2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop
Size 3.9MB
Sample261002-vx4sma1ejd
SHA256 f39720be05f285c7c4addc52938e06f32f44316827278c2689adf634eaae8338
MD5 2ef6bb298e70642b098a97c734763e47
SHA1 dfd35b388db534dfa4ea5c91dab5bfca95d20db3
SHA512 aca51e624759f86536493349e45eeec9f78aa8cf85d35fdbb7315a59863f0d33da6c58562c2375491eb2f8988b4aae1f73a20e4c3b2ff58d8c8c9ecd27a62d3e
SSDEEP 98304:d57KJIw7A24gD2lIIvn5P7NoyRZIelWYTCbOMUB2:rdwIkqP5P7NosyejHK
TLSH
T1EF16E022BA86C132D6A641B05D7DAF3E547DBA310B3581CBB3C41D2EDD706D25A3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop

.exe 3.9MB

2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop

IMPHASH bf8c968e1d3886260cd0026c21dc222d
SHA256 f39720be05f285c7c4addc52938e06f32f44316827278c2689adf634eaae8338
MD5 2ef6bb298e70642b098a97c734763e47
SHA1 dfd35b388db534dfa4ea5c91dab5bfca95d20db3
SHA512 aca51e624759f86536493349e45eeec9f78aa8cf85d35fdbb7315a59863f0d33da6c58562c2375491eb2f8988b4aae1f73a20e4c3b2ff58d8c8c9ecd27a62d3e
SSDEEP 98304:d57KJIw7A24gD2lIIvn5P7NoyRZIelWYTCbOMUB2:rdwIkqP5P7NosyejHK
TLSH
T1EF16E022BA86C132D6A641B05D7DAF3E547DBA310B3581CBB3C41D2EDD706D25A3938B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

50:b5:54:85:df:c8:d6:b7:79:dd:20:c2:8b:dc:96:49:7a:dc:c5:ba:bd:94:a5:cc:2d:b0:65:50:4f:7d:51:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Jun 5, 2020

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

fa:4b:56:f5:09:68:95:d8:2a:a7:92:ea:cd:36:43:d0:55:8c:78:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Jun 5, 2020

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

05:47:4e:c2:1d:f5:fe:aa:80:60:2e:55:1f:09:c4:d8

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 15, 2020 - Apr 19, 2021

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=成都斐阅科技有限公司,OU=研发部,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

0a:de:b7:6b:34:0c:9d:95:32:b2:31:8b:f8:0a:77:f9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 14, 2020 - Apr 19, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

683525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\454690\out\Release\LiteGameBox2.pdb

shell32

SHGetPathFromIDListW ShellExecuteExW SHFileOperationW ShellExecuteW SHChangeNotify SHGetSpecialFolderPathW Shell_NotifyIconW SHBrowseForFolderW SHCreateDirectoryExW

wininet

InternetCrackUrlW InternetGetCookieExW

iphlpapi

GetAdaptersInfo

kernel32

SetFilePointer OutputDebugStringW GetSystemDirectoryW GetTempPathW GetTempFileNameW OutputDebugStringA ReleaseMutex CreateMutexW LocalAlloc LocalFree WaitForMultipleObjects GetStartupInfoW Process32FirstW Process32NextW Module32FirstW Module32NextW MapViewOfFile UnmapViewOfFile CreateFileMappingW lstrcmpW GetFileSizeEx GetLocalTime CreateThread GetSystemWindowsDirectoryW SetEvent CreateEventW DeleteFileA GetStringTypeW EncodePointer SwitchToThread WriteFile GetStdHandle TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent GetFileSize SleepEx VirtualFree VirtualAlloc Thread32Next Thread32First CreateToolhelp32Snapshot FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread OpenThread FlushFileBuffers CompareStringW CreateFileW DeviceIoControl FreeResource DebugBreak VirtualQuery MultiByteToWideChar IsBadReadPtr GetModuleFileNameW LoadLibraryExW lstrcmpiW WaitForSingleObject SetErrorMode SetUnhandledExceptionFilter VirtualProtect InterlockedDecrement InterlockedIncrement GetVersionExW MoveFileExW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW RemoveDirectoryW GetModuleHandleW LoadLibraryW lstrlenW lstrcpynW GetTickCount CloseHandle FindClose Sleep SetLastError GetProcessId GetCurrentThread TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetShortPathNameW GetProcAddress FreeLibrary WideCharToMultiByte CopyFileW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCurrentThreadId FindResourceExW FindResourceW SizeofResource LoadResource DeleteCriticalSection SystemTimeToFileTime LocalFileTimeToFileTime CreateFileA InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource DecodePointer HeapCreate SetEndOfFile SetFilePointerEx HeapLock HeapUnlock HeapWalk GetACP GlobalAlloc ExitProcess MulDiv ReadFile InterlockedExchange InterlockedCompareExchange ResetEvent GetExitCodeThread WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetVersion GlobalLock GlobalUnlock GlobalFree UnhandledExceptionFilter IsProcessorFeaturePresent ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType QueryPerformanceCounter SetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind lstrcmpiA lstrcmpA InitializeSListHead

