2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader

General

Target
2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader
Size 2.4MB
Sample260522-sa83qaex5q
SHA256 c7caf581307230c3204012a15d6da95f4b6b38d113fb063f0198e22a45adefcc
MD5 a85997422958505b6cf1944382800b6d
SHA1 2d87c1c5cc884aeeb8efaac4a0ddf639046611c3
SHA512 23cc95427fba04aa2d4c12bf194aef99946e6f3e786045c76c79355df84ca7a1138977247ce433bd8d8d585d5eef4415c699f8b1ee63a005fe0ceed62ce007fa
SSDEEP 49152:NBQCKMN7pXRKNnpymUi6AjW/MUSdGRf3/1Ez8pYqaK:D9NnejxAZCg6HK
TLSH
T106C57C21B6A08031E1B346758DB1F21DAA7978518B238E5F22845EDDBFF29D19E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader

File Explorer

2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader

.exe 2.4MB

2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader

IMPHASH 4b540122e47bd952474dff889d5cdec9
SHA256 c7caf581307230c3204012a15d6da95f4b6b38d113fb063f0198e22a45adefcc
MD5 a85997422958505b6cf1944382800b6d
SHA1 2d87c1c5cc884aeeb8efaac4a0ddf639046611c3
SHA512 23cc95427fba04aa2d4c12bf194aef99946e6f3e786045c76c79355df84ca7a1138977247ce433bd8d8d585d5eef4415c699f8b1ee63a005fe0ceed62ce007fa
SSDEEP 49152:NBQCKMN7pXRKNnpymUi6AjW/MUSdGRf3/1Ez8pYqaK:D9NnejxAZCg6HK
TLSH
T106C57C21B6A08031E1B346758DB1F21DAA7978518B238E5F22845EDDBFF29D19E35333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

135102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dbs\el\oc\target\x86\ship\click2run\x-none\perfboost.pdb

advapi32

GetTokenInformation OpenProcessToken RegOpenKeyExW RegCloseKey IsValidSid FreeSid CreateWellKnownSid EqualSid RegGetValueW EventWriteTransfer EventRegister EventUnregister

kernel32

HeapFree CreateEventExW GetCurrentProcess GetModuleFileNameW CreateMutexW OpenEventW Sleep GetLastError SetEvent CloseHandle GetCurrentProcessId GetProcessHeap QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentThread GetThreadTimes FindNextFileW FindClose CreateFileW GetModuleHandleA GetProcAddress SetFilePointerEx MultiByteToWideChar WideCharToMultiByte GetUserDefaultLCID LCMapStringW FreeLibrary LocalFree FormatMessageA FindFirstFileExW IsWow64Process ReleaseSemaphore GlobalFree HeapAlloc SetLastError GetStringTypeW GlobalMemoryStatusEx RaiseException LoadLibraryExW GetModuleHandleW GetVersionExW InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount64 TerminateProcess GetModuleFileNameA GetShortPathNameA FindResourceW SizeofResource LoadResource IsValidCodePage FileTimeToSystemTime FormatMessageW GetLogicalProcessorInformation WaitForSingleObjectEx SignalObjectAndWait GetProcessAffinityMask CreateWaitableTimerW GetCurrentThreadId QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetFileType WriteFile FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetModuleHandleExW K32GetProcessMemoryInfo LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP EnumSystemLocalesW IsValidLocale GetACP DuplicateHandle EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW GetTickCount GetLocaleInfoW GetCPInfo ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList CreateTimerQueue SwitchToThread CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread VirtualAlloc VirtualProtect VirtualFree UnregisterWaitEx LoadLibraryW HeapSize HeapReAlloc GetStdHandle ExitProcess

ole32

StringFromGUID2 CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_a85997422958505b6cf1944382800b6d_amadey_coinminer_darkgate_elex_icedid_luca-stealer_njrat_rugmi_smoke-loader

advapi32

kernel32

ole32

generic