2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop
Size 13.9MB
Sample261011-tyc6macv9j
SHA256 bd50840c51035f43d7eb8d79001a2b77214fb3152b9e8d8f2903ab2e7c2e3616
MD5 3c97071394a92e3338942a88eac07d83
SHA1 7e7a8ceaf8d02f04e5c2f0b0cce10520b25638e1
SHA512 f6ed90ceb8d0cfe1057e9e158e087cb80d3076ca0348facef72395629ef0baba6d7e7de784c90db15440046153dd2596d44b650cd520c1d09ca4c87c271acc58
SSDEEP 196608:0tAzdvi3D0/u/9HYKBTSsA0tXv+vi3D0/u/9H2:0uxvmD0/QdB1Xv+vmD0/Qd2
TLSH
T1A8E69E1252CD84F5D052E0F9C2B2A76CF6A78F360B31D6C77BC43E0966362E1E93A156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop

.exe 13.9MB

2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop

IMPHASH ac9275e58d139328f549716de83dfa5e
SHA256 bd50840c51035f43d7eb8d79001a2b77214fb3152b9e8d8f2903ab2e7c2e3616
MD5 3c97071394a92e3338942a88eac07d83
SHA1 7e7a8ceaf8d02f04e5c2f0b0cce10520b25638e1
SHA512 f6ed90ceb8d0cfe1057e9e158e087cb80d3076ca0348facef72395629ef0baba6d7e7de784c90db15440046153dd2596d44b650cd520c1d09ca4c87c271acc58
SSDEEP 196608:0tAzdvi3D0/u/9HYKBTSsA0tXv+vi3D0/u/9H2:0uxvmD0/QdB1Xv+vmD0/Qd2
TLSH
T1A8E69E1252CD84F5D052E0F9C2B2A76CF6A78F360B31D6C77BC43E0966362E1E93A156
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8e:23:30:aa:90:5a:41:61:01:ec:bf:f7:08:5b:72:2b

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Miray Software AG,O=Miray Software AG,L=Munich/ München,C=DE

Chains

Jan 1, 0001

Subject

CN=Miray Software AG,O=Miray Software AG,L=Munich/ München,C=DE

Serial Number

01:00:00:00:00:01:2e:7c:a5:5d:d3

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 3, 2011 - Mar 3, 2014

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

02:00:00:00:00:00:d6:78:b7:94:05

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:af:24

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

238829

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WritePrivateProfileStringW FlushFileBuffers SetEndOfFile GetStartupInfoW HeapFree HeapAlloc HeapReAlloc RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapSize GetStdHandle FreeEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode VirtualQuery SetEnvironmentVariableA GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap lstrlenA GlobalFlags InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc GlobalHandle GlobalReAlloc GetCurrentProcessId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange WideCharToMultiByte FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW lstrcmpW GetVersionExA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW MulDiv SetLastError lstrlenW LocalFree LocalAlloc InterlockedDecrement GetWindowsDirectoryA GetVolumeInformationA GetDriveTypeA GetDiskFreeSpaceExA GetLocalTime GetLogicalDrives TerminateThread LoadLibraryA ResumeThread GetCurrentProcess ReadProcessMemory TlsGetValue TlsSetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSection TlsAlloc GetTickCount ExitThread CreateSemaphoreA ReleaseSemaphore CreateMutexA CreateEventA CreateThread SetEvent WaitForMultipleObjects SetConsoleCtrlHandler GetModuleHandleA GetModuleFileNameA CreateFileA GetSystemTime VirtualAlloc VirtualFree DeviceIoControl SetErrorMode CreateMutexW GetVersion ExitProcess GetCurrentThread SetThreadPriority QueryDosDeviceW OpenFile GetLastError SetFileAttributesW Sleep WaitForSingleObject ReleaseMutex MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetFileSize GetVersionExW GetCommandLineW GetModuleHandleW WriteFile DeleteFileW LoadLibraryW GetProcAddress FreeLibrary GetDriveTypeW GetModuleFileNameW CreateFileW ReadFile SetFilePointer GetEnvironmentStringsW CloseHandle

user32

DestroyMenu LoadCursorW GetSysColorBrush ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetWindowThreadProcessId SetCursor GetMessageW TranslateMessage GetCursorPos ValidateRect PostQuitMessage GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem IsWindowEnabled IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW RemovePropW GetFocus IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor GetDC CreateIconFromResourceEx SetWindowTextW EndDialog GetParent CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu GetWindowLongW SetWindowLongW SystemParametersInfoA GetCapture SendMessageW GetDlgItem SetDlgItemTextW DestroyIcon GetSystemMetrics DialogBoxParamW MessageBoxW EnableWindow RegisterClassExA LoadCursorA UpdateWindow ShowWindow SetWindowPos SetWindowLongA CreateWindowExA AdjustWindowRectEx DestroyWindow DispatchMessageA GetMessageA GetWindowLongA GetWindowRect GetClientRect ReleaseDC EndPaint IsIconic GetWindowPlacement GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetKeyboardState ToAscii InvalidateRect PostThreadMessageA DefWindowProcA BeginPaint GetPropW

gdi32

GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible CreateDIBitmap SetMapMode RestoreDC SaveDC CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetDeviceCaps StretchBlt DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection SelectObject

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenSCManagerW OpenServiceW CloseServiceHandle ControlService StartServiceW

shell32

ShellExecuteW

shlwapi

PathFindExtensionW PathRemoveFileSpecW PathRemoveExtensionW PathFindFileNameW

ole32

CoTaskMemFree CoSetProxyBlanket CoInitializeSecurity CoInitializeEx StgCreateDocfile CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysFreeString SysAllocStringLen VariantInit SysAllocString SysStringLen VariantClear VariantChangeType

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_3c97071394a92e3338942a88eac07d83_amadey_coinminer_darkgate_elex_floxif_remcos_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic