2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader
Size 14.3MB
Sample260824-e9b1dacp7w
SHA256 bfd344db4db0858b76be5ea837e7eab4469cf88893c028d6b8fa99181859bda4
MD5 96c8df4080da8caa5741ee5d5614c7b0
SHA1 04bb21d359d20b4ed1ac0191c4d1c1ea81ab89b4
SHA512 e369ccdcc626693c7361bfa232102be12795f7820311918faf88b7462e82e3f23a7186a475a55d8f5da0f3d8e15c73b055aca391a9787c737d03abd74188f99e
SSDEEP 196608:4u3rvXQxOC5zshnLD/gvWAulknBjo5DtL8InKdevd9khSB0UfDb/DFG:N3rvAxCyju+nB0DZ8IKdpPUf
TLSH
T126E6AF17E1A350ECC56BC1348757A272B931B8591334BEEF65A8DB312F21EA0573E728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader

File Explorer

2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader

.exe 14.3MB

2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader

SHA256 bfd344db4db0858b76be5ea837e7eab4469cf88893c028d6b8fa99181859bda4
MD5 96c8df4080da8caa5741ee5d5614c7b0
SHA1 04bb21d359d20b4ed1ac0191c4d1c1ea81ab89b4
SHA512 e369ccdcc626693c7361bfa232102be12795f7820311918faf88b7462e82e3f23a7186a475a55d8f5da0f3d8e15c73b055aca391a9787c737d03abd74188f99e
SSDEEP 196608:4u3rvXQxOC5zshnLD/gvWAulknBjo5DtL8InKdevd9khSB0UfDb/DFG:N3rvAxCyju+nB0DZ8IKdpPUf
TLSH
T126E6AF17E1A350ECC56BC1348757A272B931B8591334BEEF65A8DB312F21EA0573E728
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with Themida
UPX dump on OEP (original entry point)
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29212760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

528KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

9.4MB

Virtual Size

19.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

36KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

16KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_96c8df4080da8caa5741ee5d5614c7b0_amadey_cobalt-strike_coinminer_elex_glassworm_smoke-loader

generic