2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader
Size 20.4MB
Sample260719-28eq7sft2k
SHA256 08a3130427a6659b3ee3f7eef93e8cce031556e15aedabffdfdbce5891793d5b
MD5 2b7c6a3bdeaee093a0716f7c0de106fe
SHA1 9f8a1e4e67316db3256d7b8a21b444d7696b1df1
SHA512 c22d46e33f2882dfcc830adef24c7542c89f077d337f3a64f99ef23f00524dc1fef7ec849618ad336e73a86272066e45a494eac32bcd10c97baf0bdc391e59d3
SSDEEP 196608:jj1TE+1B7PdYWVkVfUNHgHphupsFsNGzEx6UXTQssss8UUKFdu9CwJsv6tJdkiuq:jfJCwNYGqFgkENKFdu9CwJsv6tJdR9C
TLSH
T1BD27BF42F78340B2E58652F0512FB73FDF345A298326A5E3D2A87D95D9702E13A3B60D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader

File Explorer

2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader

.exe 20.4MB

2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader

IMPHASH ddc15a8ff2f6e79138c51f5710b82f3f
SHA256 08a3130427a6659b3ee3f7eef93e8cce031556e15aedabffdfdbce5891793d5b
MD5 2b7c6a3bdeaee093a0716f7c0de106fe
SHA1 9f8a1e4e67316db3256d7b8a21b444d7696b1df1
SHA512 c22d46e33f2882dfcc830adef24c7542c89f077d337f3a64f99ef23f00524dc1fef7ec849618ad336e73a86272066e45a494eac32bcd10c97baf0bdc391e59d3
SSDEEP 196608:jj1TE+1B7PdYWVkVfUNHgHphupsFsNGzEx6UXTQssss8UUKFdu9CwJsv6tJdkiuq:jfJCwNYGqFgkENKFdu9CwJsv6tJdR9C
TLSH
T1BD27BF42F78340B2E58652F0512FB73FDF345A298326A5E3D2A87D95D9702E13A3B60D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14147840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Throne\build-legacy-386\КИБЕРЩИТ ／／ X.pdb

wininet

InternetSetOptionW InternetQueryOptionW

wsock32

WSAGetLastError setsockopt select listen htons getsockname getpeername closesocket bind __WSAFDIsSet getsockopt ntohl recv htonl WSAAsyncSelect WSACleanup WSAStartup gethostname WSASetLastError send

ws2_32

WSARecvFrom WSARecv WSANtohs WSASendTo WSAIoctl WSAHtonl WSAConnect WSAAccept WSASend WSASocketW WSANtohl getaddrinfo getnameinfo freeaddrinfo

user32

GetWindowLongW SetWindowLongW RegisterDeviceNotificationW MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW UnregisterDeviceNotification GetSystemMenu EnableMenuItem UnregisterClassW GetSysColor SystemParametersInfoW RegisterHotKey UnregisterHotKey GetAsyncKeyState VkKeyScanW GetDisplayConfigBufferSizes RegisterClassW DefWindowProcW GetUserObjectInformationW KillTimer DrawIconEx ChangeWindowMessageFilterEx RealGetWindowClassW GetWindowTextW CloseTouchInputHandle GetTouchInputInfo GetMessageExtraInfo TrackMouseEvent GetCursorInfo GetIconInfo CreateIconIndirect CreateCursor LoadCursorW GetCursor SetCursorPos PeekMessageW DispatchMessageW TranslateMessage CharNextExA EnumWindows PostThreadMessageW GetProcessWindowStation SetTimer PostMessageW GetWindowThreadProcessId MessageBoxW SetForegroundWindow GetForegroundWindow AttachThreadInput QueryDisplayConfig GetSystemMetrics SetFocus TrackPopupMenuEx MapVirtualKeyW ToUnicode ToAscii GetKeyboardState GetKeyState IsZoomed FindWindowA SetCaretPos ShowCaret DestroyCaret CreateCaret IsWindowEnabled RegisterWindowMessageW GetKeyboardLayout SendInput GetMessageW LoadIconW EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow GetDC ReleaseDC GetDesktopWindow GetDoubleClickTime IsWindow MessageBeep GetCaretBlinkTime UpdateLayeredWindowIndirect GetKeyboardLayoutList RegisterPowerSettingNotification UnregisterPowerSettingNotification GetClassInfoW RegisterClassExW SetWindowPos GetWindowPlacement GetFocus InvalidateRect GetClientRect GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ChildWindowFromPointEx GetSysColorBrush GetParent LoadImageW RegisterClipboardFormatW GetClipboardFormatNameW EnumDisplayDevicesW IsHungAppWindow SendMessageW SetClipboardViewer ChangeClipboardChain IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes FlashWindowEx MoveWindow SetWindowPlacement IsWindowVisible IsIconic SetMenuItemInfoW RegisterTouchWindow UnregisterTouchWindow IsTouchWindow GetCapture SetCapture ReleaseCapture GetMenu BeginPaint EndPaint GetUpdateRect SetWindowRgn SetWindowTextW GetWindowRect AdjustWindowRectEx SetCursor SetParent GetWindow DestroyCursor DestroyIcon MonitorFromPoint GetAncestor SetMenu DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu InsertMenuW AppendMenuW ModifyMenuW RemoveMenu TrackPopupMenu GetMenuItemInfoW DisplayConfigGetDeviceInfo

rasapi32

RasEnumEntriesW

iphlpapi

GetAdaptersAddresses ConvertInterfaceNameToLuidW ConvertInterfaceIndexToLuid ConvertInterfaceLuidToNameW ConvertInterfaceLuidToIndex ConvertInterfaceLuidToGuid

ntdll

VerSetConditionMask RtlGetVersion RtlUnwind

uxtheme

IsThemeBackgroundPartiallyTransparent CloseThemeData ord47 GetThemeBackgroundRegion GetThemePropertyOrigin GetThemeMargins GetThemeEnumValue GetThemeInt GetThemeColor GetCurrentThemeName IsAppThemed IsThemeActive SetWindowTheme GetThemeBool OpenThemeData GetThemePartSize GetThemeTransitionDuration

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

imm32

ImmGetVirtualKey ImmSetCandidateWindow ImmSetCompositionWindow ImmNotifyIME ImmGetDefaultIMEWnd ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus

oleaut32

SysAllocString SysFreeString VariantInit VariantClear SafeArrayPutElement SafeArrayCreateVector

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

gdi32

GetCharABCWidthsFloatW GetCharABCWidthsW GetStockObject GetDIBits GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx RemoveFontResourceExW AddFontResourceExW GetFontData EnumFontFamiliesExW CreateFontIndirectW GetObjectW GetBitmapBits SwapBuffers GetPixelFormat GetGlyphOutlineW GetCharABCWidthsI SetBkMode SetGraphicsMode CreateBitmap CreateDCW CreateCompatibleBitmap SetLayout OffsetRgn SetPixelFormat ChoosePixelFormat GetDeviceCaps GetOutlineTextMetricsW SetTextAlign SetWorldTransform ExtTextOutW GetTextFaceW CreateCompatibleDC GetTextExtentPoint32W DescribePixelFormat GetCharWidthI SetTextColor BitBlt GdiFlush CreateDIBSection SelectObject SelectClipRgn GetRegionData DeleteObject DeleteDC CreateRectRgn CombineRgn

dnsapi

DnsFree DnsQuery_W

secur32

InitSecurityInterfaceW

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpOpen

userenv

GetUserProfileDirectoryW

advapi32

FreeSid SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAce RegNotifyChangeKeyValue GetUserNameW LookupAccountNameW RegSetValueExW RegQueryInfoKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW BuildTrusteeWithSidW GetNamedSecurityInfoW GetEffectiveRightsFromAclW LookupAccountSidW MapGenericMask GetLengthSid ReportEventW DuplicateToken CopySid AllocateAndInitializeSid AccessCheck OpenProcessToken SystemFunction036 GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegQueryValueExW RegOpenKeyExW RegCloseKey RegisterEventSourceW DeregisterEventSource

