2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
Size 1.1MB
Sample260717-behynact9z
SHA256 c7f8ea549234ecc3ae9b429cdd9d72e4413faea9e3f3535ba33acbc873dbc50a
MD5 2baf61374431a4deebd709145e6cf944
SHA1 6d896b3c35a978e086e5bdbfebb7884a03f7161e
SHA512 680dacb1822067ab3f8ca4fc59117a3cae9813e39d5a26227e8c7bca2ed4c7b4a6ed97bbdc013b4fc72f2520297977c7d40c87821e3801f30491b7e853c84dd3
SSDEEP 24576:C0YLIuIF2GkHOnFm1Psbn51MXGWroRP+X3Z+JIekr:NO3a1d5128R23ZVekr
TLSH
T1F2357C10B7968132E5B20574CDB99B6A563CBD244F3089DBB3D42A2E1C706C26F35B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

.exe 1.1MB

2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

IMPHASH bd1bed42cfff157c99a6dbc312cee0dd
SHA256 c7f8ea549234ecc3ae9b429cdd9d72e4413faea9e3f3535ba33acbc873dbc50a
MD5 2baf61374431a4deebd709145e6cf944
SHA1 6d896b3c35a978e086e5bdbfebb7884a03f7161e
SHA512 680dacb1822067ab3f8ca4fc59117a3cae9813e39d5a26227e8c7bca2ed4c7b4a6ed97bbdc013b4fc72f2520297977c7d40c87821e3801f30491b7e853c84dd3
SSDEEP 24576:C0YLIuIF2GkHOnFm1Psbn51MXGWroRP+X3Z+JIekr:NO3a1d5128R23ZVekr
TLSH
T1F2357C10B7968132E5B20574CDB99B6A563CBD244F3089DBB3D42A2E1C706C26F35B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

569486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\FastCopy\Obj\Release\FastCopy.pdb

kernel32

CreateDirectoryW GetFullPathNameW GetFileAttributesW GetUserDefaultLCID DeleteFileW MoveFileExW CopyFileW MoveFileW ReadFile GetVolumeInformationW CancelIo TlsSetValue SetLastError EnterCriticalSection FindNextFileW WriteFile GetDiskFreeSpaceW SetFileTime SetThreadPriority LeaveCriticalSection InitializeCriticalSection FindClose WaitForSingleObject CreateFileW GetCurrentThreadId SuspendThread ResumeThread SetFileAttributesW Sleep GetFileInformationByHandle FormatMessageW LocalFileTimeToFileTime GetLastError FileTimeToSystemTime GetCurrentThread TerminateThread TlsAlloc CloseHandle GetLocalTime GetOverlappedResult DeleteCriticalSection SystemTimeToFileTime TlsGetValue SystemTimeToTzSpecificLocalTime TlsFree CreateEventA GetTickCount GetDriveTypeW SetFilePointer SetEndOfFile FlushFileBuffers GetFileSizeEx BackupRead BackupSeek GetFileTime BackupWrite CreateHardLinkW SetFilePointerEx SetFileValidData FindFirstFileW CreateMutexA ReleaseMutex GetFileSize GetSystemTimeAsFileTime SetDllDirectoryW SetPriorityClass GetCommandLineW SetSystemPowerState GetCurrentProcess GetThreadLocale CreatePipe DuplicateHandle OpenProcess ProcessIdToSessionId TzSpecificLocalTimeToSystemTime GetCurrentProcessId SetThreadExecutionState GetSystemTime GetLongPathNameW GetFileAttributesExW CreateProcessW GetStdHandle SetConsoleMode GetConsoleMode WriteConsoleW GetTempPathW GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress FreeLibrary UnmapViewOfFile OpenMutexA CreateFileMappingA MapViewOfFile DeviceIoControl RemoveDirectoryW FindFirstChangeNotificationW GetVolumeNameForVolumeMountPointW FindCloseChangeNotification FindNextChangeNotification HeapSize GetConsoleCP SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentVariableW GetCommandLineA GetOEMCP InterlockedExchange VirtualFree InterlockedCompareExchange VirtualAlloc GetModuleFileNameW SetEvent GetVersionExA GetModuleHandleW GetEnvironmentStringsW IsDebuggerPresent WriteConsoleA OutputDebugStringA AttachConsole OutputDebugStringW FreeConsole GetFileType InterlockedIncrement AllocConsole SetThreadLocale FindFirstFileExW GetSystemDirectoryW GetExitCodeThread GlobalAlloc GlobalFree LoadLibraryW GlobalLock MultiByteToWideChar WideCharToMultiByte CreateMutexW GlobalMemoryStatusEx ExitProcess GetModuleFileNameA RtlCaptureStackBackTrace GetModuleHandleExA RaiseException CreateThread IsBadReadPtr SetUnhandledExceptionFilter SizeofResource FindResourceA LockResource LoadResource GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount CreateEventW GetStringTypeW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetACP HeapAlloc HeapFree IsValidLocale EnumSystemLocalesW HeapReAlloc FindFirstFileExA FindNextFileA IsValidCodePage

oleaut32

VariantInit SafeArrayGetElement SafeArrayGetLBound SysFreeString SafeArrayGetUBound SafeArrayPutElement SafeArrayCreateVector VariantClear SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_2baf61374431a4deebd709145e6cf944_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

kernel32

oleaut32

generic