2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader
Size 13.9MB
Sample261001-xjaczaac96
SHA256 72417e6e4aa49a851e261e65bc2ab9a30141e04ab73e465542fe2b7f8ac9add5
MD5 0dee07b306b39c27c9bb5b65b2c94743
SHA1 de64800721ed7e60cbbabe2560c468bbf2d5c4d8
SHA512 e0a0956275c978cd37239a80be518378412bfc0eb5fee8dccf3cdb4028bdd286f282fe7e83989df1f4708dc9403e6272d7fa6e311f229688a35c1c1026d512a6
SSDEEP 196608:XrXWFzpwoFdoBxhLGb9qlxTuE8KVQaM5hrkUj6g6NpZs+DxEFlUQ3S:uaxhCRYu5KVQaM5hrkv/qk9
TLSH
T1F6E6E1526986D0D7E09F2DB19626DF961A2A07770F09CFBFA6C4389D1823DD130E9C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

File Explorer

2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

.exe 13.9MB

2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

IMPHASH c0b21a7bea19f3688be1efeeb75127b3
SHA256 72417e6e4aa49a851e261e65bc2ab9a30141e04ab73e465542fe2b7f8ac9add5
MD5 0dee07b306b39c27c9bb5b65b2c94743
SHA1 de64800721ed7e60cbbabe2560c468bbf2d5c4d8
SHA512 e0a0956275c978cd37239a80be518378412bfc0eb5fee8dccf3cdb4028bdd286f282fe7e83989df1f4708dc9403e6272d7fa6e311f229688a35c1c1026d512a6
SSDEEP 196608:XrXWFzpwoFdoBxhLGb9qlxTuE8KVQaM5hrkUj6g6NpZs+DxEFlUQ3S:uaxhCRYu5KVQaM5hrkv/qk9
TLSH
T1F6E6E1526986D0D7E09F2DB19626DF961A2A07770F09CFBFA6C4389D1823DD130E9C2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10300805

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive Beep CloseHandle CompareStringA CopyFileA CreateDirectoryA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateProcessA CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeviceIoControl EncodePointer EnterCriticalSection EnumResourceNamesA EnumSystemLocalesW ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FindResourceA FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDriveTypeA GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileSectionA GetPrivateProfileSectionNamesA GetPrivateProfileStringA GetProcAddress GetProcessHeap GetShortPathNameA GetStartupInfoW GetStdHandle GetStringTypeExA GetStringTypeW GetSystemDefaultUILanguage GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetTempPathA GetTickCount GetTimeFormatA GetUserDefaultLCID GetVersionExW GetVolumeInformationA GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalFileTimeToFileTime LockResource MapViewOfFile MoveFileA MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA Process32First Process32Next QueryDosDeviceA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive RemoveDirectoryA RtlUnwind SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableA SetErrorMode SetFileAttributesA SetFilePointerEx SetFileTime SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetVolumeLabelA SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileSectionA WritePrivateProfileStringA WriteProcessMemory lstrcatW lstrcmpiA

