2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader
Size 3.4MB
Sample260712-p6yebacs2x
SHA256 ff0f7f02786fd0cb39b47ae279dd95ca35df19415f486431f8d1a56c4e41d042
MD5 666a67688e1d2a6d977b1a4c20977e26
SHA1 45511c8db4da64d0c2988615960c44498fb66f64
SHA512 828e8a9d61623beeffd93aaf6a1e43b789cd2972b9d8d2a524add5dad54cd6e3aaa5f1cb7b89b82bdf7b4dadea5098abdca6bd2b4e6f22d62f65d97482294186
SSDEEP 49152:x2v9HjNZZIpT1EQkGok4PetAsXqDWtrOtPLGH1GJ5DmWV9SCbJB5AQMY76Jm2JLm:x2vFBIpT0GX4WtCDW49GHEHmU7am2dm
TLSH
T12BF5CF12FA4189B9E9D31174E2EF577A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

File Explorer

2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

.exe 3.4MB

2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

IMPHASH d405b0464c27228120d016fb1a544d05
SHA256 ff0f7f02786fd0cb39b47ae279dd95ca35df19415f486431f8d1a56c4e41d042
MD5 666a67688e1d2a6d977b1a4c20977e26
SHA1 45511c8db4da64d0c2988615960c44498fb66f64
SHA512 828e8a9d61623beeffd93aaf6a1e43b789cd2972b9d8d2a524add5dad54cd6e3aaa5f1cb7b89b82bdf7b4dadea5098abdca6bd2b4e6f22d62f65d97482294186
SSDEEP 49152:x2v9HjNZZIpT1EQkGok4PetAsXqDWtrOtPLGH1GJ5DmWV9SCbJB5AQMY76Jm2JLm:x2vFBIpT0GX4WtCDW49GHEHmU7am2dm
TLSH
T12BF5CF12FA4189B9E9D31174E2EF577A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1742532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildworker\steam_rel_client_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb

kernel32

GetFileSize GetFullPathNameW OutputDebugStringA SetLastError GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock LocalAlloc VerifyVersionInfoW WTSGetActiveConsoleSessionId MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventA WideCharToMultiByte ConvertFiberToThread DeleteFiber WriteConsoleW GetStringTypeW GetCPInfo GetOEMCP GetACP CreateDirectoryW DecodePointer SetStdHandle GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation HeapReAlloc LCMapStringW ExpandEnvironmentStringsW VerSetConditionMask LocalFree GetTickCount OpenProcess TerminateProcess CreateSymbolicLinkW DeviceIoControl GetConsoleWindow SetConsoleTitleW SetConsoleCtrlHandler MoveFileExW CopyFileW GetModuleHandleA Sleep CreateMutexA ReleaseMutex OutputDebugStringW WriteFile SetFilePointer SetFileAttributesW ReadFile GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCommandLineW CreateProcessW GetExitCodeProcess WaitForSingleObject CloseHandle SetCurrentDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FindResourceA LockResource CompareStringW HeapFree HeapAlloc ExitProcess HeapValidate HeapSize FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetModuleHandleExW GetLocalTime UnhandledExceptionFilter InitializeCriticalSectionEx VirtualQuery EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetEnvironmentVariableW GetStdHandle SetProcessAffinityMask GetProcessHeaps DebugBreak QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentDirectoryW SetThreadAffinityMask LoadResource LoadLibraryExA FreeLibrary LoadLibraryA IsValidCodePage WakeAllConditionVariable SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileSizeEx RemoveDirectoryW SetEndOfFile SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetModuleHandleW LoadLibraryExW LoadLibraryW IsDebuggerPresent GlobalMemoryStatusEx VirtualAlloc VirtualProtect IsWow64Process GetModuleFileNameA GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetSystemInfo GetProcessAffinityMask DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread TerminateThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextA GetWindowTextLengthA SetDlgItemInt GetProcessWindowStation GetUserObjectInformationW IsWindowVisible MessageBoxA GetDlgItemInt MessageBoxW GetDesktopWindow ShowWindow GetWindowThreadProcessId EnumWindows GetDlgItem GetWindowRect wsprintfA SetWindowPos DialogBoxParamA EndDialog

advapi32

RegQueryValueExW RegisterEventSourceW DeregisterEventSource RegCloseKey RegCreateKeyExA RegDeleteValueA SetNamedSecurityInfoW RegSetValueExW RegQueryInfoKeyA RegEnumValueW RegDeleteValueW LookupPrivilegeValueA SetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW ConvertStringSidToSidW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus SetServiceObjectSecurity RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceObjectSecurity OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA ReportEventW

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

ws2_32

WSAGetLastError recv send WSACleanup closesocket gethostname WSAStartup WSASetLastError

shlwapi

SHDeleteKeyA

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

616KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

549KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

636KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_666a67688e1d2a6d977b1a4c20977e26_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

psapi

bcrypt

generic