetRect DrawIcon GetSubMenu PostMessageA IsIconic SetTimer KillTimer OpenClipboard LoadIconA GetDlgCtrlID GetSystemMetrics CloseClipboard SetClipboardData DispatchMessageA TranslateMessage GetUserObjectInformationW GetProcessWindowStation MessageBoxW CharNextA CopyAcceleratorTableA IsRectEmpty InvalidateRgn GetNextDlgGroupItem MessageBeep RegisterClipboardFormatA GetClassNameA SetPropA GetPropA RemovePropA SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup GetTopWindow GetMessageTime GetMessagePos PeekMessageA MapWindowPoints TrackPopupMenu SetMenu SetForegroundWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect PtInRect DefWindowProcA CallWindowProcA GetMenu SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement CopyRect GetMenuState GetMenuItemID GetMenuItemCount GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow GetWindowLongA GetDlgItem IsWindowEnabled GetParent GetNextDlgTabItem EndDialog PostThreadMessageA EmptyClipboard

wldap32

ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord22 ord211 ord143 ord60 ord50 ord26 ord30 ord46

kernel32

GetModuleFileNameA CreateMutexA OutputDebugStringA TerminateProcess GetProcAddress LoadLibraryA FreeLibrary WriteFile RemoveDirectoryA DeleteFileA CreateDirectoryA GlobalUnlock lstrcpyA GlobalLock GlobalAlloc GetExitCodeThread WinExec Process32Next OpenProcess Process32First CreateToolhelp32Snapshot SetLastError GetTickCount SleepEx FormatMessageA PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA GetModuleHandleA GetEnvironmentVariableW GetSystemTimeAsFileTime DeleteFiber SwitchToFiber CreateFiber GetModuleHandleW GetVersion SystemTimeToFileTime GetSystemTime QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FindNextFileW FindFirstFileW ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency CreateSemaphoreA ReleaseSemaphore GetCurrentThreadId FreeResource GlobalFree lstrlenA MulDiv LocalFree GetVersionExA lstrcmpW CompareStringA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA FileTimeToSystemTime FileTimeToLocalFileTime GetModuleFileNameW InterlockedDecrement lstrcmpA GetLocaleInfoA EnumResourceLanguagesA ConvertDefaultLocale GetCurrentThread WritePrivateProfileStringA GetThreadLocale SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle GetCurrentProcess GetVolumeInformationA FindFirstFileA LocalAlloc GlobalFlags InterlockedIncrement TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GetCPInfo GetOEMCP GetFileSizeEx GetFileTime GetCurrentDirectoryA SetErrorMode RtlUnwind GetTimeFormatA GetDateFormatA HeapFree HeapAlloc RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA GetStartupInfoA HeapReAlloc GetDriveTypeA ExitThread GetFileInformationByHandle ExitProcess SetConsoleCtrlHandler SetStdHandle HeapSize GetACP IsValidCodePage GetTimeZoneInformation HeapCreate VirtualFree LCMapStringA LCMapStringW SetHandleCount GetConsoleCP GetStringTypeA GetStringTypeW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetUserDefaultLCID EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoW CompareStringW SetEnvironmentVariableA CreateFileW GetProcessHeap OpenMutexA GetLastError InterlockedExchange CopyFileA ReleaseMutex CreateProcessA GetFileAttributesA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar CreateFileA GetFileSize ReadFile CreateThread SetEvent WaitForSingleObject CloseHandle CreateEventA Sleep WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource FindNextFileA GetFullPathNameA FindClose

gdi32

CreateRectRgnIndirect GetClipBox SetTextColor GetRgnBox GetTextColor GetBkColor SetBkColor CreateBitmap SaveDC RestoreDC SetStretchBltMode GetDeviceCaps CreateDIBSection GetObjectA StretchBlt GetDIBColorTable SetDIBColorTable DeleteDC CreateCompatibleDC Rectangle CreatePen CreateFontW SelectObject GetTextMetricsA GetGlyphOutlineW GetMapMode GetStockObject ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx SetMapMode DeleteObject