user32

ActivateKeyboardLayout AdjustWindowRectEx AppendMenuA AttachThreadInput BlockInput BringWindowToTop CallNextHookEx CallWindowProcA ChangeClipboardChain CharLowerA CharUpperA CheckMenuItem CheckRadioButton ClientToScreen CloseClipboard CopyImage CountClipboardFormats CreateAcceleratorTableA CreateDialogIndirectParamA CreateIconFromResourceEx CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExA DefDlgProcA DefWindowProcA DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DialogBoxParamA DispatchMessageA DrawIconEx DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EnumChildWindows EnumClipboardFormats EnumDisplayMonitors EnumWindows ExitWindowsEx FillRect FindWindowA FlashWindow GetAncestor GetAsyncKeyState GetClassInfoExA GetClassLongA GetClassNameA GetClientRect GetClipboardData GetClipboardFormatNameA GetCursorInfo GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetFocus GetForegroundWindow GetGUIThreadInfo GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutNameA GetKeyboardState GetLastInputInfo GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuStringA GetMessageA GetMessagePos GetMonitorInfoA GetParent GetPropA GetQueueStatus GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetUpdateRect GetWindow GetWindowLongA GetWindowRect GetWindowTextA GetWindowTextLengthA GetWindowThreadProcessId InsertMenuItemA IntersectRect InvalidateRect IsCharAlphaA IsCharAlphaNumericA IsCharLowerA IsCharUpperA IsClipboardFormatAvailable IsDialogMessageA IsIconic IsMenu IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadAcceleratorsA LoadCursorA LoadImageA MapVirtualKeyA MapVirtualKeyExA MapWindowPoints MessageBeep MessageBoxA MonitorFromPoint MoveWindow OpenClipboard PeekMessageA PostMessageA PostMessageW PostQuitMessage PostThreadMessageA PtInRect RedrawWindow RegisterClassExA RegisterHotKey RegisterWindowMessageA ReleaseDC RemoveMenu RemovePropA ScreenToClient SendDlgItemMessageA SendInput SendMessageA SendMessageTimeoutA SendMessageW SetActiveWindow SetClipboardData SetClipboardViewer SetDlgItemTextA SetFocus SetForegroundWindow SetKeyboardState SetLayeredWindowAttributes SetMenu SetMenuDefaultItem SetMenuInfo SetMenuItemInfoA SetParent SetPropA SetRect SetTimer SetWindowLongA SetWindowPos SetWindowRgn SetWindowTextA SetWindowTextW SetWindowsHookExA ShowWindow SystemParametersInfoA ToAsciiEx TrackPopupMenuEx TranslateAcceleratorA TranslateMessage UnhookWindowsHookEx UnregisterHotKey UpdateWindow VkKeyScanExA WindowFromPoint keybd_event mouse_event

shell32

DragFinish DragQueryFileA DragQueryPoint ExtractIconA SHBrowseForFolderA SHEmptyRecycleBinA SHFileOperationA SHGetDesktopFolder SHGetFolderPathA SHGetMalloc SHGetPathFromIDListA ShellExecuteExA Shell_NotifyIconA

winmm

joyGetDevCapsA joyGetPosEx mciSendStringA mixerClose mixerGetControlDetailsA mixerGetDevCapsA mixerGetLineControlsA mixerGetLineInfoA mixerOpen mixerSetControlDetails waveOutGetVolume waveOutSetVolume

comctl32

ord6 ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_GetIconSize ImageList_ReplaceIcon InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection CreateEllipticRgn CreateFontA CreatePatternBrush CreatePolygonRgn CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExA ExcludeClipRect FillRgn GdiFlush GetCharABCWidthsA GetClipBox GetClipRgn GetDIBits GetDeviceCaps GetObjectA GetPixel GetStockObject GetSystemPaletteEntries GetTextFaceA GetTextMetricsA SelectObject SetBkColor SetBkMode SetBrushOrgEx SetTextColor

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetObject CoInitialize CoUninitialize CreateStreamOnHGlobal OleInitialize OleUninitialize StringFromGUID2

advapi32

AdjustTokenPrivileges CloseServiceHandle GetUserNameA LockServiceDatabase LookupPrivilegeValueA OpenProcessToken OpenSCManagerA RegCloseKey RegConnectRegistryA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA UnlockServiceDatabase

psapi

GetModuleBaseNameA GetModuleFileNameExA GetProcessImageFileNameA

comdlg32

CommDlgExtendedError GetOpenFileNameA GetSaveFileNameA

wsock32

WSACleanup WSAStartup gethostbyname gethostname inet_addr

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile InternetReadFileExA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

oleaut32

GetActiveObject OleLoadPicture SafeArrayAccessData SafeArrayCopy SafeArrayCreate SafeArrayDestroy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayLock SafeArrayPtrOfIndex SafeArrayUnaccessData SafeArrayUnlock SysAllocString SysFreeString SysStringLen VariantChangeType VariantClear VariantCopyInd

shlwapi

PathFindFileNameA

ntdll

RtlGetVersion

Name

.text

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

673KB

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.)Py

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_0dee07b306b39c27c9bb5b65b2c94743_amadey_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

kernel32

user32

shell32

winmm

comctl32

gdi32

ole32

advapi32

psapi

comdlg32

wsock32

wininet

version

oleaut32

shlwapi

ntdll

generic