2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

General

Target
2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader
Size 1.9MB
Sample260707-e2a34shx6z
SHA256 29acd7e3105880f9e9068e77ebb94222fafad28d185e7a62dadbadd497e54f85
MD5 36b72976bb07b87c5319f2f6b3dc07a6
SHA1 49becc823c1c9eb232c50b1bf5860a1f45e1a945
SHA512 f994c559e95a7f76c45f8bc858d9ebac7b1660f7c98cf016abc0d57bb8a47be8b44b02a6b3ba7fea42ab1ec0040df4bc03d0e4828e854460fa9439e6c61ba577
SSDEEP 49152:CX8HmURSjvNLHK57RUqfTbZeWgsx93iy6zHHsgib:CX8HqvNLHK1/Da7Eb
TLSH
T1EB95C0207555C135D56402718D3BEF7AE1AF6C2C8FB606CBA3D43B2A55312D22E3AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

.exe 1.9MB

2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

IMPHASH f70cea80715bbe33ecfb94f19ddd0b99
SHA256 29acd7e3105880f9e9068e77ebb94222fafad28d185e7a62dadbadd497e54f85
MD5 36b72976bb07b87c5319f2f6b3dc07a6
SHA1 49becc823c1c9eb232c50b1bf5860a1f45e1a945
SHA512 f994c559e95a7f76c45f8bc858d9ebac7b1660f7c98cf016abc0d57bb8a47be8b44b02a6b3ba7fea42ab1ec0040df4bc03d0e4828e854460fa9439e6c61ba577
SSDEEP 49152:CX8HmURSjvNLHK57RUqfTbZeWgsx93iy6zHHsgib:CX8HqvNLHK1/Da7Eb
TLSH
T1EB95C0207555C135D56402718D3BEF7AE1AF6C2C8FB606CBA3D43B2A55312D22E3AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

595574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v11_i18n_20211215_branch\Build\Release\WPSOffice\office6\wps.pdb

kernel32

GetCommandLineW LocalFree CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTempPathW GetStartupInfoW GetTickCount GetModuleHandleW SetDllDirectoryW GetDllDirectoryW CopyFileW CreateDirectoryW CreateFileW GetFileAttributesW GetPrivateProfileStringW MultiByteToWideChar WideCharToMultiByte OutputDebugStringW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateProcessW FindResourceExW LoadResource LockResource SizeofResource FindResourceW SetEvent CreateEventW GetExitCodeProcess Process32First Process32Next GetSystemTime SystemTimeToFileTime VerSetConditionMask GetFileAttributesExW ReadFile WaitForSingleObject VerifyVersionInfoW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx FlushFileBuffers WriteFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo GetCurrentProcess LocalAlloc SetUnhandledExceptionFilter GetProcessId LoadLibraryExW ReleaseMutex CreateMutexW VirtualQuery CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetSystemDirectoryA LoadLibraryA OpenMutexW VirtualAlloc VirtualFree GetSystemInfo SetErrorMode GetModuleHandleExW SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread WriteConsoleW SetStdHandle FreeEnvironmentStringsW VirtualProtect LoadLibraryExA GetEnvironmentVariableW lstrlenW GetPrivateProfileIntW GetUserDefaultUILanguage CompareFileTime FindClose FindFirstFileW FindNextFileW GetFileSizeEx SetFilePointerEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsW ProcessIdToSessionId GetCompressedFileSizeW ReleaseSemaphore CreateSemaphoreW GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter RtlUnwind InterlockedPushEntrySList GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW SetEnvironmentVariableW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW SetEndOfFile

krpt

?_force_link_krpt@@YGXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_36b72976bb07b87c5319f2f6b3dc07a6_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

kernel32

krpt

generic