2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop
Size 11.2MB
Sample261104-x5cefstzey
SHA256 f1eb2f33470cb2fc747b8bd0443eb659b2985072230cd7c04711e619766ec295
MD5 5dc7b05dacde9455869a5dfd81330b6b
SHA1 a41737c931167569e51b6a2d36e42a855558971a
SHA512 57277547489ab68e4719cb96b867ccf94cb30f8c8173914356fd4d9dafe8b4d8f6b12cb1df5f719bd67cc906d48ec925d6e2bf2b188e1c43fe29be59c46e9597
SSDEEP 196608:5YcjhQUF+nFQL7mM7N/e/ymdAPJ1KpvGkKQMfKIfBAN/CIQm3A9k8:5YcGUF+nFQHmM7N/Ey3J14+kKQMfKIaa
TLSH
T13FC6AE03B7E64125F5F31A745A7D4529492ABD311B38C0DFA2C92A4E4FF2EE29931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop

.exe 11.2MB

2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop

IMPHASH ba8d21e5b6e01febe5edeb95bcccda39
SHA256 f1eb2f33470cb2fc747b8bd0443eb659b2985072230cd7c04711e619766ec295
MD5 5dc7b05dacde9455869a5dfd81330b6b
SHA1 a41737c931167569e51b6a2d36e42a855558971a
SHA512 57277547489ab68e4719cb96b867ccf94cb30f8c8173914356fd4d9dafe8b4d8f6b12cb1df5f719bd67cc906d48ec925d6e2bf2b188e1c43fe29be59c46e9597
SSDEEP 196608:5YcjhQUF+nFQL7mM7N/e/ymdAPJ1KpvGkKQMfKIfBAN/CIQm3A9k8:5YcGUF+nFQHmM7N/Ey3J14+kKQMfKIaa
TLSH
T13FC6AE03B7E64125F5F31A745A7D4529492ABD311B38C0DFA2C92A4E4FF2EE29931723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:84:84:92:e9:12:ac:1d:30:cd:b9:3c:db:6e:5e:1a:81:ff:ba:a3:8d:1d:86:d8:eb:ad:58:d5:b4:ad:44:87

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

Chains

Mar 14, 2025

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

Serial Number

0a:61:6d:1b:c8:88:0f:4c:a2:7c:20:bc:d6:02:59:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 28, 2024 - Jul 26, 2025

Minor OS version

Major OS version

Entry point

2923148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x86\Release MT\HitmanPro.pdb

kernel32

GetModuleHandleW GetLastError WaitForMultipleObjects CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread SignalObjectAndWait TerminateThread Sleep VirtualAlloc VirtualFree OpenProcess VirtualQueryEx WaitForSingleObjectEx CreateWaitableTimerW SetWaitableTimer GetVersion LocalAlloc LocalFree GetProcAddress GlobalMemoryStatus FreeLibrary Heap32ListNext Heap32Next QueryPerformanceCounter Heap32First Heap32ListFirst GetTickCount GetSystemTimeAsFileTime Thread32First Thread32Next VirtualUnlock LoadLibraryA Process32FirstW VirtualLock Module32FirstW GetSystemInfo Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId Module32NextW GetCurrentProcessId QueryPerformanceFrequency SetThreadPriority GetCurrentThread SystemTimeToFileTime LocalFileTimeToFileTime CompareFileTime GetLocalTime FileTimeToSystemTime SetLastError GetSystemDirectoryW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW CreateFileW DeviceIoControl GetFileInformationByHandle GetModuleHandleA GetProcessHeap HeapFree HeapAlloc HeapReAlloc FindResourceW SizeofResource LoadResource LockResource FreeResource OutputDebugStringW WriteFile ReadFile PeekNamedPipe WaitNamedPipeW GetCalendarInfoW InterlockedCompareExchange GetFileSizeEx GetNativeSystemInfo FormatMessageW FileTimeToLocalFileTime GetLocaleInfoW TryEnterCriticalSection InterlockedIncrement GetTempPathW RemoveDirectoryW FindFirstFileW FindClose FindNextFileW GetFileAttributesW GetCurrentProcess RegisterWaitForSingleObject InterlockedExchange UnregisterWaitEx FlushFileBuffers DisconnectNamedPipe GetOverlappedResult InterlockedDecrement GetComputerNameW GetFileAttributesExW GetFileTime SetFileTime ResumeThread GetCommandLineW CreateProcessW ConvertDefaultLocale GetLogicalDriveStringsW QueryDosDeviceW SetThreadAffinityMask DeleteFileW GetModuleFileNameW SetErrorMode GetStdHandle GetDriveTypeW GetVolumeInformationW GetFileSize GetModuleHandleExA SetFileAttributesW CopyFileW TerminateProcess GetNumberFormatW GetVersionExW WTSGetActiveConsoleSessionId ProcessIdToSessionId GetProcessTimes LoadLibraryW GlobalAlloc OpenEventW AllocConsole LoadLibraryExW MultiByteToWideChar SetUnhandledExceptionFilter VirtualProtect VirtualQuery OpenThread SuspendThread GetThreadContext SetThreadContext SearchPathW GetSystemDirectoryA LoadLibraryExA DuplicateHandle CreateSemaphoreW ReleaseSemaphore GetEnvironmentVariableW WideCharToMultiByte GetSystemTime GetExitCodeProcess CreateHardLinkW GetVolumeInformationA ExpandEnvironmentStringsW SetHandleInformation CreateNamedPipeW ConnectNamedPipe GetThreadPriority GetLongPathNameW VirtualAllocEx ReadProcessMemory VirtualFreeEx RaiseException MoveFileW GetCurrentDirectoryW GetCurrentDirectoryA GlobalFree SetEndOfFile SetFilePointerEx FormatMessageA GetFullPathNameW GetFullPathNameA CreateFileA CreateMutexW HeapCompact SetFilePointer MapViewOfFile UnmapViewOfFile UnlockFile LockFile UnlockFileEx HeapDestroy GetFileAttributesA HeapCreate HeapValidate HeapSize LockFileEx GetDiskFreeSpaceW CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA OutputDebugStringA GetVersionExA GetTempPathA AreFileApisANSI DeleteFileA ExitProcess SetNamedPipeHandleState UnhandledExceptionFilter IsDebuggerPresent ReadConsoleInputA SetConsoleMode GetConsoleMode GetStartupInfoW RtlUnwind GetCPInfo LCMapStringA LCMapStringW GetStringTypeW GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetStringTypeA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW CompareStringA lstrlenA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5dc7b05dacde9455869a5dfd81330b6b_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_ngrbot_remcos_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

generic