2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee
Size 30.8MB
Sample260820-dr5pasbb77
SHA256 cb0e6aead591e5ed4483e4714021b7cf576ab5734ef40308b3e77d80f8be1013
MD5 09f5f8f362f004b850207a1623ee86a8
SHA1 d6de949cf1f937c9b53709926fd666afefdaf69a
SHA512 c8b4641644274f9f7b13da3d4410f39299afdc7fa9e58e813e9f347f40b30254ddb5113be1536ab67827128a49297193b45e6ad07e1752598d72f719da745555
SSDEEP 393216:ZA7525VA7525xA7525cBU6flbPk5HPhJCFMgNA7525VA7525xA7525cBU6fSA759:6j3LfkhXj3LfXj3Lfkhg
TLSH
T1AD677C02B68AA8F5D97615304777E3F70B38FC215420DE4FF384BB29AE35682B519726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee

.exe 30.8MB

2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 0f288380a852699af9a6bf26b7572ed6
SHA256 cb0e6aead591e5ed4483e4714021b7cf576ab5734ef40308b3e77d80f8be1013
MD5 09f5f8f362f004b850207a1623ee86a8
SHA1 d6de949cf1f937c9b53709926fd666afefdaf69a
SHA512 c8b4641644274f9f7b13da3d4410f39299afdc7fa9e58e813e9f347f40b30254ddb5113be1536ab67827128a49297193b45e6ad07e1752598d72f719da745555
SSDEEP 393216:ZA7525VA7525xA7525cBU6flbPk5HPhJCFMgNA7525VA7525xA7525cBU6fSA759:6j3LfkhXj3LfXj3Lfkhg
TLSH
T1AD677C02B68AA8F5D97615304777E3F70B38FC215420DE4FF384BB29AE35682B519726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

fp30wel

ord75 ord180 ord212 ord125 ord209 ord31 ord245 ord187 ord50 ord165 ord81 ord56 ord49 ord272 ord48 ord80 ord418 ord227 ord325 ord324 ord195 ord183 ord360 ord472 ord452 ord431 ord439 ord213 ord457 ord391 ord39 ord250 ord372 ord295 ord188 ord167 ord4 ord247 ord359 ord269 ord414 ord419 ord371 ord370 ord366 ord375 ord365 ord377 ord200 ord440 ord70 ord185 ord458 ord455 ord347 ord392 ord249 ord433 ord424 ord251 ord235 ord60 ord61 ord434 ord59 ord14 ord1 ord378 ord93 ord374 ord376 ord30 ord68 ord257 ord140 ord363 ord373

fp30utl

ord10 ord621 ord159 ord722 ord792 ord795 ord9 ord883 ord160 ord922 ord957 ord895 ord195 ord92 ord362 ord1086 ord783 ord967 ord965 ord964 ord744 ord745 ord738 ord1168 ord1128 ord1217 ord1016 ord1218 ord198 ord58 ord709 ord690 ord102 ord885 ord347 ord1102 ord901 ord654 ord206 ord73 ord207 ord720 ord72 ord115 ord862 ord1204 ord350 ord255 ord349 ord205 ord343 ord116 ord93 ord221 ord233 ord698 ord1095 ord270 ord112 ord906 ord333 ord109 ord662 ord737 ord234 ord117 ord235 ord186 ord46 ord111 ord271 ord342 ord712 ord586 ord585 ord620 ord968 ord884 ord351 ord341 ord1008 ord1007 ord982 ord934

mfc42

ord3136 ord3402 ord2976 ord1576 ord3081 ord3874 ord540 ord2614 ord641 ord609 ord860 ord656 ord800 ord795 ord4424 ord4627 ord3721 ord3079 ord3825 ord4080 ord3830 ord567 ord3831 ord324 ord2985 ord3262 ord825 ord4465 ord3259 ord3147 ord5981 ord2621 ord4159 ord815 ord561 ord3738 ord4622 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4673 ord6453 ord2086 ord1669 ord2652 ord537 ord926 ord1199 ord922 ord1148 ord470 ord755 ord2863 ord1146 ord1768 ord1147 ord1200 ord4047 ord765 ord3698 ord6394 ord5450 ord6383 ord5440 ord2379 ord4275 ord3797 ord823 ord2860 ord3803 ord3663 ord2299 ord616 ord3582 ord4398 ord2578 ord4218 ord2023 ord2411 ord692 ord3639 ord4401 ord2581 ord4219 ord2024 ord2413 ord6366 ord1771 ord535 ord4375 ord4852 ord2645 ord3092 ord2982 ord4234 ord4229 ord4834 ord5016 ord4608 ord4750 ord4716 ord4607 ord4635 ord5067 ord1834 ord2859 ord924 ord939 ord941 ord1175 ord1168 ord2515 ord6334 ord355 ord3499 ord6141 ord6142 ord4160 ord6199 ord4299 ord713 ord772 ord500 ord414 ord3662 ord5821 ord3701 ord2301 ord2358 ord4710 ord2642 ord6215 ord858 ord4407 ord2302 ord2370 ord5265 ord4376 ord4853 ord4998 ord2514 ord6052 ord1775 ord5280 ord4425 ord3597 ord3610 ord2575 ord4396 ord3574 ord6055 ord4078 ord1776 ord2648 ord5241 ord2385 ord5163 ord6374 ord4353 ord5290 ord3798 ord4837 ord4441 ord1727 ord2055 ord6376 ord3749 ord5065 ord5261 ord2446 ord2124 ord5277

msvcrt

__CxxFrameHandler _strdup memmove sprintf __p__environ _mbscmp __p___argc __dllonexit __p___argv _setmbcp _XcptFilter _onexit _exit __getmainargs exit __p__acmdln _adjust_fdiv _initterm __setusermatherr __set_app_type __p__commode __p__fmode _controlfp _except_handler3

kernel32

GetStartupInfoA GetModuleHandleA LoadLibraryA FreeLibrary

user32

ShowWindow GetSystemMetrics GetClientRect EnableWindow ScreenToClient OffsetRect GetWindowRect SendMessageA ReleaseDC GetDC GetTabbedTextExtentA DispatchMessageA TranslateMessage PeekMessageA LoadIconA AppendMenuA GetSystemMenu DrawIcon IsIconic GetDlgItem

gdi32

GetTextExtentPoint32A GetTextExtentPointA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_09f5f8f362f004b850207a1623ee86a8_amadey_coinminer_elex_glassworm_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_tofsee

fp30wel

fp30utl

mfc42

msvcrt

kernel32

user32

gdi32

generic