2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc
Size 1.7MB
Sample260826-ev2mgssbpc
SHA256 2e74e7166a6d7e176ce4ebc4ace3d60041659cedad94b343c7615d4281752a80
MD5 e8d2a681cfd89da06612c4798daba785
SHA1 51916248276be7ef6fc491ed33387a48ec0d1fbf
SHA512 170bcbe10dc1de90d1f025e13ac56d3a0d1508c37ce8170c3206af0411246b21a09caf8392af354674458fac295466fd33582d314c7e32a20ff526f263daecc1
SSDEEP 49152:QRhxBR6e0q8KoWuhpyKvNKfCVtQFSZgksNGFR:QFBge0E2NKfuuFSBoG
TLSH
T13285BE51BB86E0B0C5924074092EE76D61B9BCB187321AE7B3D83F0E5DB56C06E3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc

File Explorer

2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc

.exe 1.7MB

2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc

IMPHASH b2b65e3ecd81feb2c13e1f9121838e2e
SHA256 2e74e7166a6d7e176ce4ebc4ace3d60041659cedad94b343c7615d4281752a80
MD5 e8d2a681cfd89da06612c4798daba785
SHA1 51916248276be7ef6fc491ed33387a48ec0d1fbf
SHA512 170bcbe10dc1de90d1f025e13ac56d3a0d1508c37ce8170c3206af0411246b21a09caf8392af354674458fac295466fd33582d314c7e32a20ff526f263daecc1
SSDEEP 49152:QRhxBR6e0q8KoWuhpyKvNKfCVtQFSZgksNGFR:QFBge0E2NKfuuFSBoG
TLSH
T13285BE51BB86E0B0C5924074092EE76D61B9BCB187321AE7B3D83F0E5DB56C06E3634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

481088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\FNP-11.16.4\tier1\FNP\Service\Build\_release-Windows-NT4-i686-main\FNPLicensingService.exe.pdb

kernel32

GetProcAddress LoadLibraryA CreateNamedPipeA OpenEventA GetCurrentProcessId ResetEvent GetTempPathA SetLastError MultiByteToWideChar GetModuleHandleA LoadLibraryExA WideCharToMultiByte GetSystemTimeAsFileTime LocalFree GetCurrentThreadId GetLocalTime OpenMutexA FormatMessageA GetModuleFileNameA DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetEndOfFile SetFilePointerEx MoveFileExW AreFileApisANSI EncodePointer GetStringTypeW IsDebuggerPresent OutputDebugStringW WriteConsoleW SetStdHandle GetTimeZoneInformation OpenProcess ResumeThread SuspendThread Sleep CreateEventA CreateMutexA WaitForSingleObjectEx WaitForSingleObject ReleaseMutex SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DisconnectNamedPipe ConnectNamedPipe DecodePointer OutputDebugStringA FindNextFileA FindFirstFileA FindClose CreateDirectoryA CreateWaitableTimerA CreateThread SetWaitableTimer WaitForMultipleObjectsEx GetDriveTypeA QueryDosDeviceA GetVersionExA GetSystemDirectoryA WriteFile DeviceIoControl CloseHandle SetFilePointer ReadFile CreateFileA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException CreateFileW ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetFileType GetOEMCP GetACP IsValidCodePage GetModuleFileNameW GetStdHandle GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind IsProcessorFeaturePresent GetCommandLineA LoadLibraryExW GetCPInfo SetEnvironmentVariableA

user32

wsprintfA

advapi32

GetSidSubAuthority CryptGenRandom CryptReleaseContext CryptAcquireContextA SetNamedSecurityInfoA GetNamedSecurityInfoA GetAce EqualSid StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceConfigA OpenServiceA OpenSCManagerA CloseServiceHandle RegEnumKeyExA RegDeleteValueA RegDeleteKeyA ReportEventA RegisterEventSourceA DeregisterEventSource SetSecurityDescriptorDacl MakeSelfRelativeSD MakeAbsoluteSD IsValidSid InitializeSid InitializeSecurityDescriptor InitializeAcl GetSidLengthRequired GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl GetLengthSid GetAclInformation CopySid AddAce RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

shell32

ord680

oleaut32

SysAllocString SysAllocStringLen SysFreeString SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear

dhcpcsvc

DhcpRequestParams

ws2_32

__WSAFDIsSet closesocket connect recv ioctlsocket send setsockopt socket WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo select

Name

.text

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.textidx

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

279KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

624KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_e8d2a681cfd89da06612c4798daba785_coinminer_darkgate_elex_maze_metamorfo_stealc

kernel32

user32

advapi32

ole32

shell32

oleaut32

dhcpcsvc

ws2_32

generic