2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat
Size 3.4MB
Sample261001-hf34jstycw
SHA256 2f976d63ffe459590d29110e8bb3a8e113a7fa1b098c3145c1d71db5298030b1
MD5 c24d827e38e476631df1af8e57754ce9
SHA1 fce1c7ba6ab7aec30c6eaf94c3e6bc3768641d3b
SHA512 85eef06778717d544b542a660c957b54ac5c60e11082c83c4b10f633a2709c2fec58478a78e4a4593312d42b701160665f134dffe6fe85cabb2c4286dffe112a
SSDEEP 98304:HPwdyD7hwCslV8e+k1/cJhU4aW9DY0W8rH60AXHk2NwyakWrk0P8wMCQumRduBMr:vwdyD7hwCslV8e+k1/cJhU4aW9DY0W8Q
TLSH
T1B1F5D003E6408433F45A1171146A67BA9D3DAD302B29C4C3E7D17EB9AE716D3EA3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

.exe 3.4MB

2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH 7403ff419507603bbc2c8fc94c921032
SHA256 2f976d63ffe459590d29110e8bb3a8e113a7fa1b098c3145c1d71db5298030b1
MD5 c24d827e38e476631df1af8e57754ce9
SHA1 fce1c7ba6ab7aec30c6eaf94c3e6bc3768641d3b
SHA512 85eef06778717d544b542a660c957b54ac5c60e11082c83c4b10f633a2709c2fec58478a78e4a4593312d42b701160665f134dffe6fe85cabb2c4286dffe112a
SSDEEP 98304:HPwdyD7hwCslV8e+k1/cJhU4aW9DY0W8rH60AXHk2NwyakWrk0P8wMCQumRduBMr:vwdyD7hwCslV8e+k1/cJhU4aW9DY0W8Q
TLSH
T1B1F5D003E6408433F45A1171146A67BA9D3DAD302B29C4C3E7D17EB9AE716D3EA3934B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3515628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaGosubReturn __vbaLenBstr __vbaStrVarMove __vbaLateIdCall ord696 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaVarIndexStore __vbaRaiseEvent __vbaFreeObjList ord516 ord517 __vbaVarIndexLoadRef _adj_fprem1 ord518 __vbaCopyBytes __vbaResume __vbaVarCmpNe __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaVarCmpGe __vbaVarIndexLoadRefLock __vbaLateMemSt __vbaForEachCollObj ord593 __vbaVarForInit __vbaExitProc __vbaI4Abs ord594 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 ord520 __vbaVargVar __vbaVarTstLt __vbaBoolVarNull __vbaFpR8 _CIsin ord631 __vbaVargVarMove __vbaNextEachCollObj ord632 __vbaChkstk __vbaGosubFree ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner3 __vbaObjVar __vbaI2I4 __vbaPrintObj DllFunctionCall ord563 ord670 __vbaVarOr __vbaVarLateMemSt __vbaLbound __vbaStrR4 __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 __vbaUI1I2 _CIsqrt __vbaRedimVar __vbaVarAnd EVENT_SINK_QueryInterface __vbaStrUI1 ord710 __vbaExceptHandler ord711 __vbaStrToUnicode ord712 __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 __vbaGosub ord607 __vbaVarDiv ord608 ord531 ord716 __vbaVarCmpLe __vbaFPException ord717 __vbaInStrVar __vbaStrVarVal __vbaUbound __vbaGetOwner3 __vbaVarCat ord535 __vbaI2Var ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaVarLateMemCallLdRf __vbaInStr ord648 ord570 __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord573 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaVarAdd __vbaLateMemCall __vbaAryLock ord612 __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord616 __vbaVarLateMemCallLd __vbaVarCopy __vbaFpI4 ord617 __vbaVarSetObjAddref __vbaLateMemCallLd _CIatan __vbaCastObj ord618 __vbaStrMove __vbaAryCopy __vbaStrVarCopy ord619 __vbaR8IntI4 _allmul __vbaLateIdSt ord652 _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaRecAssign __vbaFreeObj __vbaFreeStr ord581

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

kernel32

GetModuleFileNameW

user32

GetWindow

advapi32

RegDeleteKeyA

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_c24d827e38e476631df1af8e57754ce9_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

msvbvm60

msvcrt

iphlpapi

psapi

kernel32

user32

advapi32

shell32

generic