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

shell32

SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA PathRemoveFileSpecW PathFindExtensionA PathRemoveExtensionA PathFindFileNameA PathStripToRootA UrlUnescapeA PathIsUNCA

oledlg

ord8

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CoTaskMemAlloc CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString CoDisconnectObject CoGetClassObject OleUninitialize StgOpenStorageOnILockBytes

oleaut32

SafeArrayDestroy LoadTypeLi VariantCopy SystemTimeToVariantTime VariantTimeToSystemTime SysAllocStringByteLen SysAllocStringLen VariantInit VariantChangeType VariantClear SysStringLen SysAllocString SysFreeString OleCreateFontIndirect

wsock32

getpeername accept listen gethostname WSASetLastError

dsound

ord6 ord7

gdiplus

GdipCloneImage GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageI

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetCrackUrlA InternetCanonicalizeUrlA InternetQueryOptionA InternetQueryDataAvailable InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallback InternetGetLastResponseInfoA HttpQueryInfoA

Common_Base64_Decode Common_Base64_Encode Common_Base64_IsValid Common_Calloc Common_Common2LinuxTime Common_Cond_Broadcast Common_Cond_Create Common_Cond_Destroy Common_Cond_Signal Common_Cond_TryWait Common_Cond_Wait Common_Copy Common_File_Close Common_File_IsExist Common_File_IsValid Common_File_Lock Common_File_MkDir Common_File_Open Common_File_Seek Common_File_Write Common_File_fClose Common_File_fEof Common_File_fFlush Common_File_fIsValid Common_File_fOpen Common_File_fRead Common_File_fSeek Common_File_fTell Common_File_fWrite Common_FindErrString Common_Free Common_GetCurrentTime Common_GetLocalTime Common_GetSelfExeName Common_GetSystemCount Common_GetSystemCount64 Common_HMacSha1_Append Common_HMacSha1_Create Common_HMacSha1_Destroy Common_HMacSha1_Finish Common_HMacSha1_Simply Common_HMacSha256_Append Common_HMacSha256_Create Common_HMacSha256_Destroy Common_HMacSha256_Finish Common_HMacSha256_Simply Common_Http_Free Common_Http_Http2Json Common_Http_Http2String Common_Http_Init Common_Http_Json2Http Common_Http_Parse Common_Http_Recv Common_Http_Send Common_InitHooks Common_InstanceIsRunning Common_InterSleep_Create Common_InterSleep_Destroy Common_InterSleep_Sleep Common_InterSleep_WakeUp Common_Json_AddItem Common_Json_ArraySize Common_Json_ChildSize Common_Json_Delete Common_Json_Delete_ex Common_Json_DetachItem Common_Json_Duplicate Common_Json_GetAttr Common_Json_GetAttrValue Common_Json_GetFirstChild Common_Json_GetItem Common_Json_GetItemExtData Common_Json_GetLastChild Common_Json_GetNext Common_Json_GetParent Common_Json_GetPrev Common_Json_New Common_Json_New_ex Common_Json_Parse Common_Json_Print Common_Json_PrintUnformatted Common_Json_RemoveItem Common_Json_SetAttrName Common_Json_SetAttrValue Common_Json_SetAttrValue_ex Common_Json_SetItemExtData Common_Json_Size Common_Json_StandardPrint Common_Linux2CommonTime Common_LocalTime_r Common_Lock Common_Lock_Create Common_Lock_Destroy Common_Log_Create Common_Log_Destroy Common_Log_GetDefaultHandle Common_Log_Out Common_Log_SetDefaultHandle Common_Log_SetLevel