2026-09-10_2588cb42bcc9f7e3916218e18c0c5a12_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_2588cb42bcc9f7e3916218e18c0c5a12_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_smoke-loader
Size 8.0MB
Sample260910-xhf45aec62
SHA256 eb459cd8d5a0bceb28aaa595045bb0c5eeb1a675a256ae6ddf7704a433c0d5aa
MD5 2588cb42bcc9f7e3916218e18c0c5a12
SHA1 9a4fd211604b1fb0dcf107d535b8b6ddc90ab483
SHA512 302955316cbfc2e4fbe1fabbf0c9844c41db53dc85d18181fbc064c12277a104136477c755a81265f39919b06d3d7e6ccb0d60b1452980e61a9be48affba75a7
SSDEEP 196608:y72K8lX2eHjNUYAhLEBov97x5x/dniKMmEKuZnDNDa:q2VNjNTAF1v35ldfMmEKon5Da
TLSH
T1D286F101BA81C072D19302305E5ABBBF59BEAE701B35C1C7A7D40A1E5D705E2B63B7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_2588cb42bcc9f7e3916218e18c0c5a12_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_smoke-loader

File Explorer

2026-09-10_2588cb42bcc9f7e3916218e18c0c5a12_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_smoke-loader

.exe 8.0MB

2026-09-10_2588cb42bcc9f7e3916218e18c0c5a12_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_smoke-loader

IMPHASH 7f0aa92fa8b89813abb26b1087612399
SHA256 eb459cd8d5a0bceb28aaa595045bb0c5eeb1a675a256ae6ddf7704a433c0d5aa
MD5 2588cb42bcc9f7e3916218e18c0c5a12
SHA1 9a4fd211604b1fb0dcf107d535b8b6ddc90ab483
SHA512 302955316cbfc2e4fbe1fabbf0c9844c41db53dc85d18181fbc064c12277a104136477c755a81265f39919b06d3d7e6ccb0d60b1452980e61a9be48affba75a7
SSDEEP 196608:y72K8lX2eHjNUYAhLEBov97x5x/dniKMmEKuZnDNDa:q2VNjNTAF1v35ldfMmEKon5Da
TLSH
T1D286F101BA81C072D19302305E5ABBBF59BEAE701B35C1C7A7D40A1E5D705E2B63B7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2003218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalLock SetCurrentDirectoryW ResumeThread InterlockedDecrement InterlockedIncrement FormatMessageW GetSystemInfo OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetTickCount lstrlenA GetFileSizeEx GetFileInformationByHandle InterlockedCompareExchange GetModuleHandleW GetCurrentThreadId VirtualFree VirtualAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateProcessW GetExitCodeProcess TerminateProcess OpenProcess LocalFree LocalAlloc GlobalFree GlobalAlloc WTSGetActiveConsoleSessionId CreateFileA RemoveDirectoryW CreateDirectoryW GetDriveTypeW GetEnvironmentVariableW GetCurrentProcessId GlobalUnlock CopyFileW DeleteFileW GetFileAttributesExW GetFileAttributesW SetFileAttributesW GetTempPathW FileTimeToSystemTime FileTimeToLocalFileTime ReadFile WriteFile GetFileSize CreateEventW Sleep WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetExitCodeThread TerminateThread CreateThread FindNextFileW FindFirstFileW lstrcpyW FindClose GetLongPathNameW GetWindowsDirectoryW WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer DeleteFileA WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW lstrlenW GetVolumeInformationW GetSystemDirectoryW CreateMutexW MoveFileExW ReleaseMutex LoadLibraryW GetProcAddress FreeLibrary GetVersionExW SetPriorityClass CreateFileW OutputDebugStringA FindFirstFileA WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW SetStdHandle GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime ExitThread RtlUnwind LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes CloseHandle DeviceIoControl GetLastError GetCurrentProcess GetVersionExA GetLocalTime GetFullPathNameW FindResourceW SizeofResource LoadResource LockResource FreeResource HeapCreate FlushInstructionCache OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter EncodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo MulDiv SetFileTime CompareFileTime LocalFileTimeToFileTime FileTimeToDosDateTime DosDateTimeToFileTime ResetEvent ReleaseSemaphore CreateSemaphoreW WaitForMultipleObjects SetEndOfFile GetCurrentDirectoryW GetModuleHandleA FormatMessageA SleepEx GetFileType GetStdHandle PeekNamedPipe

