2026-07-31_8d763a9652b44a42462ce02170deb337_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_8d763a9652b44a42462ce02170deb337_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 3.5MB
Sample260731-nl85msstht
SHA256 eb3c037891218df3b12337b1e81e4853ca98ba0dc5703abb61847ff93aa67f73
MD5 8d763a9652b44a42462ce02170deb337
SHA1 53dd9acaa18a28478f95b9efc2493084df205973
SHA512 21d43c37e98b63d89dd5d291dea26289e7739ba6a2d8ee8a6294e30c57076391be625674eee505f79d949fd25ce53cd67d09ddf3db2657eebc510c1e22c3897e
SSDEEP 98304:KJ+BgxIXHJPlCPQasScpVk+s+++s+Y+++s+++s+++sQhjfSlRPZetkjJsk:kDxI3plCPQasScpVk+s+++s+Y+++s++J
TLSH
T134F58D116BE54529F5B349364DBC812B493EBE711B14ACDF93C4291E49BDCE2AA30E33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-31_8d763a9652b44a42462ce02170deb337_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 3.5MB

2026-07-31_8d763a9652b44a42462ce02170deb337_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 7670b2960c2c7fbd8302b4f965c8cf6b
SHA256 eb3c037891218df3b12337b1e81e4853ca98ba0dc5703abb61847ff93aa67f73
MD5 8d763a9652b44a42462ce02170deb337
SHA1 53dd9acaa18a28478f95b9efc2493084df205973
SHA512 21d43c37e98b63d89dd5d291dea26289e7739ba6a2d8ee8a6294e30c57076391be625674eee505f79d949fd25ce53cd67d09ddf3db2657eebc510c1e22c3897e
SSDEEP 98304:KJ+BgxIXHJPlCPQasScpVk+s+++s+Y+++s+++s+++sQhjfSlRPZetkjJsk:kDxI3plCPQasScpVk+s+++s+Y+++s++J
TLSH
T134F58D116BE54529F5B349364DBC812B493EBE711B14ACDF93C4291E49BDCE2AA30E33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7a:10:3e:68:d2:77:ed:a6:88:d6:b1:54:50:58:82:5a:6b:68:4a:7f:61:47:26:21:b5:f8:ff:c0:3c:ad:ef:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Chains

Nov 20, 2018

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

3f:3e:dd:3d:e0:04:8f:96:d9:48:3a:da:02:e1:91:4b:63:5a:e7:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Chains

Nov 20, 2018

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Serial Number

5b:32:d2:7a:2e:b6:b4:cf:47:4f:83:97:38:12:9c:46

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2017 - Oct 10, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Serial Number

17:7b:68:fb:e4:74:c7:69:f8:4e:87:90:2a:7a:f2:85

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 10, 2017 - Oct 10, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

355930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\yasuo_code\YaSuo\ChengXu\Tags\pdtag_1.2.6.11119\Temp\Release\PuddingMainZip.pdb

kernel32

DosDateTimeToFileTime FileTimeToDosDateTime VirtualFree VirtualAlloc GetVersionExW InitializeCriticalSection SetEvent ResetEvent GlobalUnlock WritePrivateProfileStringW GetPrivateProfileStringW GetSystemTimeAsFileTime UpdateResourceW BeginUpdateResourceW GlobalAlloc GlobalLock lstrcpyW CopyFileW GetCommandLineW InterlockedDecrement InterlockedIncrement lstrcmpiW CreateProcessW GetDiskFreeSpaceW GlobalMemoryStatus GetProcessAffinityMask EndUpdateResourceW lstrlenW DeviceIoControl SetEndOfFile SetFilePointer GetLogicalDriveStringsW FindClose FindNextFileW FindFirstFileW MoveFileW GetCurrentProcessId MoveFileExW SetCurrentDirectoryW GetWindowsDirectoryW GetCurrentDirectoryW SetFileAttributesW GetCurrentThreadId GetFileAttributesW GetTempPathW SetFileTime RemoveDirectoryW SetLastError LocalFree FormatMessageW LoadLibraryExW FreeLibrary LoadLibraryW GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandle WriteFile GetStdHandle ReadFile GetFileSize CreateFileW FileTimeToLocalFileTime FileTimeToSystemTime OutputDebugStringW Sleep GetSystemDefaultLangID GetUserDefaultLangID DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetDriveTypeW WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW AreFileApisANSI DeleteFileW CreateFileMappingW CreateEventW WaitForSingleObject WaitForMultipleObjects GetProcessTimes GetTickCount GetModuleHandleW DeleteCriticalSection IsProcessorFeaturePresent GetProcAddress GetModuleHandleA LeaveCriticalSection EnterCriticalSection CompareFileTime MapViewOfFile CloseHandle GetLastError UnmapViewOfFile OpenFileMappingW OpenEventW SetProcessAffinityMask GetCurrentProcess FindResourceW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW HeapSize SetFilePointerEx FlushFileBuffers GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind QueryDosDeviceW SetErrorMode Process32NextW Process32FirstW CreateToolhelp32Snapshot GetDateFormatW GetTimeFormatW LocalAlloc GetPrivateProfileIntW SystemTimeToFileTime DuplicateHandle GetFileType OpenProcess GetLocalTime GlobalFree MulDiv ExitProcess FreeResource GetACP VerifyVersionInfoW VerSetConditionMask LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList LoadResource GetSystemInfo LockResource SizeofResource CreateDirectoryW GetProcessHeap HeapFree HeapAlloc InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx TerminateProcess GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

ScreenToClient GetWindowRect ShowWindow MoveWindow SetWindowLongW PostQuitMessage MessageBoxW CharUpperW SendMessageW SetWindowTextW wsprintfW PostMessageW UnregisterClassW MessageBeep SetForegroundWindow CharNextW GetClassInfoExW GetMenuItemCount CreatePopupMenu GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible BringWindowToTop MsgWaitForMultipleObjects GetSystemMetrics GetMenu SetPropW GetPropW GetClientRect AdjustWindowRectEx MonitorFromWindow GetMonitorInfoW UpdateLayeredWindow GetFocus GetKeyState SetCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect MapWindowPoints UnionRect IsRectEmpty PtInRect UpdateWindow SetCursor IntersectRect InflateRect OffsetRect IsIconic SetWindowRgn CharPrevW DrawTextW FillRect SetRect GetDesktopWindow GetForegroundWindow WindowFromPoint OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor GetWindowRgn CreateAcceleratorTableW InvalidateRgn AttachThreadInput GetWindowThreadProcessId DestroyIcon GetIconInfo DestroyMenu TrackPopupMenuEx GetCursorPos DestroyWindow RegisterClassExW FindWindowExW EndDialog EnumChildWindows GetClassNameW LoadImageW SetWindowPos IsWindow ReleaseCapture ExitWindowsEx SetFocus InvalidateRect SetScrollPos IsZoomed GetWindow SetTimer LoadIconW KillTimer EnableWindow GetParent GetWindowTextLengthW GetWindowTextW LoadStringW DefWindowProcW RegisterClassW LoadCursorW CallWindowProcW CreateWindowExW GetWindowLongW

gdi32

SaveDC GetTextMetricsW GetObjectW CreatePen CreateDCW GetDIBits CreateRoundRectRgn GetObjectA CreateSolidBrush SetBkMode SetTextColor CombineRgn CreatePenIndirect CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn RestoreDC SetBkColor StretchBlt SetStretchBltMode MoveToEx TextOutW GetDeviceCaps CreateRectRgn PtInRegion CreateFontIndirectW CreateCompatibleBitmap BitBlt DeleteObject CreateICW DeleteDC CreateCompatibleDC CreateDIBSection SelectObject Rectangle ExtSelectClipRgn GetStockObject SetWindowOrgEx

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

LookupPrivilegeValueW ImpersonateLoggedOnUser GetTokenInformation SetTokenInformation InitializeSecurityDescriptor RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW GetFileSecurityW RevertToSelf AdjustTokenPrivileges SetFileSecurityW OpenProcessToken SetSecurityDescriptorDacl RegOpenKeyW RegEnumKeyW DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW

shell32

SHOpenFolderAndSelectItems Shell_NotifyIconW SHGetFolderLocation SHGetDesktopFolder SHGetSpecialFolderLocation ord18 ord155 ord16 ord190 SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW ord75 SHGetFileInfoW SHGetPathFromIDListW SHBrowseForFolderW DragFinish DragQueryFileW

ole32

CoCreateGuid OleLockRunning CLSIDFromProgID CLSIDFromString RevokeDragDrop RegisterDragDrop CoTaskMemRealloc OleInitialize CoUninitialize CoInitialize OleUninitialize CoTaskMemAlloc CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree ReleaseStgMedium

oleaut32

VariantClear VarUI4FromStr SysStringByteLen SysAllocString SysFreeString SysStringLen VariantCopy SysAllocStringLen VariantInit

gdiplus

GdipGetImageHeight GdipCreateHBITMAPFromBitmap GdipDrawImageRectRectI GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDrawArcI GdipDisposeImage GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDrawImageRectI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetTextRenderingHint GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdiplusStartup GdiplusShutdown GdipCreateLineBrushI GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem

shlwapi

PathIsRootW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW StrStrW StrCmpW ord219 wnsprintfW PathFileExistsW PathRemoveBackslashW PathSkipRootW

comctl32

ord413 ord410 ord412 ord17 _TrackMouseEvent

uxtheme

SetWindowTheme

psapi

EnumProcesses GetModuleFileNameExW

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

744KB

Virtual Size

743KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=179, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=2, id=199, version=41118,

count=27, id=259, version=24123,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=65, id=261, version=24123,

count=36, id=260, version=24123,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=531, id=1, productName=Unmarked objects,

count=63, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=186, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,