2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 2.3MB
Sample260922-mvsnkstfrc
SHA256 8f65d3671454b715f69cf2e2c9fd5c3a0227ace913aed995b572a1cbdfeec82a
MD5 af9e8db8c8c0a025b425d4ef6fec0247
SHA1 c84072a34b81659f4b31635dec9f07ef74ac426a
SHA512 7fc8df3a3236d39e589af0317cad771141cf230d4a621574d2b6831f85f759340f17cd9b1a9e66e2ead429b5e80262b019eaa00840a7b660fc6357e5b8bdc718
SSDEEP 49152:2+VBHJ9ImLGamBKnDm9fVkmLe+t+KWWUF54oFkwXreBlmaHtSjcl/bynZw:pBHJ9vKWWA7AmzcF
TLSH
T1A9B57B2E7A87C0BAC62322718C28A798D5BDFE20DB6456CB77C85B1D1F305C35A31667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 2.3MB

2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH ece178181aa34d7111c2227372fe795a
SHA256 8f65d3671454b715f69cf2e2c9fd5c3a0227ace913aed995b572a1cbdfeec82a
MD5 af9e8db8c8c0a025b425d4ef6fec0247
SHA1 c84072a34b81659f4b31635dec9f07ef74ac426a
SHA512 7fc8df3a3236d39e589af0317cad771141cf230d4a621574d2b6831f85f759340f17cd9b1a9e66e2ead429b5e80262b019eaa00840a7b660fc6357e5b8bdc718
SSDEEP 49152:2+VBHJ9ImLGamBKnDm9fVkmLe+t+KWWUF54oFkwXreBlmaHtSjcl/bynZw:pBHJ9vKWWA7AmzcF
TLSH
T1A9B57B2E7A87C0BAC62322718C28A798D5BDFE20DB6456CB77C85B1D1F305C35A31667
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

647788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

RdrCEF.pdb

kernel32

WriteFile GetModuleFileNameW SetFilePointer GetCurrentProcessId FormatMessageA SetHandleInformation GetHandleInformation CreateJobObjectW AssignProcessToJobObject IsDebuggerPresent SetThreadPriority Sleep GetCurrentThread GetThreadPriority RaiseException GetExitCodeProcess CreateProcessW GetThreadContext CreateFileMappingW MapViewOfFile FreeLibrary LoadLibraryW GetFileType ProcessIdToSessionId GetProcessHandleCount VirtualFree SignalObjectAndWait TryEnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleHandleExW QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter UnmapViewOfFile VirtualFreeEx OpenProcess CreateNamedPipeW SearchPathW ReadProcessMemory SuspendThread DebugBreak lstrlenW GetCurrentDirectoryW TlsSetValue TlsAlloc TlsGetValue TlsFree QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualAlloc GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread AreFileApisANSI DeviceIoControl GetTickCount SetInformationJobObject TerminateJobObject RegisterWaitForSingleObject UnregisterWaitEx GetProcessId GetCurrentThreadId CreateThread CreateEventW WaitForSingleObject ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VerSetConditionMask InitializeCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError DuplicateHandle WriteProcessMemory VirtualProtectEx QueryDosDeviceW GetLongPathNameW GetFileAttributesW CreateFileW LocalFree ResumeThread TerminateProcess GetNativeSystemInfo GetVersionExW GetModuleHandleA VirtualQueryEx VirtualAllocEx GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CreateDirectoryW CreateEventA CancelIoEx DisconnectNamedPipe VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TerminateThread SwitchToThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode ExitProcess GetStdHandle WriteConsoleW HeapAlloc HeapReAlloc HeapFree GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers SetStdHandle SetFilePointerEx OutputDebugStringW ReadFile IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetCommandLineA FindClose FindFirstFileExW FindNextFileW ReadConsoleW HeapSize SetEndOfFile ConnectNamedPipe CloseHandle GetCommandLineW GetThreadId CancelSynchronousIo

user32

CloseWindowStation CloseDesktop GetSystemMetrics GetUserObjectInformationW GetProcessWindowStation SetProcessWindowStation CreateWindowStationW GetThreadDesktop CreateDesktopW

advapi32

ConvertStringSidToSidW RegOpenKeyA GetUserNameW GetSecurityInfo SetEntriesInAclW ConvertSidToStringSidW LookupPrivilegeValueW GetTokenInformation EqualSid CreateRestrictedToken CreateWellKnownSid CopySid RegQueryValueExW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf DuplicateTokenEx DuplicateToken RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo SetTokenInformation SetKernelObjectSecurity GetSecurityDescriptorSacl GetLengthSid GetKernelObjectSecurity GetAce OpenProcessToken SetThreadToken CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey SystemFunction036

shell32

CommandLineToArgvW SHGetFolderPathW

winmm

timeGetTime

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

648KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_af9e8db8c8c0a025b425d4ef6fec0247_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

winmm

generic