2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader
Size 13.0MB
Sample260708-a14xkshv8k
SHA256 63e128ffc5d2d6a924c75ca1d2be787b70f793e7f958461edcd3276399c84968
MD5 c709f894729373199decc503d50e5b15
SHA1 a50f43e6b94a6f150bf34d19d26e2e7d1ac3abb4
SHA512 a6783e6350da2236d777ec9d16c1f01bcf2c684f77a1ad352207d2fef8e004f84c4a0546c909b816971a2d17a851bb88bea185bc8ce0dd40aabec02390d9096c
SSDEEP 393216:HXYCs8QTHxoMo5uEQ5ysQNpLIiuZw5gS:Wkqw
TLSH
T1B4D69D41B6B380F1C494327870AA763BDE3675485F2D46D39BE03E199DE12D06AFB2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader

File Explorer

2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader

.exe 13.0MB

2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader

IMPHASH b5217f7e510cdca41e76c04812a5df52
SHA256 63e128ffc5d2d6a924c75ca1d2be787b70f793e7f958461edcd3276399c84968
MD5 c709f894729373199decc503d50e5b15
SHA1 a50f43e6b94a6f150bf34d19d26e2e7d1ac3abb4
SHA512 a6783e6350da2236d777ec9d16c1f01bcf2c684f77a1ad352207d2fef8e004f84c4a0546c909b816971a2d17a851bb88bea185bc8ce0dd40aabec02390d9096c
SSDEEP 393216:HXYCs8QTHxoMo5uEQ5ysQNpLIiuZw5gS:Wkqw
TLSH
T1B4D69D41B6B380F1C494327870AA763BDE3675485F2D46D39BE03E199DE12D06AFB2D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6787004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\t6\code\src\obj\t6\codmpSteam_CEG_ZM_bin\t6zm.pdb

steam_api

SteamGameServer_Init SteamGameServer SteamGameServer_Shutdown SteamAPI_RegisterCallResult SteamAPI_RegisterCallback SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamAPI_Init SteamAPI_RestartAppIfNecessary SteamUtils SteamUserStats SteamApps SteamNetworking SteamGameServer_RunCallbacks SteamUser SteamFriends

winmm

timeGetTime timeBeginPeriod timeEndPeriod mixerClose mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA mixerOpen mixerSetControlDetails mixerGetDevCapsA waveInGetNumDevs mixerGetNumDevs

wsock32

htonl recvfrom select sendto shutdown connect socket ioctlsocket htons recv __WSAFDIsSet WSAStartup WSACleanup gethostname ntohl closesocket accept bind send WSAGetLastError setsockopt gethostbyname ntohs inet_ntoa

faultrep

ReportFault

dxgi

CreateDXGIFactory1

dsound

ord6 ord11

kernel32

FormatMessageA SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CompareStringW HeapQueryInformation GetExitCodeProcess CreatePipe LoadLibraryW SetConsoleCtrlHandler FlushFileBuffers GetConsoleMode GetConsoleCP SetHandleCount SetEnvironmentVariableA SleepEx GetExitCodeThread TerminateThread HeapAlloc CreateFileW InterlockedExchange CloseHandle GetFileInformationByHandleEx HeapFree CreateFileA GetCurrentThreadId GetTickCount lstrlenW GetStartupInfoW GetModuleFileNameA InterlockedIncrement GetFileInformationByHandle CreateSemaphoreA InterlockedCompareExchange Sleep GetCurrentProcessId GetModuleHandleA GetLastError ReleaseSemaphore OpenFileById GetTimeZoneInformation GetProcessHeap lstrcmpiW FileTimeToSystemTime GetProcessTimes GetCurrentProcess UnmapViewOfFile HeapSize SetLastError InterlockedDecrement GetFullPathNameW GetConsoleWindow SizeofResource LoadLibraryA GetSystemTime WriteFile QueryPerformanceFrequency VirtualQuery GetCommandLineW GetCurrentDirectoryW LockResource CreateEventA WaitForSingleObject GetFullPathNameA GetComputerNameA SetEvent CreateFileMappingA MapViewOfFile GetModuleHandleExA DebugBreak ExpandEnvironmentStringsA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetFileTime LoadResource GetProcAddress ExitProcess GetSystemTimeAsFileTime FindResourceW GetEnvironmentStringsW lstrlenA FreeLibrary QueryPerformanceCounter SetFilePointer GetFileSize ReadFile RaiseException ResetEvent GetProcessAffinityMask DuplicateHandle GetCurrentThread CreateThread SuspendThread ResumeThread SetThreadPriority OutputDebugStringW InterlockedExchangeAdd DeleteFileA SetFileAttributesA GetCurrentDirectoryA VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection TryEnterCriticalSection LeaveCriticalSection GlobalMemoryStatus SetProcessAffinityMask GetThreadPriority OutputDebugStringA GetDriveTypeA GlobalUnlock GlobalSize GlobalLock GlobalAlloc GetVersionExA SetErrorMode SetUnhandledExceptionFilter TerminateProcess WaitForMultipleObjects MulDiv SetPriorityClass SetThreadExecutionState WideCharToMultiByte GetSystemInfo GetSystemDirectoryW OpenFileMappingA GetModuleFileNameW GetWindowsDirectoryW HeapCreate HeapDestroy OpenEventA CreateSemaphoreW GetModuleHandleW OpenProcess PulseEvent FindClose FileTimeToLocalFileTime FindFirstFileExA FindNextFileA GetDriveTypeW HeapReAlloc ExitThread CreateProcessA GetTimeFormatA GetDateFormatA GetCommandLineA HeapSetInformation PeekNamedPipe GetFileType IsProcessorFeaturePresent GetStdHandle GetLocaleInfoW UnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEnvironmentVariableW CreateDirectoryA MoveFileA RtlUnwind MultiByteToWideChar EncodePointer DecodePointer ReleaseMutex CreateMutexA GetVersion FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode GetFileAttributesA

user32

SetWindowTextA CallWindowProcA PostQuitMessage DestroyWindow DefWindowProcA CloseWindow RegisterClassA LoadImageA CreateWindowExA SendMessageA AdjustWindowRect SetWindowPos MapVirtualKeyA LoadCursorA GetSystemMetrics LoadIconA RegisterClassExA PeekMessageA EmptyClipboard SetClipboardData OpenClipboard GetClientRect MonitorFromWindow RegisterWindowMessageA GetClipboardData CloseClipboard GetMessageA DispatchMessageA TranslateMessage ShowWindow ClientToScreen GetCursorPos ScreenToClient GetForegroundWindow SetFocus GetWindowRect SetCursorPos GetActiveWindow ChangeDisplaySettingsA EnumThreadWindows GetDesktopWindow GetDC ReleaseDC GetWindowTextA GetWindowLongA SetWindowLongA PostMessageA MessageBoxA ShowCursor GetClassLongA AdjustWindowRectEx GetMonitorInfoA SetCursor IsWindow GetMenuItemCount SetClassLongA EnumDisplaySettingsA DeleteMenu GetMenuItemID GetSystemMenu GetUserObjectInformationW GetProcessWindowStation MoveWindow

gdi32

CreateCompatibleDC CreateCompatibleBitmap SetStretchBltMode GetObjectA SelectObject DeleteObject StretchBlt DeleteDC GetBitmapBits BitBlt CreateDCA GetDeviceCaps SetDeviceGammaRamp CreateFontA CreateSolidBrush GetDIBits

advapi32

InitializeSecurityDescriptor RegOpenKeyExW RegisterEventSourceA ReportEventA DeregisterEventSource CryptAcquireContextA CryptReleaseContext RegQueryValueExW RegCloseKey SetSecurityDescriptorDacl CryptGenRandom

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize StringFromGUID2 CLSIDFromString

oleaut32

VariantInit VariantClear

wintrust

WinVerifyTrust

wininet

InternetConnectA InternetReadFile InternetWriteFile HttpEndRequestA HttpQueryInfoA HttpAddRequestHeadersA HttpSendRequestExA HttpOpenRequestA InternetQueryOptionA InternetSetOptionA HttpSendRequestA InternetCrackUrlA InternetOpenA InternetCloseHandle

xinput1_3

ord4 ord2 ord3

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

ws2_32

WSASetLastError getsockname getsockopt inet_ntoa

psapi

GetProcessMemoryInfo

binkw32

_BinkWaitStopAsyncThread@4 _BinkSetMemory@8 _BinkGetRealtime@12 _BinkGetFrameBuffersInfo@8 _BinkPause@8 _BinkControlBackgroundIO@8 _BinkDoFrameAsync@12 _BinkStartAsyncThread@8 _BinkSetSoundTrack@8 _BinkOpen@8 _BinkGetError@0 _BinkDoFrameAsyncWait@8 _BinkClose@4 _BinkGetRects@8 _BinkRequestStopAsyncThread@4 _BinkRegisterFrameBuffers@8 _BinkSetIOSize@4 _BinkDoFrame@4 _BinkNextFrame@4

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.conceal

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.interpr

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.0MB

Virtual Size

54.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

824KB

Virtual Size

828KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_c709f894729373199decc503d50e5b15_amadey_coinminer_elex_glassworm_qakbot_smoke-loader

steam_api

winmm

wsock32

faultrep

dxgi

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wintrust

wininet

xinput1_3

wtsapi32

ws2_32

psapi

binkw32

d3d11

generic