user32

GetWindowRect GetCursorPos IsRectEmpty PtInRect GetParent FindWindowExW SystemParametersInfoW IsWindow SetWindowPos MapWindowPoints PostMessageW SetTimer LoadImageW PostQuitMessage DefWindowProcW CharNextW MessageBoxW SetWindowsHookExW SendMessageW ShowWindow IsWindowVisible SetFocus SwitchToThisWindow UpdateWindow SetWindowTextW SetForegroundWindow RegisterWindowMessageW PeekMessageW PostThreadMessageW GetDC ReleaseDC GetWindow GetIconInfo EnableWindow IsZoomed MoveWindow DestroyWindow GetSystemMetrics KillTimer IntersectRect GetMessageW DestroyIcon wvsprintfW SetCursor InflateRect OffsetRect LoadCursorW TranslateMessage DispatchMessageW CreateWindowExW IsChild UpdateLayeredWindow GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect ScreenToClient GetWindowLongW SetWindowLongW GetClassNameW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW GetMenu SetPropW GetPropW AdjustWindowRectEx RemovePropW IsIconic SetWindowRgn MonitorFromWindow GetMonitorInfoW CopyRect CharPrevW DrawTextW SetRect DrawIconEx CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor CreateAcceleratorTableW InvalidateRgn FillRect SetLayeredWindowAttributes RedrawWindow GetWindowTextW GetWindowTextLengthW GetWindowDC

gdi32

GetTextMetricsW SaveDC RestoreDC Rectangle DeleteDC CreatePen CreateFontIndirectW GetObjectW SelectObject GetTextExtentPoint32W GetStockObject GetDIBits DeleteObject LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetWindowOrgEx StretchBlt SetStretchBltMode SetTextColor CreateDIBSection MoveToEx TextOutW ExtTextOutW GetDeviceCaps CreateSolidBrush CreateRoundRectRgn SetDIBitsToDevice CombineRgn CreateRectRgnIndirect GetCharABCWidthsW CreateCompatibleDC CreateCompatibleBitmap BitBlt SetBkMode GetClipBox CreateDCW

advapi32

CloseServiceHandle RegDeleteValueW RegOpenKeyExA RegEnumKeyExA RegEnumKeyExW RegQueryValueExA OpenProcessToken OpenThreadToken GetTokenInformation EqualSid AllocateAndInitializeSid FreeSid RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteKeyW OpenSCManagerW OpenServiceW QueryServiceStatus RegCreateKeyExW RegQueryInfoKeyW DuplicateTokenEx GetLengthSid CreateWellKnownSid SetTokenInformation GetUserNameW RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW

ole32

OleLockRunning CreateStreamOnHGlobal CoTaskMemAlloc CoInitializeSecurity CoCreateGuid CoTaskMemFree CoCreateInstance CLSIDFromString CLSIDFromProgID CoInitialize CoUninitialize CoTaskMemRealloc

oleaut32

SafeArrayCreate VariantChangeType SysAllocStringLen VarCmp VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString SafeArrayPutElement

shlwapi

PathAppendW PathFindExtensionW PathFindFileNameW PathCanonicalizeW SHGetValueW SHSetValueW AssocQueryStringW wnsprintfW PathCombineW PathFileExistsW PathIsDirectoryW PathRemoveFileSpecW StrCmpIW StrStrIW StrStrIA StrTrimA StrCmpNIW SHSetValueA SHGetValueA SHDeleteKeyW

comctl32

ord17 _TrackMouseEvent InitCommonControlsEx

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipGetImageWidth GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipGetImageEncoders GdipGetImageEncodersSize GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateFromHDC GdipSetSmoothingMode GdipFillEllipseI GdipCreatePath GdipDeletePath ord1 GdipCreatePen1 GdipDeletePen GdipDrawPath GdipDrawEllipseI GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipDrawImageRectRectI GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CryptStringToBinaryW CryptBinaryToStringW CertGetNameStringW

urlmon

URLDownloadToCacheFileA

secur32

GetUserNameExW

winmm

timeGetTime

msimg32

AlphaBlend GradientFill

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

generic

count=32, id=241, version=40116,

count=178, id=243, version=40116,

count=34, id=242, version=40116,

count=2, id=264, version=27040,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=4, id=199, version=41118,

count=24, id=259, version=26706,

count=2, id=261, version=27031,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=81, id=261, version=26706,

count=35, id=260, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=18, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=573, id=1, productName=Unmarked objects,

count=1, id=260, version=27032,

count=84, id=261, version=27032,

count=4, id=260, productName=VS2017 v15.8.5 build 26732, version=26732,

count=15, id=261, version=27040,

count=1, id=255, version=27040,

count=1, id=151,

count=1, id=258, version=27040,