2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 905KB
Sample261102-man5naswav
SHA256 430608f381cd68f4cfb25109ff09062f5323fdb0e4b7e77c51e4a9ead300becf
MD5 bc4d18c20ce84214678fb31b1f9db2b2
SHA1 74e6ec8151a872440050e4a0326ce81a43abe150
SHA512 d70011936b5114f12d09bba676aa89b6bf7a428674c98ed3cbdea98382144d6e87ad0510bb4eebc9540286109693146407e683fbadc93a7a420696720c2ba88c
SSDEEP 12288:FLTvLgHUtunIVNX3ChQQjqa2CM+Cird5ptQ03gYqKlrR/VzdUQlM5O5IyN2gXt7V:FLgHGunuNC9jPjh5p93qUzdUQeyYg
TLSH
T1311523223AC6D331D55146388834DBE56E7EFC72E632930EE2A53B6A0E717E18325D47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 905KB

2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4e7d969410d0d229d00fefda4400c7e4
SHA256 430608f381cd68f4cfb25109ff09062f5323fdb0e4b7e77c51e4a9ead300becf
MD5 bc4d18c20ce84214678fb31b1f9db2b2
SHA1 74e6ec8151a872440050e4a0326ce81a43abe150
SHA512 d70011936b5114f12d09bba676aa89b6bf7a428674c98ed3cbdea98382144d6e87ad0510bb4eebc9540286109693146407e683fbadc93a7a420696720c2ba88c
SSDEEP 12288:FLTvLgHUtunIVNX3ChQQjqa2CM+Cird5ptQ03gYqKlrR/VzdUQlM5O5IyN2gXt7V:FLgHGunuNC9jPjh5p93qUzdUQeyYg
TLSH
T1311523223AC6D331D55146388834DBE56E7EFC72E632930EE2A53B6A0E717E18325D47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\project\ime_popup\branch\sogou_pp_R_3_4\bin\SogouInput\SogouExplorer.pdb

kernel32

CloseHandle FormatMessageW GetModuleFileNameW SetLastError LocalFree FindFirstFileW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection TerminateProcess MultiByteToWideChar GetProcAddress EnterCriticalSection FindClose DeleteCriticalSection SetFilePointer WriteFile FlushFileBuffers WideCharToMultiByte GetCommandLineW GetCurrentProcess GetCurrentProcessId GetStartupInfoW HeapFree HeapAlloc FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime GetCurrentThreadId TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation VirtualAlloc GetFullPathNameW GetCurrentDirectoryA LCMapStringA LCMapStringW RaiseException RtlUnwind HeapSize GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetModuleHandleA GetDriveTypeA CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA GetLastError FileTimeToSystemTime HeapReAlloc

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bc4d18c20ce84214678fb31b1f9db2b2_amadey_coinminer_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

advapi32

shell32

generic