2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop

General

Target
2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop
Size 11.7MB
Sample261104-agjsasdx91
SHA256 6b521f1842363286326a5c14b09b9aac4a4135a6212e9c340e7b17d68a466da2
MD5 403363d489df45650d589980c2c0934d
SHA1 7caf243ee2c2b378ff251483c671ecfe510d9c74
SHA512 d5e0cf5b616727c1523ad052e5379023a1b6a33ce5faff4e5fb20d1ce8060246d190552588f47fe1a09727cf83aac4e030d7d19e0ea9e66d58a56becc07019b4
SSDEEP 196608:R9wi+qa2eXWfE+6//0qSOmdAPJ1KpvGkKQMfKIfBAN/CIQmu5:R9xla2eXWfF6H0c3J14+kKQMfKIah1Q/
TLSH
T16CC6AE0373E64129F5F316745A7D55294A3ABD311B34C0DFA2CA1A4E8FF2AE29931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop

.exe 11.7MB

2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 4db9c62c225163604e8611603de90619
SHA256 6b521f1842363286326a5c14b09b9aac4a4135a6212e9c340e7b17d68a466da2
MD5 403363d489df45650d589980c2c0934d
SHA1 7caf243ee2c2b378ff251483c671ecfe510d9c74
SHA512 d5e0cf5b616727c1523ad052e5379023a1b6a33ce5faff4e5fb20d1ce8060246d190552588f47fe1a09727cf83aac4e030d7d19e0ea9e66d58a56becc07019b4
SSDEEP 196608:R9wi+qa2eXWfE+6//0qSOmdAPJ1KpvGkKQMfKIfBAN/CIQmu5:R9xla2eXWfF6H0c3J14+kKQMfKIah1Q/
TLSH
T16CC6AE0373E64129F5F316745A7D55294A3ABD311B34C0DFA2CA1A4E8FF2AE29931723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12095488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x86\Release MT\HitmanPro.pdb

kernel32

GetModuleHandleW GetLastError WaitForMultipleObjects CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread SignalObjectAndWait TerminateThread Sleep VirtualAlloc VirtualFree OpenProcess VirtualQueryEx WaitForSingleObjectEx CreateWaitableTimerW SetWaitableTimer GetVersion LocalAlloc LocalFree GetProcAddress GlobalMemoryStatus FreeLibrary Heap32ListNext Heap32Next QueryPerformanceCounter Heap32First Heap32ListFirst GetTickCount GetSystemTimeAsFileTime Thread32First Thread32Next VirtualUnlock LoadLibraryA Process32FirstW VirtualLock Module32FirstW GetSystemInfo Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId Module32NextW GetCurrentProcessId QueryPerformanceFrequency SetThreadPriority GetCurrentThread SystemTimeToFileTime LocalFileTimeToFileTime CompareFileTime GetLocalTime FileTimeToSystemTime SetLastError GetSystemDirectoryW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW CreateFileW DeviceIoControl GetFileInformationByHandle GetModuleHandleA GetProcessHeap HeapFree HeapAlloc HeapReAlloc FindResourceW SizeofResource LoadResource LockResource FreeResource OutputDebugStringW WriteFile ReadFile PeekNamedPipe WaitNamedPipeW GetCalendarInfoW InterlockedCompareExchange GetFileSizeEx GetNativeSystemInfo FormatMessageW FileTimeToLocalFileTime GetLocaleInfoW TryEnterCriticalSection InterlockedIncrement GetTempPathW RemoveDirectoryW FindFirstFileW FindClose FindNextFileW GetFileAttributesW GetCurrentProcess RegisterWaitForSingleObject InterlockedExchange UnregisterWaitEx FlushFileBuffers DisconnectNamedPipe GetOverlappedResult InterlockedDecrement GetComputerNameW GetFileAttributesExW GetFileTime SetFileTime ResumeThread GetCommandLineW CreateProcessW ConvertDefaultLocale GetLogicalDriveStringsW QueryDosDeviceW SetThreadAffinityMask DeleteFileW GetModuleFileNameW SetErrorMode GetStdHandle GetDriveTypeW GetVolumeInformationW GetFileSize GetModuleHandleExA SetFileAttributesW CopyFileW TerminateProcess GetNumberFormatW GetVersionExW WTSGetActiveConsoleSessionId ProcessIdToSessionId GetProcessTimes LoadLibraryW GlobalAlloc OpenEventW AllocConsole LoadLibraryExW MultiByteToWideChar SetUnhandledExceptionFilter VirtualProtect VirtualQuery OpenThread SuspendThread GetThreadContext SetThreadContext SearchPathW GetSystemDirectoryA LoadLibraryExA DuplicateHandle CreateSemaphoreW ReleaseSemaphore GetEnvironmentVariableW WideCharToMultiByte GetSystemTime GetExitCodeProcess CreateHardLinkW GetVolumeInformationA ExpandEnvironmentStringsW SetHandleInformation CreateNamedPipeW ConnectNamedPipe GetThreadPriority GetLongPathNameW VirtualAllocEx ReadProcessMemory VirtualFreeEx RaiseException MoveFileW GetCurrentDirectoryW GetCurrentDirectoryA GlobalFree SetEndOfFile SetFilePointerEx FormatMessageA GetFullPathNameW GetFullPathNameA CreateFileA CreateMutexW HeapCompact SetFilePointer MapViewOfFile UnmapViewOfFile UnlockFile LockFile UnlockFileEx HeapDestroy GetFileAttributesA HeapCreate HeapValidate HeapSize LockFileEx GetDiskFreeSpaceW CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA OutputDebugStringA GetVersionExA GetTempPathA AreFileApisANSI DeleteFileA ExitProcess SetNamedPipeHandleState UnhandledExceptionFilter IsDebuggerPresent ReadConsoleInputA SetConsoleMode GetConsoleMode GetCPInfo GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetStringTypeW GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetStringTypeA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW CompareStringA lstrlenA

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

652KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_403363d489df45650d589980c2c0934d_amadey_coinminer_darkgate_elex_glassworm_ngrbot_ramnit_remcos_rhadamanthys_smoke-loader_stop

kernel32

generic