2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot
Size 5.1MB
Sample260821-dtm72awsdx
SHA256 db458551a0958d7c81d0dc7a8be9bc209ba050ca6a236ca194d487958c0915e5
MD5 15e09413181e622db8c34bdd62b568a6
SHA1 1e6ca52ac5f9e7be1fd0675a21af74fca824c43f
SHA512 8f82e4a932e5d14c4c78aec042391146b49755e081bbc6873c3997fd96fb8d2c22a718bc345f1a0013aec5596cd8dded4435ddb5edb445fcfdb9206b2a762c30
SSDEEP 98304:JJeV/ztZBe91jiImuUiK9N9EGQKF9lSHbr7ahoycwG+b0n:TS/hwhmg4EpbrOhawG+4n
TLSH
T1EC36D062BB41C071F9C201B5657EAF7A093DAE204B75C1C397D43E6AC8311D36B3A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

File Explorer

2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

.exe 5.1MB

2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

IMPHASH aba7499e03b82a57f9bd5a8efa8507ce
SHA256 db458551a0958d7c81d0dc7a8be9bc209ba050ca6a236ca194d487958c0915e5
MD5 15e09413181e622db8c34bdd62b568a6
SHA1 1e6ca52ac5f9e7be1fd0675a21af74fca824c43f
SHA512 8f82e4a932e5d14c4c78aec042391146b49755e081bbc6873c3997fd96fb8d2c22a718bc345f1a0013aec5596cd8dded4435ddb5edb445fcfdb9206b2a762c30
SSDEEP 98304:JJeV/ztZBe91jiImuUiK9N9EGQKF9lSHbr7ahoycwG+b0n:TS/hwhmg4EpbrOhawG+4n
TLSH
T1EC36D062BB41C071F9C201B5657EAF7A093DAE204B75C1C397D43E6AC8311D36B3A79A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

87:f9:c9:48:6c:3a:48:80:cd:7a:02:9d:72:15:d3:db:38:14:fe:2b:8e:e1:76:2b:66:cc:61:cd:e4:35:9e:e5:a4:01:9b:9a:f5:cf:7f:db:b5:c1:56:d2:9b:c5:0c:89:9c:1b:20:fb:cc:c7:1e:ce:77:c2:1d:fa:b0:5b:a7:cc

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Aspro Corp

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

1364589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb

kernel32

SetLastError SystemTimeToFileTime GetSystemTime SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW ReadConsoleA WriteFile RemoveDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapAlloc HeapFree HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode PeekNamedPipe GetFileType ExitProcess InterlockedPushEntrySList RtlUnwind GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW VerifyVersionInfoW FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GetCurrentProcess GlobalAlloc SizeofResource LockResource LoadResource GetModuleFileNameW OpenProcess GetExitCodeProcess SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress Sleep GetCurrentThreadId DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA LeaveCriticalSection EnterCriticalSection GetLastError WaitForSingleObjectEx GetCPInfo ProcessIdToSessionId GetCurrentProcessId DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive OpenEventA SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SetProcessAffinityMask GetProcessHeaps SetErrorMode CloseHandle RemoveDirectoryA GetFileAttributesA MultiByteToWideChar OutputDebugStringA SystemTimeToTzSpecificLocalTime GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileW GetDateFormatW GetTimeFormatW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObject CreateEventA QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation TerminateProcess GlobalMemoryStatusEx VirtualAlloc IsDebuggerPresent GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority TerminateThread GetExitCodeThread SuspendThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadAffinityMask SetEnvironmentVariableW SetCurrentDirectoryW OutputDebugStringW CreateProcessW GetSystemInfo GetProcessAffinityMask SetUnhandledExceptionFilter DebugBreak

user32

CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW GetProcessWindowStation GetWindowThreadProcessId EnumWindows DispatchMessageW IsWindowVisible TranslateMessage GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongW SetWindowLongW GetWindowLongW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow SetTimer MsgWaitForMultipleObjects SetWindowPos MoveWindow GetMessageW ReleaseDC GetDC GetUserObjectInformationW AllowSetForegroundWindow MessageBoxA DestroyWindow ShowWindow

gdi32

AddFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject RemoveFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ReportEventW RegOpenKeyExA RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoW CommandLineToArgvW ord680 SHGetKnownFolderPath

ole32

CoTaskMemFree

oleaut32

VariantClear

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW GetModuleInformation GetProcessMemoryInfo

version

VerQueryValueW

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError WSARecv WSARecvFrom WSASend htonl WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup WSAIoctl setsockopt getsockname ioctlsocket bind send recv connect WSASendTo

wsock32

ord1142

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_15e09413181e622db8c34bdd62b568a6_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic