2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat

General

Target
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat
Size 5.8MB
Sample260630-ehr8aad17x
SHA256 29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a
MD5 c26866a99c8365ca90629dda9f88dff7
SHA1 fcbecccb0984a932a1579cd3835ef0b726b28c5a
SHA512 4c9a52bf346850ef9d848eee6bf660556ca7ba10ba9e1ee6ef4dc611e5424c519178be34c6ffbf2796bd65718d802868dab49da2cc3a81af52e32b00f02a15a3
SSDEEP 49152:VBGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2i:3DiH9MfT3NwMkKhBRr0yAk6qkKvs
TLSH
T1C3568C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat

File Explorer

2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat

.exe 5.8MB

2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat

IMPHASH 0ab8af968841351a6340b418cb8a364d
SHA256 29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a
MD5 c26866a99c8365ca90629dda9f88dff7
SHA1 fcbecccb0984a932a1579cd3835ef0b726b28c5a
SHA512 4c9a52bf346850ef9d848eee6bf660556ca7ba10ba9e1ee6ef4dc611e5424c519178be34c6ffbf2796bd65718d802868dab49da2cc3a81af52e32b00f02a15a3
SSDEEP 49152:VBGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2i:3DiH9MfT3NwMkKhBRr0yAk6qkKvs
TLSH
T1C3568C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

RegisterClassExA TranslateMessage PostQuitMessage LoadIconA LoadCursorA GetMessageA DispatchMessageA DefWindowProcA SendMessageA CreateWindowExA CharLowerA

kernel32

lstrlenA lstrcpyA lstrcmpiA BeginUpdateResourceA CloseHandle CopyFileA CreateFileA CreateFileMappingA CreateThread DeleteFileA EndUpdateResourceA EnumResourceNamesA ExitProcess FindClose FindFirstFileA FindNextFileA FindResourceA FreeLibrary GetCommandLineA GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetModuleFileNameA GetModuleHandleA GetShortPathNameA GetSystemDefaultLangID GetTickCount GetWindowsDirectoryA GlobalAlloc GlobalFree LoadLibraryA LoadResource LockResource MapViewOfFile MoveFileA ReadFile RtlMoveMemory SetEndOfFile SetFilePointer SizeofResource Sleep UnmapViewOfFile UpdateResourceA WinExec WriteFile lstrcatA lstrcmpA

shlwapi

PathFindExtensionA

urlmon

URLDownloadToFileA

advapi32

RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

dbghelp

MakeSureDirectoryPathExists

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat

user32

kernel32

shlwapi

urlmon

advapi32

shell32

dbghelp

generic