2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos
Size 2.4MB
Sample261002-e833gavz9n
SHA256 87d54fc33ba3749a6df8a3edb2ffe9a995a766c9273a0e3c4196c2a72e5fb712
MD5 ba01bcb66972216309424f0e75f379ad
SHA1 50457d4d6425bce34084500b1fa536b580cbf93b
SHA512 d3473df6a80f8bbb21005714596a80006c6ce0aa9b4dc7974a9e33c22b1c4ca2e31103f6a3f0997d3f993a911fd420dc44fac02c4f048ce167e427441dac24af
SSDEEP 24576:GfiRmiAa9JXUMNpMO6OM29m7A9aJ0Wa9mJ+09aKngL2jdshRTdG1YxITqvfPkbIp:IzUJEapaOMv7Aoa39MN9arSj8RoTCCW
TLSH
T15AC51220B682C032D5B302710E78EAAA187DBF744F7659DBB3E41E6D1E746C11A36F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos

.exe 2.4MB

2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos

IMPHASH a6e1b65616492f24d85bc78a14d2aacf
SHA256 87d54fc33ba3749a6df8a3edb2ffe9a995a766c9273a0e3c4196c2a72e5fb712
MD5 ba01bcb66972216309424f0e75f379ad
SHA1 50457d4d6425bce34084500b1fa536b580cbf93b
SHA512 d3473df6a80f8bbb21005714596a80006c6ce0aa9b4dc7974a9e33c22b1c4ca2e31103f6a3f0997d3f993a911fd420dc44fac02c4f048ce167e427441dac24af
SSDEEP 24576:GfiRmiAa9JXUMNpMO6OM29m7A9aJ0Wa9mJ+09aKngL2jdshRTdG1YxITqvfPkbIp:IzUJEapaOMv7Aoa39MN9arSj8RoTCCW
TLSH
T15AC51220B682C032D5B302710E78EAAA187DBF744F7659DBB3E41E6D1E746C11A36F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadConsoleW OpenProcess LoadLibraryA Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot GetTickCount WTSGetActiveConsoleSessionId GetPrivateProfileIntW FindResourceExW CreateThread CloseHandle SetLastError GetCurrentThreadId InterlockedIncrement InterlockedDecrement LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar EnterCriticalSection LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary SetEvent WaitForSingleObject OutputDebugStringW CreateEventW GetModuleFileNameW GetProcessHeap TerminateThread LockResource DeleteCriticalSection HeapDestroy DecodePointer IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache HeapAlloc VirtualAlloc VirtualFree LoadLibraryExA ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetACP LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringA SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW GetFileSize ReadFile GetThreadLocale SetThreadLocale CreateMutexW LocalFree GetPrivateProfileStringW ReleaseMutex DeleteFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile WritePrivateProfileStringW lstrlenA GetLongPathNameW RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent HeapFree

user32

GetWindowLongW CallWindowProcW UnregisterClassW CharNextW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetWindowLongW KillTimer PostQuitMessage SetTimer CreateWindowExW LoadCursorW GetClassInfoExW DestroyWindow RegisterClassExW PeekMessageW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptReleaseContext CryptHashData DuplicateTokenEx LookupPrivilegeValueW GetTokenInformation OpenProcessToken CreateProcessAsUserW RegQueryValueExW RevertToSelf ImpersonateLoggedOnUser RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerW DeleteService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW StartServiceCtrlDispatcherW CryptDeriveKey CryptEncrypt CryptDecrypt

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathA SHGetSpecialFolderPathW SHGetFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VariantClear VarUI4FromStr

shlwapi

PathIsDirectoryW PathSearchAndQualifyW AssocQueryStringW PathCanonicalizeW PathRemoveBackslashW SHGetValueW PathIsPrefixW PathRemoveFileSpecW PathAppendW PathFindFileNameW PathFileExistsW PathCombineW

comctl32

InitCommonControlsEx

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

EnumProcessModules

wtsapi32

WTSQueryUserToken

Name

.text

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_ba01bcb66972216309424f0e75f379ad_coinminer_darkgate_elex_graphican_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

userenv

psapi

wtsapi32

generic