2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 906KB
Sample261023-2edxtaes9x
SHA256 8965f041dd2bc239827bd27633778dcc85782f59398e9d31ec3430a8f8d3ff38
MD5 bd453c85b43e2eb23fecc11ab0a20510
SHA1 4349c953608664b12de123478f4b9ac8ef8d0255
SHA512 983f33426a403a0a0c6cadd6e04945a7cce2e7e79d4fae7a1d725b9704b88f534abb77d66a6e68d71de2110afa01e650c917c692a7124650df6d26d148350c4b
SSDEEP 12288:oLAOJgHftuKgrhQaIrrn44uEGDlvrJIzrxdKwnEBGdMTKpmDudm0BMpEUelp1pFY:wJgHVuZ2aIrr0c3EUUzN8MpGLxA8
TLSH
T14315121138D1D335D6A2567458B5D25108BBBCF2EA13C30FE2A43A6A1E727E0CE35E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 906KB

2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 8965f041dd2bc239827bd27633778dcc85782f59398e9d31ec3430a8f8d3ff38
MD5 bd453c85b43e2eb23fecc11ab0a20510
SHA1 4349c953608664b12de123478f4b9ac8ef8d0255
SHA512 983f33426a403a0a0c6cadd6e04945a7cce2e7e79d4fae7a1d725b9704b88f534abb77d66a6e68d71de2110afa01e650c917c692a7124650df6d26d148350c4b
SSDEEP 12288:oLAOJgHftuKgrhQaIrrn44uEGDlvrJIzrxdKwnEBGdMTKpmDudm0BMpEUelp1pFY:wJgHVuZ2aIrr0c3EUUzN8MpGLxA8
TLSH
T14315121138D1D335D6A2567458B5D25108BBBCF2EA13C30FE2A43A6A1E727E0CE35E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_bd453c85b43e2eb23fecc11ab0a20510_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic