2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

General

Target
2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader
Size 2.1MB
Sample261011-gem59set6m
SHA256 cd360eea9d824d60a778e30294abbc1d18a8280b4e93f3118e9487da91941432
MD5 ad41500ba622ca0c5c16567b7ac51391
SHA1 cf5afdae94d74de77304cfb7b55b47abce3642e8
SHA512 ad2958369f73ebe45e02a62486c9a7388c440b7e701dee5f763e078e84550d4ed0276547e421ad41986f01fb6bb9b7b744cad00ac44d7335b6e7a950cdc71abe
SSDEEP 49152:NJLn4aUAwyU/U7diOZCqyS+b5vqUxhkoWKiWpajlcWvC9Y6:TLn4ewyU/kwbb5v4KnQYz
TLSH
T128A5CF217657C231E66041B08D7CEFAAD46CAD2C5F7246CBF7C43B2956305C22F36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

.exe 2.1MB

2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

IMPHASH 100d4d6870537c16ef3a268a7b35583f
SHA256 cd360eea9d824d60a778e30294abbc1d18a8280b4e93f3118e9487da91941432
MD5 ad41500ba622ca0c5c16567b7ac51391
SHA1 cf5afdae94d74de77304cfb7b55b47abce3642e8
SHA512 ad2958369f73ebe45e02a62486c9a7388c440b7e701dee5f763e078e84550d4ed0276547e421ad41986f01fb6bb9b7b744cad00ac44d7335b6e7a950cdc71abe
SSDEEP 49152:NJLn4aUAwyU/U7diOZCqyS+b5vqUxhkoWKiWpajlcWvC9Y6:TLn4ewyU/kwbb5v4KnQYz
TLSH
T128A5CF217657C231E66041B08D7CEFAAD46CAD2C5F7246CBF7C43B2956305C22F36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

596008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_9a2o\rc_v11_per_143\Build\Release\WPSOffice\office6\wps_host.pdb

kernel32

GetCommandLineW LocalFree CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW VerSetConditionMask CreateDirectoryW CreateFileW GetFileAttributesW GetPrivateProfileStringW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte OutputDebugStringW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateProcessW FindResourceExW LoadResource LockResource SizeofResource FindResourceW SetEvent CreateEventW GetExitCodeProcess ReleaseMutex OpenMutexW GetSystemTime SystemTimeToFileTime GetFileAttributesExW ReadFile WaitForSingleObject DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx FlushFileBuffers WriteFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo GetCurrentProcess LocalAlloc SetUnhandledExceptionFilter GetProcessId LoadLibraryExW CreateMutexW VirtualQuery CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetSystemDirectoryA LoadLibraryA VirtualAlloc VirtualFree SetErrorMode GetModuleHandleExW SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes SetEndOfFile WriteConsoleW SetStdHandle GetSystemInfo VirtualProtect LoadLibraryExA lstrlenW GetPrivateProfileIntW GetUserDefaultUILanguage CompareFileTime FindClose FindFirstFileW FindNextFileW GetFileSizeEx SetFilePointerEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsW ProcessIdToSessionId GetCompressedFileSizeW ReleaseSemaphore CreateSemaphoreW GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FreeLibraryAndExitThread InterlockedPushEntrySList RtlUnwind GetCommandLineA ExitThread SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW SetEnvironmentVariableW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

krpt

?_force_link_krpt@@YGXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_ad41500ba622ca0c5c16567b7ac51391_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader

kernel32

krpt

generic