2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 906KB
Sample261012-3erpcacs2j
SHA256 7d2954095e91011ce377bc6b58afa97778185b130ddc6cac6981b0b80bfd6e03
MD5 417c00eb995affab0c52e26e693c64e2
SHA1 cc0c1b615e17e6831dafc1b39737a46414c9ca22
SHA512 ccdb31ce6d4e6c7203cf302528c9f9ba29f84f18565c035b374bd2f9f70a3d593a16f1df4a5fa9dd06c6bc890c01fc693ee5a5cb6b7183aa64318d5f1e6fbbdb
SSDEEP 24576:wJgHVuYmlJOZLHLylwzdoizjc5KzJfArLAwWLr:6jYgsJiwmizjckzJfULAw2
TLSH
T1D11512307AE0CA31E9B654384075D7615DBEFCB1DA61D64EEB903B6D0D30BE0462AE93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 906KB

2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 7d2954095e91011ce377bc6b58afa97778185b130ddc6cac6981b0b80bfd6e03
MD5 417c00eb995affab0c52e26e693c64e2
SHA1 cc0c1b615e17e6831dafc1b39737a46414c9ca22
SHA512 ccdb31ce6d4e6c7203cf302528c9f9ba29f84f18565c035b374bd2f9f70a3d593a16f1df4a5fa9dd06c6bc890c01fc693ee5a5cb6b7183aa64318d5f1e6fbbdb
SSDEEP 24576:wJgHVuYmlJOZLHLylwzdoizjc5KzJfArLAwWLr:6jYgsJiwmizjckzJfULAw2
TLSH
T1D11512307AE0CA31E9B654384075D7615DBEFCB1DA61D64EEB903B6D0D30BE0462AE93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_417c00eb995affab0c52e26e693c64e2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic