2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 906KB
Sample261011-jgwljaeb76
SHA256 f2a62cb06e06a7ec94549f00a6444591b09871397cbf3c56710f4c58d1a2db30
MD5 99e5480ffb1aaf7419b9b11a6518540e
SHA1 f2ed2d63782ad8fe098c683aa7f0cb50a21f3d3f
SHA512 06af4d4129ff311bf9176dbce3eb9d593e20f25db94b9b48fce7b28b8ab3254e2e025350407d8b59d77c66e8a47280ec67c3e9e404f6232ab1b3ccbef6f85afb
SSDEEP 24576:wJgHVubmlJOZLHLylwzdoizjc5KzJfArLAwWLr:6jbgsJiwmizjckzJfULAw2
TLSH
T1331512307AE0C631E9B654384075D7615DBEBCB1DA61D64EEBA03B6D0D30BE0062AE97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 906KB

2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 f2a62cb06e06a7ec94549f00a6444591b09871397cbf3c56710f4c58d1a2db30
MD5 99e5480ffb1aaf7419b9b11a6518540e
SHA1 f2ed2d63782ad8fe098c683aa7f0cb50a21f3d3f
SHA512 06af4d4129ff311bf9176dbce3eb9d593e20f25db94b9b48fce7b28b8ab3254e2e025350407d8b59d77c66e8a47280ec67c3e9e404f6232ab1b3ccbef6f85afb
SSDEEP 24576:wJgHVubmlJOZLHLylwzdoizjc5KzJfArLAwWLr:6jbgsJiwmizjckzJfULAw2
TLSH
T1331512307AE0C631E9B654384075D7615DBEBCB1DA61D64EEBA03B6D0D30BE0062AE97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_99e5480ffb1aaf7419b9b11a6518540e_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic