2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza
Size 2.0MB
Sample261012-tcr3naxyhz
SHA256 0efa35aa99c20c4921ee6617c635b4e8879b2a5dcf37d82757742675d8f9c73f
MD5 924628e029f3d0166a232953530e62f6
SHA1 ab835670385e885dc24333e7f206713c9470367a
SHA512 58865022b3c5b7b04de01e9a6e6854d6142ca67d24be38d88a5d58c7c5f3056cd35787df140aff9f1cb3146450da6aca80bfbd1c36e7c9bbff9037ed83421839
SSDEEP 49152:Ipi/3dWfcUnx4x8EVepWxgRWGeTz+71iY:IspGix8EVyomWGe/eiY
TLSH
T1BBA5E111E74F80B2EB9601B583EA5BFF0D269E3703154DE796843A6D5C30DD23A3AA47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza

File Explorer

2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza

.exe 2.0MB

2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza

IMPHASH 3a698cb4bef550cea660686212d98be9
SHA256 0efa35aa99c20c4921ee6617c635b4e8879b2a5dcf37d82757742675d8f9c73f
MD5 924628e029f3d0166a232953530e62f6
SHA1 ab835670385e885dc24333e7f206713c9470367a
SHA512 58865022b3c5b7b04de01e9a6e6854d6142ca67d24be38d88a5d58c7c5f3056cd35787df140aff9f1cb3146450da6aca80bfbd1c36e7c9bbff9037ed83421839
SSDEEP 49152:Ipi/3dWfcUnx4x8EVepWxgRWGeTz+71iY:IspGix8EVyomWGe/eiY
TLSH
T1BBA5E111E74F80B2EB9601B583EA5BFF0D269E3703154DE796843A6D5C30DD23A3AA47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

550389

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-international\output\TeraBoxWebService.pdb

kernel32

GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers OpenMutexW ReleaseMutex OpenFileMappingW SizeofResource LockResource LoadResource FindResourceW InterlockedCompareExchange VirtualQuery GetModuleHandleW GetModuleFileNameW CreateProcessW InitializeCriticalSectionAndSpinCount RaiseException CreateEventA InterlockedIncrement InterlockedExchange InterlockedDecrement TlsAlloc CreateEventW SetEvent ResetEvent TlsGetValue TlsSetValue TlsFree OpenEventW OpenProcess TerminateProcess GetPrivateProfileIntW WriteConsoleW SetConsoleTextAttribute FreeConsole GetConsoleScreenBufferInfo GetStdHandle AllocConsole OpenEventA InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile FindResourceExW AreFileApisANSI

user32

IsWindow SendMessageTimeoutW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetSpecialFolderPathW

ole32

CoFreeLibrary CoUninitialize CoInitializeEx CoLoadLibrary CoCreateInstance

oleaut32

SysStringLen SysAllocString SysAllocStringLen SysFreeString

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

shlwapi

SHDeleteKeyW

psapi

GetModuleBaseNameW EnumProcesses

ws2_32

WSACleanup WSAStartup

vcruntime140

memcpy memset _except_handler4_common _CxxThrowException __vcrt_InitializeCriticalSectionEx __CxxFrameHandler3 wcsstr wcsrchr wcschr _purecall __std_exception_destroy memmove __std_exception_copy __std_terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf _wfsopen fclose __stdio_common_vfwprintf _set_fmode fflush __stdio_common_vswprintf_s __stdio_common_vswscanf __stdio_common_vsnwprintf_s __p__commode

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex _invalid_parameter_noinfo _controlfp_s strerror _errno _endthreadex _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _invalid_parameter_noinfo_noreturn _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode realloc _msize

api-ms-win-crt-string-l1-1-0

wcsspn wcscspn wcsncpy_s wcsnlen _wcslwr_s strncmp iswspace wcscat_s wcscpy_s _wcsicmp isxdigit wmemcpy_s

api-ms-win-crt-time-l1-1-0

_localtime64_s wcsftime _time64

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_924628e029f3d0166a232953530e62f6_coinminer_darkgate_elex_mespinoza

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

shlwapi

psapi

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic