2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

General

Target
2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader
Size 2.6MB
Sample261029-1h36fae141
SHA256 c0fe4638f8a5c5a13b6e8dbd0ee6570ee3307a15abf6279852fc512a61a27f63
MD5 a784f9b91a6363facbd82f31950b5c29
SHA1 cad73e030961af0013b6a63c0df3517a54bce9c2
SHA512 ea370deac50696f3559b75b9409dd819ad5cc84ece5640d31c661c5af9cec1d971d84e90fb175d1d040b0103b42832ecbb3f58671331cd97278236e448f37f5f
SSDEEP 49152:MmDta4Qvnlj4oJdXN0BMOwLloBrug10g7mM+M6RkMkIM7I067:MCg9JdXN0B7+smM+M6RkMkIM7
TLSH
T126D58D1EFF90DC76D17202308966D37C5166BD704A21560BB398BA1DEDB0FC2693AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

File Explorer

2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

.exe 2.6MB

2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

SHA256 c0fe4638f8a5c5a13b6e8dbd0ee6570ee3307a15abf6279852fc512a61a27f63
MD5 a784f9b91a6363facbd82f31950b5c29
SHA1 cad73e030961af0013b6a63c0df3517a54bce9c2
SHA512 ea370deac50696f3559b75b9409dd819ad5cc84ece5640d31c661c5af9cec1d971d84e90fb175d1d040b0103b42832ecbb3f58671331cd97278236e448f37f5f
SSDEEP 49152:MmDta4Qvnlj4oJdXN0BMOwLloBrug10g7mM+M6RkMkIM7I067:MCg9JdXN0B7+smM+M6RkMkIM7
TLSH
T126D58D1EFF90DC76D17202308966D37C5166BD704A21560BB398BA1DEDB0FC2693AE27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

150292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\selfcert.pdb

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_a784f9b91a6363facbd82f31950b5c29_amadey_coinminer_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

generic