2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop
Size 5.1MB
Sample260723-sk6ekseq9y
SHA256 cafeedf2c8802a0baa97a0e951d02ef68db5f8add529bdd583de7c73a0e7527a
MD5 7b1d9192f435f1817f66a5612871e1b3
SHA1 e89078110e39cd9e4eed73f9f3831039bcb54d3d
SHA512 6c5714925c8f8187c7fef265cebb38d44646717ec922d545bd496a7a1376f4fe13525373aaf53c90ec36b288b6989fa27cb9cd941fe4ad88c26671bdcb8c3fca
SSDEEP 98304:RYldeUzLjzunGrAEklIKKsvoe2prU/7EICIYGcIIIIII0jnzRemTVofsIBU7wRGN:RYHeUzLjzunWAEHKKsvoe2prU/AILGI7
TLSH
T1AF36CF02E381B172D8D916B990E7677E5A305F64033A91C3FEE43E469E71EE469393C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop

File Explorer

2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop

.exe 5.1MB

2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop

IMPHASH bfa2f498bed95dc32e9eb5f1827b64f1
SHA256 cafeedf2c8802a0baa97a0e951d02ef68db5f8add529bdd583de7c73a0e7527a
MD5 7b1d9192f435f1817f66a5612871e1b3
SHA1 e89078110e39cd9e4eed73f9f3831039bcb54d3d
SHA512 6c5714925c8f8187c7fef265cebb38d44646717ec922d545bd496a7a1376f4fe13525373aaf53c90ec36b288b6989fa27cb9cd941fe4ad88c26671bdcb8c3fca
SSDEEP 98304:RYldeUzLjzunGrAEklIKKsvoe2prU/7EICIYGcIIIIII0jnzRemTVofsIBU7wRGN:RYHeUzLjzunWAEHKKsvoe2prU/AILGI7
TLSH
T1AF36CF02E381B172D8D916B990E7677E5A305F64033A91C3FEE43E469E71EE469393C8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3060959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\trees\iw5build6-iw-release\iw5\code_source\src\CodeOutput\iw5sp\Steam_CEG_bin\iw5sp.pdb

winmm

timeBeginPeriod timeGetTime timeEndPeriod

steam_api

SteamAPI_RegisterCallResult SteamAPI_UnregisterCallResult SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamAPI_RunCallbacks SteamRemoteStorage SteamNetworking SteamApps SteamUtils SteamMatchmaking SteamFriends SteamUserStats SteamAPI_Init SteamAPI_Shutdown SteamUser

mss32

_AIL_sample_ms_position@12 _AIL_set_sample_volume_levels@12 _AIL_set_room_type@8 _AIL_open_stream@12 _AIL_stream_ms_position@12 _AIL_sample_playback_rate@4 _AIL_set_sample_playback_rate@8 _AIL_set_stream_loop_count@8 _AIL_set_sample_reverb_levels@12 _AIL_set_stream_ms_position@8 _AIL_stream_info@20 _AIL_set_sample_3D_distances@16 _AIL_sample_channel_levels@8 _AIL_set_sample_channel_levels@12 _AIL_pause_stream@8 _AIL_close_stream@4 _AIL_sample_volume_pan@12 _AIL_stop_sample@4 _AIL_end_sample@4 _AIL_set_DirectSound_HWND@8 _AIL_stream_sample_handle@4 _AIL_sample_status@4 _AIL_digital_CPU_percent@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_sample_processor@12 _AIL_sample_processor@8 _AIL_sample_stage_property@24 _AIL_find_filter@8 _AIL_open_filter@8 _AIL_allocate_sample_handle@4 _AIL_init_sample@12 _AIL_stream_status@4 _AIL_speaker_configuration@20 _AIL_resume_sample@4 _AIL_sample_3D_position@16 _AIL_size_processed_digital_audio@16 _AIL_process_digital_audio@24 _AIL_set_sample_info@8 _AIL_set_sample_loop_count@8 _AIL_set_sample_ms_position@8 _AIL_set_file_callbacks@16 _AIL_set_redist_directory@4 _AIL_set_3D_distance_factor@8 _AIL_set_3D_rolloff_factor@8 _AIL_open_digital_driver@16 _AIL_set_preference@8 _AIL_set_speaker_configuration@16 _AIL_set_sample_3D_position@16

binkw32

_BinkDoFrame@4 _BinkGoto@12 _BinkNextFrame@4 _BinkGetRealtime@12 _BinkControlBackgroundIO@8 _BinkGetRects@8 _BinkSetMemory@8 _BinkOpenMiles@4 _BinkSetSoundSystem@8 _BinkSetSoundTrack@8 _BinkGetFrameBuffersInfo@8 _BinkRegisterFrameBuffers@8 _BinkGetKeyFrame@12 _BinkSetMixBinVolumes@20 _BinkOpen@8 _BinkGetError@0 _BinkSetError@4 _BinkClose@4 _BinkPause@8 _BinkWait@4 _BinkSetIOSize@4

d3d9

Direct3DCreate9

powrprof

CallNtPowerInformation

ws2_32

htons bind closesocket sendto setsockopt inet_addr gethostbyname WSAGetLastError send connect ioctlsocket recv recvfrom shutdown ntohl gethostname inet_ntoa select __WSAFDIsSet WSASetLastError getsockopt getsockname WSAStartup WSACleanup ntohs socket

kernel32

GetConsoleOutputCP WriteConsoleA SetEndOfFile SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler FlushFileBuffers HeapCreate WriteConsoleW GetConsoleMode GetConsoleCP DeleteCriticalSection SetHandleCount SetFilePointer GetFileType PeekNamedPipe GetStdHandle LCMapStringW MultiByteToWideChar WideCharToMultiByte LCMapStringA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoA GetCommandLineA HeapReAlloc GetModuleHandleW CreateDirectoryA RtlUnwind GetDriveTypeA FileTimeToLocalFileTime MoveFileA ReleaseMutex CreateMutexA CompareStringA CompareStringW SetEnvironmentVariableA WaitForMultipleObjects GetExitCodeThread TerminateThread ExpandEnvironmentStringsA GetVersion FlushConsoleInputBuffer ExitThread ReadConsoleInputA SetConsoleMode VirtualQuery FindResourceW OpenEventA OpenFileMappingA CreateSemaphoreA CreateFileMappingA MapViewOfFile InterlockedDecrement InterlockedExchangeAdd GetFileSize GetLastError ReadFileEx SleepEx InterlockedIncrement CloseHandle InterlockedCompareExchange InterlockedExchange Sleep GetCurrentThreadId SetEvent ResetEvent CreateEventA WaitForSingleObject GetProcessAffinityMask GetCurrentProcess DuplicateHandle GetCurrentThread SetThreadPriority RaiseException CreateThread SuspendThread ResumeThread SetThreadAffinityMask GetThreadPriority VirtualAlloc VirtualFree CreateFileA QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameA GetModuleHandleA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GlobalMemoryStatus GetProcAddress GetSystemInfo GetVersionExA SetProcessAffinityMask FormatMessageA Module32Next Module32First CreateToolhelp32Snapshot OpenProcess WriteFile ReadFile GetCurrentProcessId DeleteFileA SetErrorMode SetPriorityClass GetSystemTime SystemTimeToFileTime MulDiv SetThreadExecutionState GetCurrentDirectoryA FindClose FindFirstFileA FindNextFileA GlobalMemoryStatusEx FreeLibrary LoadLibraryA HeapFree GetProcessHeap lstrcmpiW CreateFileW GetFileInformationByHandle GetFullPathNameW HeapAlloc HeapSize GetTimeZoneInformation GetComputerNameA GetTickCount ExitProcess FileTimeToSystemTime GetSystemTimeAsFileTime GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW UnmapViewOfFile LockResource LoadResource SizeofResource GetConsoleWindow GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW GetStartupInfoW SetLastError ReleaseSemaphore GetFullPathNameA GetModuleHandleExA

user32

GetProcessWindowStation UpdateWindow IsWindow ClipCursor ClientToScreen GetClientRect GetWindowRect SetWindowLongA GetWindowLongA GetWindowTextA ReleaseDC GetDC GetDesktopWindow EnumThreadWindows ChangeDisplaySettingsA GetSystemMetrics SetCursorPos SetFocus GetForegroundWindow ScreenToClient GetCursorPos ShowCursor PostMessageA ShowWindow DispatchMessageA TranslateMessage GetMessageA PeekMessageA RegisterClassExA LoadCursorA LoadIconA MessageBoxA GetActiveWindow SetWindowPos AdjustWindowRect SendMessageA CreateWindowExA LoadImageA RegisterClassA DefWindowProcA GetUserObjectInformationW DestroyWindow PostQuitMessage CallWindowProcA SetWindowTextA CloseWindow SystemParametersInfoA MapVirtualKeyA MoveWindow GetMonitorInfoA MonitorFromWindow RegisterWindowMessageA MonitorFromPoint EnumDisplayMonitors AdjustWindowRectEx

gdi32

GetBitmapBits DeleteObject DeleteDC BitBlt GetObjectA CreateCompatibleBitmap CreateCompatibleDC CreateDCA GetDeviceCaps CreateFontA SelectObject SetDeviceGammaRamp CreateSolidBrush

advapi32

SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW CryptReleaseContext CryptAcquireContextA CryptGenRandom RegisterEventSourceA ReportEventA DeregisterEventSource RegOpenKeyExA RegCloseKey RegQueryInfoKeyA InitializeSecurityDescriptor RegQueryValueExA RegEnumKeyExA

shell32

ShellExecuteA

ole32

StringFromGUID2

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

30.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

33B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

660KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_7b1d9192f435f1817f66a5612871e1b3_amadey_coinminer_elex_glassworm_smoke-loader_stop

winmm

steam_api

mss32

binkw32

d3d9

powrprof

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

generic