2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader

General

Target
2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader
Size 3.1MB
Sample261012-r6ecjsfx8p
SHA256 e094c3b39cb0adf4b36eb9e3d7b01c5df5956490f0dee6c34bb0531d0a313048
MD5 9e90eaef013d3492d74f7d3fc89eebab
SHA1 7419d5491473224f0daacbf1f498ef24dceaf2b3
SHA512 01d9b6ed3eaf9854ba9fd5660e51fca2c87808839e145faba37938aa73018acc18502311d958e57ad5d024d6776ab3c1b1864f184278cf0af42574af76246019
SSDEEP 49152:zDb/3lziLR+PIgtpYfUUeLR+0cg6l3Y3QJeFHYptCDE7:zDb/3lzARoI4pmOR+0gzJbptCI7
TLSH
T143E5AEE0BAC7C676D5B200B29D6B974F9019EE250B2D1CD76388391E6C706D35BF2623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader

File Explorer

2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader

.exe 3.1MB

2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader

IMPHASH a07a78f1a7758cc936f5c9a20843cbb4
SHA256 e094c3b39cb0adf4b36eb9e3d7b01c5df5956490f0dee6c34bb0531d0a313048
MD5 9e90eaef013d3492d74f7d3fc89eebab
SHA1 7419d5491473224f0daacbf1f498ef24dceaf2b3
SHA512 01d9b6ed3eaf9854ba9fd5660e51fca2c87808839e145faba37938aa73018acc18502311d958e57ad5d024d6776ab3c1b1864f184278cf0af42574af76246019
SSDEEP 49152:zDb/3lziLR+PIgtpYfUUeLR+0cg6l3Y3QJeFHYptCDE7:zDb/3lzARoI4pmOR+0gzJbptCI7
TLSH
T143E5AEE0BAC7C676D5B200B29D6B974F9019EE250B2D1CD76388391E6C706D35BF2623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1093346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\per_0812\Build\Release\WPSOffice\office6\KUninstall.pdb

kernel32

VirtualAlloc VirtualFree GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection CreateFileW FindClose FindFirstFileW GetFileAttributesW FindNextFileW lstrlenW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetFileSize SetFilePointer SetEndOfFile SetFilePointerEx WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemDirectoryW CopyFileW MoveFileExW DeleteFileW GetTickCount CreateDirectoryW ReadFile GetStdHandle WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte SetFileAttributesW RemoveDirectoryW MoveFileW GetWindowsDirectoryW GetCurrentDirectoryW GetTempPathW GetTempFileNameW CompareFileTime GetSystemInfo GetProcAddress GetModuleHandleW lstrlenA GetCurrentProcess GetPrivateProfileStringW FreeLibrary LoadLibraryExW QueryPerformanceCounter OpenMutexW CreateMutexW CreateProcessW LocalFree GetExitCodeProcess Sleep ExpandEnvironmentStringsW LoadLibraryW GetFileAttributesExW TerminateProcess OpenProcess lstrcmpW RaiseException FlushInstructionCache GetCurrentThreadId GetVersion SetLastError FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetPrivateProfileIntW WritePrivateProfileStringW SetCurrentDirectoryW GetCurrentThread InterlockedDecrement GetModuleHandleA Process32NextW Process32FirstW GetCurrentProcessId CreateToolhelp32Snapshot ReadProcessMemory GetModuleFileNameW GetLongPathNameW QueryDosDeviceW ProcessIdToSessionId FileTimeToSystemTime FileTimeToLocalFileTime CreateThread GetLocalTime IsWow64Process HeapFree GetProcessHeap HeapAlloc GetNativeSystemInfo OutputDebugStringW InitializeCriticalSectionAndSpinCount MapViewOfFileEx InterlockedIncrement lstrcmpiW TerminateThread GetLocaleInfoW GetUserDefaultUILanguage ResumeThread SetNamedPipeHandleState WaitNamedPipeW InterlockedCompareExchange LocalAlloc InterlockedExchange LoadLibraryA GetFileSizeEx SystemTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime DeviceIoControl CreateFileA SetCommTimeouts WaitNamedPipeA ReleaseMutex GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread DecodePointer EncodePointer RtlUnwind HeapReAlloc GetSystemTimeAsFileTime ExitProcess GetTimeZoneInformation SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate HeapDestroy UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapSize GetConsoleCP GetConsoleMode GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle FlushFileBuffers WriteConsoleW CompareStringW SetEnvironmentVariableA InterlockedPushEntrySList InterlockedPopEntrySList

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_9e90eaef013d3492d74f7d3fc89eebab_coinminer_darkgate_elex_mafia_smoke-loader

kernel32

generic