2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 2.2MB
Sample261107-zh1vmsgb42
SHA256 22e5b8245078881d9800341e22fe5361e949b74e92cd964b12305c65177b2257
MD5 e26ffad21f3ac0f6f9b2e3aab7e3d7b7
SHA1 7e060d25d04c59d78526b248f95eaad7d0568a00
SHA512 1d30060c71f154edbf072545dea8b7ca6134fe13d53664d3f9044f73f4648efc7b7f1842041b370c641711f3ca5c9d9a9e573a4090f51b3b11dd43ec85451f68
SSDEEP 49152:iOfTpLcy7OY+UXUhXUejL0ZeDikr1Py6qxF1i2Vg6p2aQICxhBZ8X:iOpcy7OLUXUTikJ32yi2/xCX
TLSH
T108B5BF21B956C131D96042B0CA7CEBAAD06EAD2C5FB105DFA3D03F2D69305D25B31E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 2.2MB

2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH f5a2e8b5e316d963ad658523ff565570
SHA256 22e5b8245078881d9800341e22fe5361e949b74e92cd964b12305c65177b2257
MD5 e26ffad21f3ac0f6f9b2e3aab7e3d7b7
SHA1 7e060d25d04c59d78526b248f95eaad7d0568a00
SHA512 1d30060c71f154edbf072545dea8b7ca6134fe13d53664d3f9044f73f4648efc7b7f1842041b370c641711f3ca5c9d9a9e573a4090f51b3b11dd43ec85451f68
SSDEEP 49152:iOfTpLcy7OY+UXUhXUejL0ZeDikr1Py6qxF1i2Vg6p2aQICxhBZ8X:iOpcy7OLUXUTikJ32yi2/xCX
TLSH
T108B5BF21B956C131D96042B0CA7CEBAAD06EAD2C5FB105DFA3D03F2D69305D25B31E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

591590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v11_personal_20230323-1\Build\Release\WPSOffice\office6\photolaunch.pdb

kernel32

GetCommandLineW CloseHandle GetLastError GetCurrentProcessId TerminateProcess OpenProcess FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW OutputDebugStringW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateProcessW FindResourceExW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW LocalFree CopyFileW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask CreateFileW GetFileAttributesExW ReadFile WaitForSingleObject SetDllDirectoryW VerifyVersionInfoW SetEvent CreateEventW Sleep GetExitCodeProcess GetCurrentThreadId GetSystemTime SystemTimeToFileTime CreateThread GetSystemDirectoryA LoadLibraryA ReleaseMutex OpenMutexW GetFileAttributesW GetTickCount GetSystemDirectoryW GetSystemWow64DirectoryW GetPrivateProfileStringW CreateMutexW VirtualQuery CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile WideCharToMultiByte DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects QueueUserWorkItem UnregisterWaitEx FlushFileBuffers WriteFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo GetCurrentProcess LocalAlloc SetUnhandledExceptionFilter GetProcessId LoadLibraryExW SetErrorMode GetModuleHandleExW VirtualAlloc VirtualFree GetTempPathW GetStartupInfoW GetDllDirectoryW CreateDirectoryW SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes SetEndOfFile WriteConsoleW SetStdHandle GetSystemInfo VirtualProtect LoadLibraryExA CompareFileTime FindClose FindFirstFileW FindNextFileW GetFileSizeEx SetFilePointerEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime lstrlenW GetPrivateProfileIntW GetUserDefaultUILanguage ExpandEnvironmentStringsW ProcessIdToSessionId GetCompressedFileSizeW ReleaseSemaphore CreateSemaphoreW GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FreeLibraryAndExitThread InterlockedPushEntrySList RtlUnwind GetCommandLineA ExitThread SetConsoleCtrlHandler GetStdHandle ExitProcess IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleCP GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

krpt

?_force_link_krpt@@YGXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_e26ffad21f3ac0f6f9b2e3aab7e3d7b7_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader

kernel32

krpt

generic