2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.7MB
Sample261003-1ctd2sys9p
SHA256 6c728b2980be15e4ba43ccb4b87b53b46105e31ad56faf7e941f77937a74f1cc
MD5 270411dfa082f5d104f3fee57de7756e
SHA1 37aaf90ae2bd0f05407834778cd2c098fb770783
SHA512 d447a04e4467436306eead680105957efd6ae7d1c7396950a03df456e41753d7ec52b850d2905d3b26f2635b2e77b88b90b5ab65fab30aa2505f27e439996bde
SSDEEP 24576:f9pI85007b736UogCjWOqKVNcnw0ZVwoB0aKngL2jdshRTdG1YxITqvfPkbIcbjK:f9pX39KWOqY+nw0ZVw80arSj8RoTCCW
TLSH
T17085D0507756E232E56082F24D79AF96906DAD2C1F7206CFA3C41F3E88356D22E31E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 1.7MB

2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH fc1f1701cc2cd2382801317bb6201029
SHA256 6c728b2980be15e4ba43ccb4b87b53b46105e31ad56faf7e941f77937a74f1cc
MD5 270411dfa082f5d104f3fee57de7756e
SHA1 37aaf90ae2bd0f05407834778cd2c098fb770783
SHA512 d447a04e4467436306eead680105957efd6ae7d1c7396950a03df456e41753d7ec52b850d2905d3b26f2635b2e77b88b90b5ab65fab30aa2505f27e439996bde
SSDEEP 24576:f9pI85007b736UogCjWOqKVNcnw0ZVwoB0aKngL2jdshRTdG1YxITqvfPkbIcbjK:f9pX39KWOqY+nw0ZVw80arSj8RoTCCW
TLSH
T17085D0507756E232E56082F24D79AF96906DAD2C1F7206CFA3C41F3E88356D22E31E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

478370

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\rc_v11_personal_20220421_branch\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW GetPrivateProfileStringW MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter CreateProcessW GetProcessId LoadLibraryExW OutputDebugStringW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW SetEvent CreateEventW GetModuleHandleExW VirtualAlloc VirtualFree GetFileAttributesExW GetSystemInfo SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA lstrlenW GetPrivateProfileIntW ExpandEnvironmentStringsW ProcessIdToSessionId CompareFileTime FindClose FindFirstFileW FindNextFileW GetFileSizeEx SetFilePointerEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCompressedFileSizeW ReleaseSemaphore CreateSemaphoreW GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter RtlUnwind InterlockedPushEntrySList SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess SetEnvironmentVariableW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

kernel32

generic