2026-08-21_6e0194f3e4b1b1c75a3faecd2ec02077_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_6e0194f3e4b1b1c75a3faecd2ec02077_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader
Size 42.9MB
Sample260821-e1646asgla
SHA256 25a02ee11e9691313f2f17b3059c66025b51afda0629e3456d049640f758dc55
MD5 6e0194f3e4b1b1c75a3faecd2ec02077
SHA1 0340271d14d830d20b9f9100699d27411fab515c
SHA512 673518210b5b1f33070401f7bef7e144e2b261f47a78ff6292d2085afd2b28e2d7a9b455b8b6df5baadcd39e9bec03f238876d923abff36d633a5071f050316e
SSDEEP 786432:SyxWN4tmuA9sd/mLuRokL8CUn/MohLHcvVcRi7QhO2rjXJsTXZKjg:SGU4tf7+GwCzuRoYeTX3
TLSH
T183A7331EF7858C31E59F023082AA67BB483A6D305725CDC7D7B138AD5D301E16A3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_6e0194f3e4b1b1c75a3faecd2ec02077_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

File Explorer

2026-08-21_6e0194f3e4b1b1c75a3faecd2ec02077_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

.exe 42.9MB

2026-08-21_6e0194f3e4b1b1c75a3faecd2ec02077_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

IMPHASH 55e371115023936a0aa27521203987cb
SHA256 25a02ee11e9691313f2f17b3059c66025b51afda0629e3456d049640f758dc55
MD5 6e0194f3e4b1b1c75a3faecd2ec02077
SHA1 0340271d14d830d20b9f9100699d27411fab515c
SHA512 673518210b5b1f33070401f7bef7e144e2b261f47a78ff6292d2085afd2b28e2d7a9b455b8b6df5baadcd39e9bec03f238876d923abff36d633a5071f050316e
SSDEEP 786432:SyxWN4tmuA9sd/mLuRokL8CUn/MohLHcvVcRi7QhO2rjXJsTXZKjg:SGU4tf7+GwCzuRoYeTX3
TLSH
T183A7331EF7858C31E59F023082AA67BB483A6D305725CDC7D7B138AD5D301E16A3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

249341

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\git\shurufa\src\ImeWB\Temp\Release\Install.pdb

kernel32

SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateThread CreateFileW LoadLibraryA lstrlenW GetNativeSystemInfo SetLastError DecodePointer HeapReAlloc HeapSize RaiseException GetLastError InitializeCriticalSectionAndSpinCount WaitForSingleObject GetProcessHeap HeapFree HeapAlloc VirtualProtect VirtualFree VirtualAlloc GetProcAddress FreeLibrary LocalAlloc LocalFree OpenProcess GetCurrentProcessId GetLogicalDriveStringsW GetModuleHandleW QueryDosDeviceW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteFile lstrcpyW LoadLibraryW Sleep CloseHandle CreateEventW GetFileSize GetSystemDirectoryW ReadFile DeleteFileW InterlockedIncrement GetModuleFileNameW WritePrivateProfileStringW GetPrivateProfileStringW InterlockedDecrement GetDiskFreeSpaceExW WinExec GetTempPathW LockResource MultiByteToWideChar FindResourceW LoadLibraryExW lstrcmpiW SizeofResource IsBadReadPtr LoadResource WriteConsoleW SetEndOfFile FlushFileBuffers ReadConsoleW GetConsoleCP GetTimeZoneInformation SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler GetDriveTypeW SetFilePointerEx FreeLibraryAndExitThread ExitThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetACP GetTickCount GetCurrentDirectoryW GetVersionExW FreeResource ExitProcess GlobalAlloc GlobalLock GlobalUnlock GlobalFree MulDiv GetFileType SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW WideCharToMultiByte GetLocalTime GetLongPathNameW GetFileAttributesW GetTempFileNameW CopyFileW GetExitCodeProcess FindClose RemoveDirectoryW FindFirstFileW FindNextFileW MoveFileExW ReadProcessMemory CreateProcessW FileTimeToSystemTime GetFileAttributesExW ReleaseMutex CreateMutexW GetVolumeInformationW AreFileApisANSI DeviceIoControl OutputDebugStringA SetPriorityClass VerSetConditionMask SetErrorMode SystemTimeToTzSpecificLocalTime GetWindowsDirectoryW GetVersion VirtualAllocEx VirtualFreeEx WriteProcessMemory lstrcpynW GetFileAttributesExA SleepEx GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency VerifyVersionInfoA ExpandEnvironmentStringsA WaitForMultipleObjects GetStdHandle PeekNamedPipe FormatMessageA GetSystemTime FlushConsoleInputBuffer GlobalMemoryStatus RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetFullPathNameW FindFirstFileExW GetPrivateProfileIntW