user32

SetWindowPos GetForegroundWindow SetForegroundWindow GetWindowLongW SetWindowLongW PostMessageW ShowWindow PostQuitMessage SetWindowTextW GetCursorPos SendMessageW GetMonitorInfoW SystemParametersInfoW FindWindowW GetParent GetDesktopWindow PtInRect ScreenToClient ClientToScreen GetWindowRect GetSystemMetrics IsWindow GetClassNameW PeekMessageW DispatchMessageW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo TranslateMessage LoadStringW GetKeyState UnregisterClassW wsprintfW GetDC ReleaseDC InflateRect OffsetRect DrawIconEx GetIconInfo CharUpperW CharPrevExA GetProcessWindowStation GetUserObjectInformationW MessageBoxW IntersectRect LoadCursorW DestroyCursor DestroyWindow SetTimer KillTimer SetCursor SetRect CopyRect UnionRect IsRectEmpty EqualRect SetFocus GetFocus DefWindowProcW CallWindowProcW RegisterClassExW CreateWindowExW GetDlgItem GetActiveWindow GetClientRect MapWindowPoints GetWindow MonitorFromWindow TrackMouseEvent AnimateWindow SetLayeredWindowAttributes IsIconic IsZoomed GetCapture SetCapture ReleaseCapture UpdateWindow BeginPaint EndPaint InvalidateRect CreateCaret GetCaretBlinkTime HideCaret SetCaretPos DestroyIcon GetMessageW IsWindowVisible MsgWaitForMultipleObjects IsWindowEnabled LoadBitmapW CreateIconFromResource LoadImageW CharNextW EnableMenuItem GetSysColor DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow IsMenu CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenu GetMenuInfo

advapi32

RegQueryValueExA DeleteService StartServiceW OpenServiceW OpenSCManagerW CreateServiceW CloseServiceHandle RegFlushKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf ImpersonateLoggedOnUser RegEnumKeyW RegOpenKeyW OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountSidW DuplicateTokenEx SetTokenInformation CreateProcessAsUserW RegDeleteKeyW RegDeleteValueW

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation ShellExecuteExW SHGetSpecialFolderPathA SHFileOperationW SHGetFolderPathW SHChangeNotify SHCreateDirectoryExW SHGetPathFromIDListW ShellExecuteW SHGetSpecialFolderPathW

ole32

CoCreateGuid OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize CreateBindCtx CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal

shlwapi

SHDeleteValueW SHDeleteKeyW SHSetValueW PathFileExistsW PathAddBackslashW SHGetValueW StrToIntExW SHCreateStreamOnFileEx

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

gdiplus

GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipBitmapUnlockBits GdipImageGetFrameDimensionsCount GdipCloneImage GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdiplusShutdown GdiplusStartup GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdipDrawImageI GdipDeleteGraphics GdipAlloc

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

wldap32

ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143

ws2_32

freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind WSASetLastError select __WSAFDIsSet WSAGetLastError send recv WSACleanup WSAStartup sendto accept listen ioctlsocket gethostname recvfrom

gdi32

SetGraphicsMode GetDeviceCaps CreateBitmap CreateRoundRectRgn EnumFontsW BitBlt GetViewportOrgEx GetCurrentObject SetViewportOrgEx GetObjectW CreateFontIndirectW SelectObject SelectClipRgn IntersectClipRect GetRegionData ExtCreateRegion DeleteObject DeleteDC CreateCompatibleDC StretchBlt CreateSolidBrush GetStockObject Rectangle SetBkMode CreateDIBSection GetTextFaceW ExtTextOutW SetWorldTransform GetTextMetricsW EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GdiFlush

oleaut32

SysAllocString SysAllocStringLen VariantCopy VariantClear SysFreeString SysStringLen

wininet

InternetReadFile InternetOpenUrlW InternetSetOptionW InternetOpenW HttpQueryInfoW InternetQueryOptionW InternetCloseHandle

usp10

ScriptFreeCache ScriptItemize ScriptShape

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

963KB

Virtual Size

962KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24.2MB

Virtual Size

24.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=265, version=24247,

count=37, id=241, version=40116,

count=216, id=243, version=40116,

count=39, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=199, version=41118,

count=28, id=259, version=24237,

count=6, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=12, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=704, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=550, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=122, id=261, version=24237,

count=42, id=260, version=24237,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=615, id=1, productName=Unmarked objects,

count=64, id=261, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,