2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys

General

Target
2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys
Size 3.9MB
Sample261011-ws2cdaed39
SHA256 e18943bda9e8ad9cee433b7a04d1f856ebfe44b36bc501f71d09f374792173b5
MD5 2b2001e405c60925f5d54e18cbb85dbe
SHA1 117e73e7ea6e4cdaad1cf66082ee93590a7227b2
SHA512 53c1363f7641dec243019e9d5731e84ef327d1c36fc249dca1b83a693f205a3a8c610731d19821e5ae8c7468390c98ab9fe986fbbf52fa8ae5d07a63b8ce69be
SSDEEP 49152:teODSmUi6AjW/MUSdGRf3/aoJdXN0BMOwLloBrugag/:tewjxAZBJdXN0B7+sX
TLSH
T15916A3022D0C9521CC5F3D30699092BAF9907CAFBD1F78562EC07E9DEAB79C1769D122
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys

File Explorer

2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys

.exe 3.9MB

2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys

IMPHASH 92f377bec2fd08bb16ed274dff1cdbcc
SHA256 e18943bda9e8ad9cee433b7a04d1f856ebfe44b36bc501f71d09f374792173b5
MD5 2b2001e405c60925f5d54e18cbb85dbe
SHA1 117e73e7ea6e4cdaad1cf66082ee93590a7227b2
SHA512 53c1363f7641dec243019e9d5731e84ef327d1c36fc249dca1b83a693f205a3a8c610731d19821e5ae8c7468390c98ab9fe986fbbf52fa8ae5d07a63b8ce69be
SSDEEP 49152:teODSmUi6AjW/MUSdGRf3/aoJdXN0BMOwLloBrugag/:tewjxAZBJdXN0B7+sX
TLSH
T15916A3022D0C9521CC5F3D30699092BAF9907CAFBD1F78562EC07E9DEAB79C1769D122
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW GetModuleFileNameW SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW GetFileType SignalObjectAndWait CreateFileW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetModuleHandleExW SetLastError GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW TerminateProcess ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW HeapFree EncodePointer DecodePointer HeapAlloc HeapReAlloc IsProcessorFeaturePresent LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_2b2001e405c60925f5d54e18cbb85dbe_coinminer_darkgate_elex_maze_rhadamanthys

kernel32

winmm

advapi32

generic