2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader

General

Target
2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader
Size 3.1MB
Sample260930-calz7acb92
SHA256 aa1c04ec4c47009ba5e36deddab1c61280c00110f1a2d8b8085c99fc89802b2d
MD5 49449f40b0011d3cc9fa2236d1e162ea
SHA1 1dbaeb28afe1364c5616d516f92c30db39164108
SHA512 d082c00b982944184a7930dfc7a73c400eea714e7e60ed2a87f7fac813922ea457544bf00d70969624f53f1e744a114b9baf9b9c3cc01e8996ba54871b68b4bc
SSDEEP 49152:3Db/3lziLR+PIgtpYfUUeLR+0cuGAI/L2KEh6PQ09y:3Db/3lzARoI4pmOR+0rGrj2o4
TLSH
T18EE5BFE0BAC7C276D5B200B28D6B974F9019EE25072D2CD76388291E6D706D35FF2627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader

File Explorer

2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader

.exe 3.1MB

2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader

IMPHASH a07a78f1a7758cc936f5c9a20843cbb4
SHA256 aa1c04ec4c47009ba5e36deddab1c61280c00110f1a2d8b8085c99fc89802b2d
MD5 49449f40b0011d3cc9fa2236d1e162ea
SHA1 1dbaeb28afe1364c5616d516f92c30db39164108
SHA512 d082c00b982944184a7930dfc7a73c400eea714e7e60ed2a87f7fac813922ea457544bf00d70969624f53f1e744a114b9baf9b9c3cc01e8996ba54871b68b4bc
SSDEEP 49152:3Db/3lziLR+PIgtpYfUUeLR+0cuGAI/L2KEh6PQ09y:3Db/3lzARoI4pmOR+0rGrj2o4
TLSH
T18EE5BFE0BAC7C276D5B200B28D6B974F9019EE25072D2CD76388291E6D706D35FF2627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1093346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\per_0812\Build\Release\WPSOffice\office6\KUninstall.pdb

kernel32

VirtualAlloc VirtualFree GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection CreateFileW FindClose FindFirstFileW GetFileAttributesW FindNextFileW lstrlenW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetFileSize SetFilePointer SetEndOfFile SetFilePointerEx WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemDirectoryW CopyFileW MoveFileExW DeleteFileW GetTickCount CreateDirectoryW ReadFile GetStdHandle WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte SetFileAttributesW RemoveDirectoryW MoveFileW GetWindowsDirectoryW GetCurrentDirectoryW GetTempPathW GetTempFileNameW CompareFileTime GetSystemInfo GetProcAddress GetModuleHandleW lstrlenA GetCurrentProcess GetPrivateProfileStringW FreeLibrary LoadLibraryExW QueryPerformanceCounter OpenMutexW CreateMutexW CreateProcessW LocalFree GetExitCodeProcess Sleep ExpandEnvironmentStringsW LoadLibraryW GetFileAttributesExW TerminateProcess OpenProcess lstrcmpW RaiseException FlushInstructionCache GetCurrentThreadId GetVersion SetLastError FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetPrivateProfileIntW WritePrivateProfileStringW SetCurrentDirectoryW GetCurrentThread InterlockedDecrement GetModuleHandleA Process32NextW Process32FirstW GetCurrentProcessId CreateToolhelp32Snapshot ReadProcessMemory GetModuleFileNameW GetLongPathNameW QueryDosDeviceW ProcessIdToSessionId FileTimeToSystemTime FileTimeToLocalFileTime CreateThread GetLocalTime IsWow64Process HeapFree GetProcessHeap HeapAlloc GetNativeSystemInfo OutputDebugStringW InitializeCriticalSectionAndSpinCount MapViewOfFileEx InterlockedIncrement lstrcmpiW TerminateThread GetLocaleInfoW GetUserDefaultUILanguage ResumeThread SetNamedPipeHandleState WaitNamedPipeW InterlockedCompareExchange LocalAlloc InterlockedExchange LoadLibraryA GetFileSizeEx SystemTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime DeviceIoControl CreateFileA SetCommTimeouts WaitNamedPipeA ReleaseMutex GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread DecodePointer EncodePointer RtlUnwind HeapReAlloc GetSystemTimeAsFileTime ExitProcess GetTimeZoneInformation SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate HeapDestroy UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapSize GetConsoleCP GetConsoleMode GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle FlushFileBuffers WriteConsoleW CompareStringW SetEnvironmentVariableA InterlockedPushEntrySList InterlockedPopEntrySList

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_49449f40b0011d3cc9fa2236d1e162ea_coinminer_darkgate_elex_mafia_smoke-loader

kernel32

generic