user32

ShowWindow SetWindowPos SetCursor InflateRect OffsetRect LoadCursorW GetMessageW TranslateMessage DispatchMessageW DestroyWindow UpdateLayeredWindow SetFocus GetFocus GetKeyState SetCapture ReleaseCapture KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect GetClientRect GetCursorPos ScreenToClient MapWindowPoints IsRectEmpty PtInRect GetParent GetWindow wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW EnableWindow GetSystemMetrics SetPropW GetPropW GetWindowLongW GetMonitorInfoW IsIconic IsZoomed SetWindowRgn IntersectRect CharPrevW DrawTextW FillRect PostQuitMessage CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor GetDoubleClickTime SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetDesktopWindow GetWindowThreadProcessId FindWindowExW GetClassNameW GetShellWindow SystemParametersInfoW GetProcessWindowStation GetUserObjectInformationW MessageBoxA PostMessageW SendMessageW InvalidateRect MonitorFromWindow SetWindowLongW LoadIconW LoadStringW IsWindow SetForegroundWindow FindWindowW CharNextW MoveWindow GetForegroundWindow GetWindowRect SetTimer SetRect

advapi32

CryptDestroyKey CryptSignHashA CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptReleaseContext RegCloseKey RegCreateKeyExW RevertToSelf ImpersonateLoggedOnUser OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountSidW DuplicateTokenEx RegEnumKeyW RegOpenKeyW DeregisterEventSource RegisterEventSourceA ReportEventA CryptAcquireContextA RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegEnumValueA RegSetValueExW RegQueryValueExW RegOpenKeyExW CryptEnumProvidersA

shell32

SHGetSpecialFolderPathW SHAppBarMessage SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW SHGetFolderPathW ord155 SHGetFolderLocation SHGetDesktopFolder SHGetDataFromIDListW SHGetFileInfoW ShellExecuteW

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize CoTaskMemRealloc

oleaut32

SysAllocString SysFreeString VariantClear VarUI4FromStr VariantInit

gdiplus

GdiplusShutdown GdipCreateFromHDC GdiplusStartup GdipDrawImageRectI GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipSetTextRenderingHint GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawImageRectRectI GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics

shlwapi

PathFileExistsW PathAppendW

psapi

GetProcessImageFileNameW EnumProcessModules GetModuleFileNameExW

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CryptQueryObject CertCloseStore CryptMsgGetParam CertGetNameStringW CertFindCertificateInStore CryptMsgClose CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext

msimg32

AlphaBlend

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

InternetOpenW InternetCloseHandle InternetSetOptionW InternetReadFile HttpQueryInfoW InternetOpenUrlW

comctl32

_TrackMouseEvent ord17

ws2_32

connect getservbyname gethostbyname htonl shutdown freeaddrinfo getaddrinfo accept gethostname ioctlsocket WSAGetLastError socket __WSAFDIsSet select WSASetLastError recv send bind closesocket getpeername getsockname getsockopt htons ntohs setsockopt WSAIoctl WSAStartup WSACleanup sendto recvfrom listen

wldap32

ord46 ord60 ord50 ord41 ord217 ord143 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord211

gdi32

BitBlt CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW CreateDIBSection GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx TextOutW GetDeviceCaps GetObjectA GetDIBits CreateBitmap CreateDCW CreateCompatibleBitmap

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

506KB

Virtual Size

505KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40.4MB

Virtual Size

40.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=208, id=243, version=40116,

count=32, id=242, version=40116,

count=35, id=265, version=24215,

count=623, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=261, version=23013,

count=11, id=199, version=41118,

count=28, id=259, version=24123,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=65, id=261, version=24123,

count=38, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=559, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=118, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,