2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc
Size 9.9MB
Sample260825-enlyfsswe1
SHA256 d13ca858a1bbc4f43ee60bed9f933ff05d579a2a5443a79bddd8c675259097f9
MD5 afc257dacd14a6b024b3c342529afea8
SHA1 2cc697e19f7a5bc661b5927f2d143b20417c30d5
SHA512 d408e182aa85486d07161838c73fe37723fa9a2cd26f9fbc0b73f7bade08483dce3f584e421c4c7f0a1a97f2c5cc8ece893815291ffd0c6f1cb3b9bc7f87c954
SSDEEP 196608:Eut0r20Qq1LU/WYquhmNVnG0tQEiImaJyxS0cP2:NXVq1LUuYqWoI0t3maJykbP2
TLSH
T1AAA629203A05CA37E9914EF1593C5A2F510C9F550BBAB8C3E2C83E6E29B59C71732E57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc

File Explorer

2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc

.exe 9.9MB

2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc

IMPHASH 75b84f52c86ac63cfc169b5edb8640fc
SHA256 d13ca858a1bbc4f43ee60bed9f933ff05d579a2a5443a79bddd8c675259097f9
MD5 afc257dacd14a6b024b3c342529afea8
SHA1 2cc697e19f7a5bc661b5927f2d143b20417c30d5
SHA512 d408e182aa85486d07161838c73fe37723fa9a2cd26f9fbc0b73f7bade08483dce3f584e421c4c7f0a1a97f2c5cc8ece893815291ffd0c6f1cb3b9bc7f87c954
SSDEEP 196608:Eut0r20Qq1LU/WYquhmNVnG0tQEiImaJyxS0cP2:NXVq1LUuYqWoI0t3maJykbP2
TLSH
T1AAA629203A05CA37E9914EF1593C5A2F510C9F550BBAB8C3E2C83E6E29B59C71732E57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

72:dc:33:d4:9b:80:61:61:c7:55:51:81:4f:64:9d:b1:eb:ab:24:cd:3e:03:d0:fb:c3:f4:8e:e0:b2:99:c2:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=pogz™

Chains

Aug 21, 2026

CN=pogz™

PE Signature issue

Digest

72:dc:33:d4:9b:80:61:61:c7:55:51:81:4f:64:9d:b1:eb:ab:24:cd:3e:03:d0:fb:c3:f4:8e:e0:b2:99:c2:68

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Subject

CN=Icafe8\

Serial Number

03:4e:84:bc:a3:86:91:75:da:69:31:b6:6c:f0:f2:93:bb:d2:bc:8c

Issuer

CN=Icafe8\

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2026 - Feb 12, 2080

Subject

CN=pogz™

Serial Number

3a:be:09:93:3d:cb:56:8b:42:9c:91:2c:cb:e6:29:b6

Issuer

CN=pogz™

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 2, 2025 - Oct 2, 2125

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7194021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\slave\workspace\NBMS_BAR_trunk\bin\pdb\BarServer.pdb

iocptcp

TcpListen TcpSetLinkAttr TcpConnect TcpGetLinkAddr TcpCreate TcpUninit TcpInit TcpSend TcpDestroy

iocpudp

UdpUninit UdpSendTo UdpDestroy UdpCreate UdpInit

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

kernel32

CreateFileA HeapReAlloc GetFullPathNameA GetFullPathNameW GetCurrentThreadId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetConsoleCtrlHandler SetFileAttributesA GetCurrentThread SetLastError GetModuleFileNameA OpenProcess GetCurrentProcess TerminateProcess GetFileSizeEx DeviceIoControl FindClose SetSystemTime GetTimeZoneInformation FileTimeToSystemTime OpenMutexA GetLogicalDriveStringsA GetDriveTypeA CreateDirectoryA FindFirstFileA FindNextFileA CopyFileA CreateToolhelp32Snapshot Process32First Process32Next Module32First GetFileTime DuplicateHandle lstrlenA MoveFileA GetFileType SetFilePointerEx lstrlenW CreateDirectoryW RemoveDirectoryA RemoveDirectoryW SetFileAttributesW FindFirstFileW FindNextFileW CopyFileW MoveFileW LockResource LoadResource SizeofResource lstrcpyA FindResourceA EnumResourceNamesA GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileSectionA WritePrivateProfileSectionA WritePrivateProfileStructA GetComputerNameA SetEvent ResetEvent ReleaseMutex CreateMutexA CreateEventA FileTimeToLocalFileTime GetModuleHandleA VirtualQuery SetUnhandledExceptionFilter GetLocalTime IsBadWritePtr GetModuleFileNameW GetDiskFreeSpaceExA InterlockedIncrement GetCommandLineW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount InterlockedDecrement GetModuleHandleExW TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode PeekNamedPipe GetFileSize GetExitCodeProcess WriteConsoleW SystemTimeToTzSpecificLocalTime FreeEnvironmentStringsW GetEnvironmentStringsW VirtualProtect VirtualFree VirtualAlloc UnregisterWaitEx InitializeSListHead ReleaseSemaphore SetStdHandle WaitForSingleObject InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA LoadLibraryExA GetLastError GetProcAddress FreeLibrary CreateMutexW HeapCompact SetFilePointer MapViewOfFile UnmapViewOfFile SetEndOfFile GetConsoleCP GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetStartupInfoW CreateEventW UnhandledExceptionFilter SetEnvironmentVariableA GetDriveTypeW MoveFileExW GetCurrentDirectoryW GetCommandLineA UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue FreeLibraryAndExitThread GetThreadTimes ExitProcess GetCPInfo LoadLibraryExW ExitThread CreateThread IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind EncodePointer GetStringTypeW GetExitCodeThread HeapAlloc SystemTimeToFileTime QueryPerformanceCounter CreateProcessA HeapFree GetFileInformationByHandle FindFirstFileExW

user32

wsprintfA MessageBoxW GetUserObjectInformationW GetProcessWindowStation PeekMessageA DispatchMessageA TranslateMessage GetMessageA

comdlg32

GetFileTitleA

advapi32

SetEntriesInAclA CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceConfigA QueryServiceConfig2A QueryServiceStatus CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash RegCloseKey RegCreateKeyExA RegOpenKeyExA CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetNamedSecurityInfoA RegQueryValueExA FreeSid AllocateAndInitializeSid RegSetValueExA

shell32

ShellExecuteExA ShellExecuteA SHGetSpecialFolderPathA CommandLineToArgvW

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoInitializeSecurity

oleaut32

SysFreeString VariantInit SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound VariantClear SafeArrayDestroy SysAllocString

dbghelp

MiniDumpWriteDump

ws2_32

getaddrinfo WSASocketW WSAGetLastError socket setsockopt send select sendto getsockopt getpeername ioctlsocket connect closesocket freeaddrinfo WSACleanup WSAStartup ntohs htons inet_addr ntohl htonl getnameinfo inet_pton WSASetLastError __WSAFDIsSet gethostbyname recv

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersInfo SendARP GetIfEntry

rpcrt4

UuidCreate

shlwapi

PathFileExistsW PathFindFileNameA PathFileExistsA

psapi

GetProcessMemoryInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_afc257dacd14a6b024b3c342529afea8_amadey_bkransomware_coinminer_elex_glassworm_maze_smoke-loader_stealc

PE Signature issue

PE Signature issue

iocptcp

iocpudp

crypt32

kernel32

user32

comdlg32

advapi32

shell32

ole32

oleaut32

dbghelp

ws2_32

version

iphlpapi

rpcrt4

shlwapi

psapi

generic