kernel32

FindFirstChangeNotificationW FindCloseChangeNotification GetModuleHandleExW CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SetThreadpoolWait LocalAlloc GetTimeZoneInformation lstrcmpW WTSGetActiveConsoleSessionId GlobalAlloc GlobalSize GlobalUnlock GlobalLock CheckRemoteDebuggerPresent ExpandEnvironmentStringsW GetUserDefaultLangID FindNextChangeNotification GetGeoInfoW GetUserGeoID WaitNamedPipeW DisconnectNamedPipe K32GetModuleFileNameExW SetHandleInformation OpenProcess ReleaseMutex VirtualAlloc VirtualFree SetLastError InterlockedExchangeAdd InterlockedCompareExchange InitializeCriticalSectionAndSpinCount GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CreateThreadpoolWait CancelIoEx GetOverlappedResult PeekNamedPipe FindNextFileW FindFirstFileExW GetUserPreferredUILanguages GetUserDefaultLCID GetCurrencyFormatW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead LoadLibraryExW ExitThread FreeLibraryAndExitThread GetCommandLineA GetConsoleOutputCP SetFileAttributesW SetStdHandle ExitProcess SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect IsValidLocale EnumSystemLocalesW GetFileSizeEx SetEnvironmentVariableW IsValidCodePage GetOEMCP HeapQueryInformation GetEnvironmentStringsW GetNamedPipeClientProcessId GetLastError GlobalFree CreateFileW CloseHandle SetUnhandledExceptionFilter SetErrorMode WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId GetProcAddress LoadLibraryW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetVersionExW GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection TerminateProcess IsProcessorFeaturePresent GetConsoleWindow CompareStringEx SetEvent CreateEventW GetLocalTime GetCommandLineW DuplicateHandle WaitForMultipleObjects CreateThread GetCurrentThread SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW VerifyVersionInfoW QueryPerformanceFrequency GetTickCount64 ResetEvent GetStdHandle WriteConsoleW FreeEnvironmentStringsW ConnectNamedPipe CreateNamedPipeW WaitForMultipleObjectsEx CreateProcessW GetProcessId GetModuleHandleW GetACP GetSystemDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileInformationByHandle GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetVolumePathNamesForVolumeNameW DeviceIoControl CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime GetFileInformationByHandleEx GetDriveTypeW GetFileType GetVolumeInformationW SetFilePointerEx GetModuleFileNameW GetDateFormatW GetTimeFormatW

netapi32

NetApiBufferFree NetShareEnum

ole32

CoGetMalloc CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoCreateGuid CoInitialize OleInitialize OleUninitialize ReleaseStgMedium OleSetClipboard OleGetClipboard CoInitializeEx OleFlushClipboard OleIsCurrentClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop DoDragDrop StringFromGUID2

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winmm

PlaySoundW timeSetEvent timeKillEvent

shell32

SHGetKnownFolderPath SHGetStockIconInfo ord727 ShellExecuteW SHCreateItemFromParsingName SHGetMalloc SHGetPathFromIDListW CommandLineToArgvW ord680 ShellExecuteExW SHCreateItemFromIDList SHGetFileInfoW Shell_NotifyIconW SHGetKnownFolderIDList SHBrowseForFolderW Shell_NotifyIconGetRect

crypt32

CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertOpenSystemStoreW CertFindCertificateInStore CertOpenStore

bcrypt

BCryptGenRandom

Name

.text

Size

14.2MB

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

202KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmimed

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

528KB

Virtual Size

527KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_2b7c6a3bdeaee093a0716f7c0de106fe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_revil_smoke-loader

wininet

wsock32

ws2_32

user32

rasapi32

iphlpapi

ntdll

uxtheme

dwmapi

imm32

oleaut32

wtsapi32

gdi32

dnsapi

secur32

winhttp

userenv

advapi32

kernel32

netapi32

ole32

version

winmm

shell32

crypt32

bcrypt

generic