2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop

General

Target
2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop
Size 12.1MB
Sample261002-s56wvavdja
SHA256 5348d7578bd9bbf36aa9408785ef3330ee0f200092188a4a19234b2d03e32779
MD5 44ee980650c30f93307b428446e57ae1
SHA1 83dd8d25923f37a95cb28de897187a3cd8d103b0
SHA512 a80bfd78856f909ca1357aced46f1bfc85df1b0862746af8020719a6f8114b0e78dc2538bd1ba92ee9f73edbf77aec17b673bd0edca9acdf2cbd49bfe31aef3a
SSDEEP 393216:E9xMa21XWfu63TV3J14+kKQMfKIah1Qm3j4W:GxO6jVzfHs
TLSH
T15CD6BE03B3E64125F5F31A745A7D5529492ABD311B34C0DFA2C92A4E4FF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop

.exe 12.1MB

2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 4db9c62c225163604e8611603de90619
SHA256 5348d7578bd9bbf36aa9408785ef3330ee0f200092188a4a19234b2d03e32779
MD5 44ee980650c30f93307b428446e57ae1
SHA1 83dd8d25923f37a95cb28de897187a3cd8d103b0
SHA512 a80bfd78856f909ca1357aced46f1bfc85df1b0862746af8020719a6f8114b0e78dc2538bd1ba92ee9f73edbf77aec17b673bd0edca9acdf2cbd49bfe31aef3a
SSDEEP 393216:E9xMa21XWfu63TV3J14+kKQMfKIah1Qm3j4W:GxO6jVzfHs
TLSH
T15CD6BE03B3E64125F5F31A745A7D5529492ABD311B34C0DFA2C92A4E4FF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

2957436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x86\Release MT\HitmanPro.pdb

kernel32

GetModuleHandleW GetLastError WaitForMultipleObjects CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread SignalObjectAndWait TerminateThread Sleep VirtualAlloc VirtualFree OpenProcess VirtualQueryEx WaitForSingleObjectEx CreateWaitableTimerW SetWaitableTimer GetVersion LocalAlloc LocalFree GetProcAddress GlobalMemoryStatus FreeLibrary Heap32ListNext Heap32Next QueryPerformanceCounter Heap32First Heap32ListFirst GetTickCount GetSystemTimeAsFileTime Thread32First Thread32Next VirtualUnlock LoadLibraryA Process32FirstW VirtualLock Module32FirstW GetSystemInfo Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId Module32NextW GetCurrentProcessId QueryPerformanceFrequency SetThreadPriority GetCurrentThread SystemTimeToFileTime LocalFileTimeToFileTime CompareFileTime GetLocalTime FileTimeToSystemTime SetLastError GetSystemDirectoryW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW CreateFileW DeviceIoControl GetFileInformationByHandle GetModuleHandleA GetProcessHeap HeapFree HeapAlloc HeapReAlloc FindResourceW SizeofResource LoadResource LockResource FreeResource OutputDebugStringW WriteFile ReadFile PeekNamedPipe WaitNamedPipeW GetCalendarInfoW InterlockedCompareExchange GetFileSizeEx GetNativeSystemInfo FormatMessageW FileTimeToLocalFileTime GetLocaleInfoW TryEnterCriticalSection InterlockedIncrement GetTempPathW RemoveDirectoryW FindFirstFileW FindClose FindNextFileW GetFileAttributesW GetCurrentProcess RegisterWaitForSingleObject InterlockedExchange UnregisterWaitEx FlushFileBuffers DisconnectNamedPipe GetOverlappedResult InterlockedDecrement GetComputerNameW GetFileAttributesExW GetFileTime SetFileTime ResumeThread GetCommandLineW CreateProcessW ConvertDefaultLocale GetLogicalDriveStringsW QueryDosDeviceW SetThreadAffinityMask DeleteFileW GetModuleFileNameW SetErrorMode GetStdHandle GetDriveTypeW GetVolumeInformationW GetFileSize GetModuleHandleExA SetFileAttributesW CopyFileW TerminateProcess GetNumberFormatW GetVersionExW WTSGetActiveConsoleSessionId ProcessIdToSessionId GetProcessTimes LoadLibraryW GlobalAlloc OpenEventW AllocConsole LoadLibraryExW MultiByteToWideChar SetUnhandledExceptionFilter VirtualProtect VirtualQuery OpenThread SuspendThread GetThreadContext SetThreadContext SearchPathW GetSystemDirectoryA LoadLibraryExA DuplicateHandle CreateSemaphoreW ReleaseSemaphore GetEnvironmentVariableW WideCharToMultiByte GetSystemTime GetExitCodeProcess CreateHardLinkW GetVolumeInformationA ExpandEnvironmentStringsW SetHandleInformation CreateNamedPipeW ConnectNamedPipe GetThreadPriority GetLongPathNameW VirtualAllocEx ReadProcessMemory VirtualFreeEx RaiseException MoveFileW GetCurrentDirectoryW GetCurrentDirectoryA GlobalFree SetEndOfFile SetFilePointerEx FormatMessageA GetFullPathNameW GetFullPathNameA CreateFileA CreateMutexW HeapCompact SetFilePointer MapViewOfFile UnmapViewOfFile UnlockFile LockFile UnlockFileEx HeapDestroy GetFileAttributesA HeapCreate HeapValidate HeapSize LockFileEx GetDiskFreeSpaceW CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA OutputDebugStringA GetVersionExA GetTempPathA AreFileApisANSI DeleteFileA ExitProcess SetNamedPipeHandleState UnhandledExceptionFilter IsDebuggerPresent ReadConsoleInputA SetConsoleMode GetConsoleMode GetCPInfo GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetStringTypeW GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetStringTypeA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW CompareStringA lstrlenA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_44ee980650c30f93307b428446e57ae1_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_rhadamanthys_smoke-loader_stop

kernel32

generic