2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 905KB
Sample261102-kctf2saw2n
SHA256 67a8ee936c85bdf89743ac581e1e194d6735c1f7167d6b104e58f39c2ed010ba
MD5 cd6091be222f8852392540db3818068d
SHA1 0ab847fb20dfcd14fe4a8617ae591ff523a2ce43
SHA512 f87a6ef099262f80830d78b2b7c8ad06248242644a8f5875f597470815bc70dc350b4c7ff0383b18e6633a442f26eeba9203c7fafd893e03e3303bf10e47c21f
SSDEEP 24576:q5gHpuqC2PcrJbg45XnwsiKzkThAlofcZA0QnT:EzqCmoM45nwBKwNAekZm
TLSH
T1A01512217AD1C336C1B25A360473869158BAFC71CD72930EEAC53FAE8A31B904956F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 905KB

2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 67a8ee936c85bdf89743ac581e1e194d6735c1f7167d6b104e58f39c2ed010ba
MD5 cd6091be222f8852392540db3818068d
SHA1 0ab847fb20dfcd14fe4a8617ae591ff523a2ce43
SHA512 f87a6ef099262f80830d78b2b7c8ad06248242644a8f5875f597470815bc70dc350b4c7ff0383b18e6633a442f26eeba9203c7fafd893e03e3303bf10e47c21f
SSDEEP 24576:q5gHpuqC2PcrJbg45XnwsiKzkThAlofcZA0QnT:EzqCmoM45nwBKwNAekZm
TLSH
T1A01512217AD1C336C1B25A360473869158BAFC71CD72930EEAC53FAE8A31B904956F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_cd6091be222f8852392540db3818068d_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic