2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry
Size 7.3MB
Sample260628-xc7d5act7j
SHA256 8c1e570b5273389f81b830e58a5264bedd8c39df5c0faf9ebdd32a4c57136880
MD5 d7ed5a4f7bd3a9b945de247b7a2e1a7a
SHA1 75bbf1ed2b334e4eb358f31d8997f3d780975410
SHA512 78cad5065f3b56dbd13c3700d6e02a88e5cf998d50d5cd4a57bbd9e492ba8ca2a39dc48a8d23757c9c77ae05e3261749d0fec4d51c3d2feeee3ce50876e57991
SSDEEP 196608:bcY48x8kLzmgAWXGABxVVG6hrlo0rG1NETvu6Ps42g5DdnHhjlahOB:A8x8kLzmjOLjVAEk42g5DdBjlahO
TLSH
T16C764A06E342E00BF9B700F1B95E976B71102B30A740D48BB7C49E6E77B95E2A63571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry

File Explorer

2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry

.exe 7.3MB

2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry

IMPHASH 1be10437bc6b51a93d46e60600bc8450
SHA256 8c1e570b5273389f81b830e58a5264bedd8c39df5c0faf9ebdd32a4c57136880
MD5 d7ed5a4f7bd3a9b945de247b7a2e1a7a
SHA1 75bbf1ed2b334e4eb358f31d8997f3d780975410
SHA512 78cad5065f3b56dbd13c3700d6e02a88e5cf998d50d5cd4a57bbd9e492ba8ca2a39dc48a8d23757c9c77ae05e3261749d0fec4d51c3d2feeee3ce50876e57991
SSDEEP 196608:bcY48x8kLzmgAWXGABxVVG6hrlo0rG1NETvu6Ps42g5DdnHhjlahOB:A8x8kLzmjOLjVAEk42g5DdBjlahO
TLSH
T16C764A06E342E00BF9B700F1B95E976B71102B30A740D48BB7C49E6E77B95E2A63571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5972842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

wininet

InternetCloseHandle FtpPutFileA InternetConnectA InternetOpenA

ddraw

DirectDrawCreateEx

winmm

timeGetTime

ws2_32

inet_ntoa WSAWaitForMultipleEvents WSAEnumNetworkEvents recv send setsockopt WSASocketA gethostbyname WSAEventSelect inet_addr htons WSAConnect WSAGetLastError WSACloseEvent WSACleanup WSAStartup WSACreateEvent gethostname closesocket

kernel32

GetCurrentProcess CreateFileA GetLocalTime SetUnhandledExceptionFilter GetPrivateProfileStringA GetPrivateProfileIntA GetCurrentDirectoryA Sleep GetLastError CreateMutexA InterlockedDecrement InterlockedIncrement DeleteFileA GetProcAddress LoadLibraryA FreeLibrary CreateEventA SetEvent lstrlenA Module32Next Module32First Process32First CreateToolhelp32Snapshot SetEnvironmentVariableA GetEnvironmentVariableA WritePrivateProfileStringA GetNumberFormatA lstrcmpA FindClose FindNextFileA FindFirstFileA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar UnmapViewOfFile MapViewOfFile CreateFileMappingA IsBadWritePtr lstrcmpiA GetVersionExA GlobalMemoryStatus GetComputerNameA IsBadReadPtr ResetEvent WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter GetDiskFreeSpaceExA ReadFile GetFileSize GetTempFileNameA GetTempPathA SetCurrentDirectoryA WideCharToMultiByte CreateFileW HeapFree GetProcessHeap GetModuleHandleA IsProcessorFeaturePresent WriteFile GetCurrentThread CloseHandle OutputDebugStringA GetStartupInfoA Process32Next

user32

UnregisterClassA ChangeDisplaySettingsA DispatchMessageA CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx GetAsyncKeyState SetTimer SystemParametersInfoA DrawTextW ReleaseCapture SetCapture GetSystemMetrics CharNextA GetWindowLongA CallWindowProcA DestroyWindow EnableWindow SetWindowLongA MoveWindow GetWindowTextA SetRect CharUpperA wsprintfA GetKeyboardLayout SetFocus SendMessageA BeginPaint DrawTextA EndPaint PostQuitMessage SetWindowTextA GetActiveWindow IsIconic DefWindowProcA IsWindow PostMessageA MessageBoxA EnumDisplaySettingsA LoadIconA LoadCursorA RegisterClassExA CreateWindowExA TranslateMessage ShowWindow UpdateWindow GetClientRect SetCursorPos ShowCursor PeekMessageA GetMessageA KillTimer

gdi32

CreateFontA CreateFontIndirectA SetBkMode CreateDIBSection CreateCompatibleDC SetBkColor GetObjectA DeleteDC SetTextColor SelectObject DeleteObject

advapi32

RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

ole32

CoCreateInstance CoUninitialize CoInitialize

imagehlp

SymFunctionTableAccess SymGetOptions SymSetOptions SymInitialize SymCleanup SymGetModuleInfo SymGetSymFromAddr StackWalk SymGetModuleBase

imm32

ImmSetCompositionStringA ImmGetDescriptionA ImmGetOpenStatus ImmReleaseContext ImmGetContext ImmSetOpenStatus

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

msvcirt

??5istream@@QAEAAV0@AAH@Z ??1ios@@UAE@XZ ??1ofstream@@UAE@XZ ??_Difstream@@QAEXXZ ??1ifstream@@UAE@XZ ??5istream@@QAEAAV0@PAD@Z ?eatwhite@istream@@QAEXXZ _mtunlock ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ ?getline@istream@@QAEAAV1@PADHD@Z ?lock@ios@@QAAXXZ ??5istream@@QAEAAV0@AAI@Z ?open@ofstream@@QAEXPBDHH@Z ??0ifstream@@QAE@XZ ?open@ifstream@@QAEXPBDHH@Z ??6ostream@@QAEAAV0@I@Z ??6ostream@@QAEAAV0@G@Z ?unlock@ios@@QAAXXZ ??5istream@@QAEAAV0@AAG@Z ??0ofstream@@QAE@PBDHH@Z ??6ostream@@QAEAAV0@PBD@Z ??6ostream@@QAEAAV0@N@Z ?endl@@YAAAVostream@@AAV1@@Z ??6ostream@@QAEAAV0@H@Z ??6ostream@@QAEAAV0@K@Z ?get@istream@@IAEAAV1@PADHH@Z ?close@ofstream@@QAEXXZ ??_Dofstream@@QAEXXZ ?openprot@filebuf@@2HB ??0ifstream@@QAE@PBDHH@Z ??5istream@@QAEAAV0@AAM@Z ??5istream@@QAEAAV0@AAK@Z ?close@ifstream@@QAEXXZ _mtlock ??0ofstream@@QAE@XZ

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Xlen@std@@YAXXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

msvcrt

strrchr tolower toupper _getcwd strchr atof fscanf _mbschr _CIatan2 _mbsstr fwrite wcsstr _CIpow _CIsqrt _mbscspn strpbrk strcspn _itoa strncat _mbstok localtime _atoi64 _mbsupr printf _CIlog vsprintf _CIcos _CIasin _CIacos ceil _CItan _finite bsearch floor fprintf _strupr _CIlog10 _beginthreadex _endthreadex _errno system _stricmp __RTDynamicCast _mbsinc _ismbcspace fgets _EH_prolog _vsnprintf isdigit isalpha isalnum isspace sscanf free _strdup setlocale longjmp _setjmp3 _controlfp exit malloc calloc _CxxThrowException clock memcpy _except_handler3 ?terminate@@YAXXZ __dllonexit _onexit ??1type_info@@UAE@XZ _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _unlink _ftol strtok memmove _CIatan _strnicmp strncpy _mkdir sprintf ??2@YAPAXI@Z __CxxFrameHandler atoi _purecall rand srand time rename fclose fopen strncmp _chdir _snprintf fread ftell fseek _CIsin

dinput8

DirectInput8Create

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

216KB

Virtual Size

748KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gdi

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_d7ed5a4f7bd3a9b945de247b7a2e1a7a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wannacry

rpcrt4

wininet

ddraw

winmm

ws2_32

kernel32

user32

gdi32

advapi32

ole32

imagehlp

imm32

version

msvcirt

msvcp60

msvcrt

dinput8

generic