2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat

General

Target
2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat
Size 1.8MB
Sample260724-y9dnraea52
SHA256 64275420d401e838b43d9453361941669376017bc8b780ab3fee7a06776f5cfe
MD5 d689f60552297961e6f88d47d101b7d0
SHA1 8e90589a802a6e0139a7c511260e41e94c753fcf
SHA512 8c3480cbf2afb67a39a6bd8bdcf6f6a07b5427cafc26dd753164d1cebb2660cba20e0852e47907f70f8a9e40a8f635cf5e1c0b3d1f1a9220d80929cb7f1591de
SSDEEP 24576:tSI8LUlFl5Fp/k/oJdXN0BN2qnw4a+edxoBrLdggAA7wnNTB:ncY//k/oJdXN0BMOwLloBrug/wnNTB
TLSH
T1EC95D71126A24835E472C7305965FA9C556BBD70E9338E1F71C27ECEFBF07829922632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 1.8MB

2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat

SHA256 64275420d401e838b43d9453361941669376017bc8b780ab3fee7a06776f5cfe
MD5 d689f60552297961e6f88d47d101b7d0
SHA1 8e90589a802a6e0139a7c511260e41e94c753fcf
SHA512 8c3480cbf2afb67a39a6bd8bdcf6f6a07b5427cafc26dd753164d1cebb2660cba20e0852e47907f70f8a9e40a8f635cf5e1c0b3d1f1a9220d80929cb7f1591de
SSDEEP 24576:tSI8LUlFl5Fp/k/oJdXN0BN2qnw4a+edxoBrLdggAA7wnNTB:ncY//k/oJdXN0BMOwLloBrug/wnNTB
TLSH
T1EC95D71126A24835E472C7305965FA9C556BBD70E9338E1F71C27ECEFBF07829922632
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

66646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\firstrun.pdb

Name

.text

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

622KB

Virtual Size

622KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_d689f60552297961e6f88d47d101b7d0_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat

generic