Common_Malloc Common_Memory_IsDebugging Common_Memory_Print Common_Memory_StartDebug Common_Memory_StopDebug Common_QuickResponseCode Common_RWLock_Create Common_RWLock_Destroy Common_RWLock_RLock Common_RWLock_TryRLock Common_RWLock_TryWLock Common_RWLock_UnLock Common_RWLock_WLock Common_Rand16 Common_Rand32 Common_Realloc Common_Sem_Create Common_Sem_Destroy Common_Sem_Pend Common_Sem_Post Common_Sem_TryPend Common_Sha1_Append Common_Sha1_Create Common_Sha1_Destroy Common_Sha1_Finish Common_Sha1_Simply Common_Sha256_Append Common_Sha256_Create Common_Sha256_Destroy Common_Sha256_Finish Common_Sha256_Simply Common_Sleep Common_Socket_Close Common_Socket_IsValid Common_Socket_Open Common_StrCmp Common_StrDup Common_Strcpy Common_StriCmp Common_StrnCmp Common_StrnDup Common_Strncpy Common_StrniCmp Common_Thread_Create Common_Thread_Destroy Common_Thread_Detach Common_Thread_Self Common_Thread_Yield Common_Timer_Create Common_Timer_Destroy Common_TryLock Common_UnLock Common_UriOneParse Common_UsernameToken_CalcDigest Common_UsernameToken_CalcNonce Common_cJSON_AddItemReferenceToArray Common_cJSON_AddItemReferenceToObject Common_cJSON_AddItemToArray Common_cJSON_AddItemToArrayByIndex Common_cJSON_AddItemToObject Common_cJSON_CreateArray Common_cJSON_CreateArray_ex Common_cJSON_CreateBool Common_cJSON_CreateBool_ex Common_cJSON_CreateDouble Common_cJSON_CreateDoubleArray Common_cJSON_CreateDoubleArray_ex Common_cJSON_CreateDouble_ex Common_cJSON_CreateFalse Common_cJSON_CreateFalse_ex Common_cJSON_CreateFloatArray Common_cJSON_CreateFloatArray_ex Common_cJSON_CreateIntArray Common_cJSON_CreateIntArray_ex Common_cJSON_CreateNull Common_cJSON_CreateNull_ex Common_cJSON_CreateNumber Common_cJSON_CreateNumber_ex Common_cJSON_CreateObject Common_cJSON_CreateObject_ex Common_cJSON_CreateString Common_cJSON_CreateStringArray Common_cJSON_CreateStringArray_ex Common_cJSON_CreateString_ex Common_cJSON_CreateTrue Common_cJSON_CreateTrue_ex Common_cJSON_Delete Common_cJSON_DeleteItemFromArray Common_cJSON_DeleteItemFromObject Common_cJSON_Delete_ex Common_cJSON_DetachItemFromArray Common_cJSON_DetachItemFromObject Common_cJSON_Duplicate Common_cJSON_GetArrayItem Common_cJSON_GetArraySize Common_cJSON_GetErrorPtr Common_cJSON_GetItemExtData Common_cJSON_GetObjectItem Common_cJSON_InitHooks Common_cJSON_Minify Common_cJSON_Parse Common_cJSON_ParseWithOpts Common_cJSON_Print Common_cJSON_PrintUnformatted Common_cJSON_ReplaceItemInArray Common_cJSON_ReplaceItemInObject Common_cJSON_SetItemExtData Common_cJSON_free Common_cJSON_free_ex Common_cJSON_malloc Common_cJSON_malloc_ex Common_cJSON_strdup_ex Common_cmp_time Common_cnt_delta_ms Common_cnt_interval_ms Update_Broadcast_Start Update_Broadcast_Stop Update_Tcp_Require Update_Udp_Require Update_Udp_Send Update_Udp_Start Update_Udp_Stop Update_udp_SendPkt

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_d757c130685a32d1c775ca12dd8e8120_amadey_coinminer_darkgate_elex_glassworm_remcos_revil_smoke-loader_stop

i8_playsdk

i8_netsdk

i8h_sdk

iphlpapi

ws2_32

crypt32

advapi32

user32

wldap32

kernel32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wsock32

dsound

gdiplus

wininet

generic