2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 905KB
Sample261027-ha51ysa12x
SHA256 3a300f111cf4e59716d4020376beabc153444a5edeeeaad60c875e28fb650067
MD5 cd2850848e8f3e6ccae1f544f4020f31
SHA1 1ebfa9d288670853ff00ff73398233c8ff0a7905
SHA512 caeca767af6cd9db6230d1a2635bd0b9f3293233cc9d9b1bc62ea0d8cdb36df1a957aaf1b2486b1c0ac2b6515158a5fa0452c91ae93cc23f3a64d117a5c4e3ee
SSDEEP 24576:UkgjCun2D9MIZT523WOf1p0QMESgwFdka0+gRXebjf:TqniMIZTk3WOfXT8bYRXa
TLSH
T1DE151220B6E2E330D562053508B5DBA45BBEBE71D972860EDAE1372D1E317E08766F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 905KB

2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 3a300f111cf4e59716d4020376beabc153444a5edeeeaad60c875e28fb650067
MD5 cd2850848e8f3e6ccae1f544f4020f31
SHA1 1ebfa9d288670853ff00ff73398233c8ff0a7905
SHA512 caeca767af6cd9db6230d1a2635bd0b9f3293233cc9d9b1bc62ea0d8cdb36df1a957aaf1b2486b1c0ac2b6515158a5fa0452c91ae93cc23f3a64d117a5c4e3ee
SSDEEP 24576:UkgjCun2D9MIZT523WOf1p0QMESgwFdka0+gRXebjf:TqniMIZTk3WOfXT8bYRXa
TLSH
T1DE151220B6E2E330D562053508B5DBA45BBEBE71D972860EDAE1372D1E317E08766F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_cd2850848e8f3e6ccae1f544f4020f31_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic