2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil
Size 6.4MB
Sample261002-v8psvasdra
SHA256 5ca86bf98796ffff52921409e9fd3d087ff75bd1637d9c42d456573a78f4c557
MD5 2b21e882a975b3b36fe3d78e729c262a
SHA1 ad3a47efc16454e993cfbd6d528446bfb71ade42
SHA512 3b99a1d5581b27c1908a89134f29087be776c954dcd8ef7736218c2dc0430da8b67773e752c33325d76195802387c6aa4fbb63d68d96b76ac63f6b8345e671ca
SSDEEP 98304:gi276eUBIAFUnQodoR2qUY+nffNo+QihpdXpdPctR+PDDvYDxUHRGm2B3uFWH:gv/UBNvodoRYNrhpDdpDwWEnduF
TLSH
T145669E02B9E18475E57302323A65B356EDBDA9629B3194CFB38C162F0F709C1973BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil

File Explorer

2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil

.exe 6.4MB

2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil

IMPHASH 93a0a1a2e15cb5aaae6b6cddcbad469c
SHA256 5ca86bf98796ffff52921409e9fd3d087ff75bd1637d9c42d456573a78f4c557
MD5 2b21e882a975b3b36fe3d78e729c262a
SHA1 ad3a47efc16454e993cfbd6d528446bfb71ade42
SHA512 3b99a1d5581b27c1908a89134f29087be776c954dcd8ef7736218c2dc0430da8b67773e752c33325d76195802387c6aa4fbb63d68d96b76ac63f6b8345e671ca
SSDEEP 98304:gi276eUBIAFUnQodoR2qUY+nffNo+QihpdXpdPctR+PDDvYDxUHRGm2B3uFWH:gv/UBNvodoRYNrhpDdpDwWEnduF
TLSH
T145669E02B9E18475E57302323A65B356EDBDA9629B3194CFB38C162F0F709C1973BB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CareUEyes.pdb

winmm

timeSetEvent mciSendStringW timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

FindNextFileW GetFileAttributesExW GetCurrentDirectoryW MapViewOfFile GetVolumeInformationW GetFileAttributesW GetTempPathW CreateDirectoryW SetFilePointerEx SetEndOfFile FlushFileBuffers GetFileInformationByHandle CreateToolhelp32Snapshot GetFileSizeEx FormatMessageW TryEnterCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW GetSystemInfo GetSystemDirectoryW GetTimeZoneInformation GetUserDefaultLangID FindFirstChangeNotificationW FindCloseChangeNotification WaitForMultipleObjects FindNextChangeNotification Process32FirstW Process32NextW ResetEvent OpenFileMappingW IsBadReadPtr GetComputerNameW GetSystemTime GetCurrentDirectoryA GetModuleFileNameA GetVersionExA HeapCreate FreeResource GetFullPathNameW SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoW QueryPerformanceCounter MoveFileExA CompareFileTime GetFileType GetStdHandle PeekNamedPipe FormatMessageA InterlockedDecrement WriteFile UnmapViewOfFile SuspendThread GetThreadContext lstrlenA VirtualFree InterlockedIncrement GlobalAlloc VirtualAlloc FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetEnvironmentVariableA ExitProcess CreateProcessW ResumeThread TerminateProcess FindFirstFileW ReadProcessMemory LoadLibraryExA LoadLibraryA GetComputerNameA OutputDebugStringW IsBadWritePtr ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetDriveTypeW SetStdHandle GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetExitCodeThread SwitchToThread WaitForSingleObjectEx DuplicateHandle IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent SetLastError lstrcmpW GlobalAddAtomA Sleep InterlockedCompareExchange GetModuleHandleA SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetProcessHeap FindClose ReadFile CreateFileMappingW GetFileSize GlobalLock GlobalUnlock MulDiv WideCharToMultiByte OutputDebugStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateThread LoadLibraryW GetProcAddress FreeLibrary GetLastError CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCommandLineA GetModuleHandleW GetLocalTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount lstrcmpiW LockResource SizeofResource FindResourceExW DecodePointer RaiseException MultiByteToWideChar DeleteFileW LoadResource FindResourceW LoadLibraryExW GetCurrentThread GetModuleFileNameW VirtualQuery GetCurrentThreadId CreateFileW

user32

ReleaseDC MessageBoxW GetActiveWindow IsWindowVisible GetFocus GetParent ShowWindow SetWindowPos DestroyWindow SendMessageW UnregisterClassW CharNextW PtInRect GetDC OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindow MsgWaitForMultipleObjects CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetClassLongW GetClassLongW RemovePropW GetPropW SetPropW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow OffsetRect PeekMessageW FindWindowW GetWindowRect MonitorFromRect PostMessageW UnhookWinEvent SetWinEventHook GetForegroundWindow MonitorFromWindow GetCursorPos WindowFromPoint GetMonitorInfoW GetUserObjectInformationW GetProcessWindowStation DrawIconEx BringWindowToTop SetWindowLongW SetForegroundWindow MonitorFromPoint GetSystemMetrics GetAsyncKeyState UnregisterHotKey RegisterHotKey EnumDisplayMonitors CopyRect ScreenToClient GetWindowLongW GetClassNameW GetShellWindow GetAncestor LockWorkStation GetWindowThreadProcessId SystemParametersInfoW AttachThreadInput ClientToScreen InvalidateRect SetCursor SetCapture ReleaseCapture SetActiveWindow PostQuitMessage GetDesktopWindow CreateWindowExW SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow GetClientRect BeginPaint EndPaint InvalidateRgn RedrawWindow SetFocus GetWindow IsChild GetDlgCtrlID GetDlgItem GetSysColor DestroyAcceleratorTable FillRect CreateAcceleratorTableW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW RegisterClassExW CreatePopupMenu IsMenu IsWindowEnabled EnableWindow LoadImageW CreateIconFromResource LoadBitmapW GetIconInfo MapWindowPoints SetCaretPos HideCaret GetCaretBlinkTime CreateCaret UpdateWindow GetCapture AnimateWindow TrackMouseEvent SetRect DispatchMessageW CallWindowProcW SetTimer KillTimer GetWindowLongA SetLayeredWindowAttributes IsIconic EnumDisplayDevicesW DestroyIcon SendMessageA GetWindowDC GetWindowRgn IsZoomed SetSysColors DestroyCursor GetKeyState TranslateMessage GetMessageW EqualRect IsRectEmpty UnionRect IntersectRect InflateRect EnableMenuItem

gdi32

SetDeviceGammaRamp GetObjectW GetStockObject DeleteDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject SetBkMode SaveDC SetViewportOrgEx CreateFontIndirectW EnumFontsW CreateRectRgn CreatePen SetROP2 CreateHatchBrush FrameRgn Rectangle SetGraphicsMode CreateRoundRectRgn ExcludeClipRect GetDeviceCaps RestoreDC ExtCreateRegion GetRegionData IntersectClipRect SelectClipRgn CreateDIBSection GetCurrentObject GetViewportOrgEx CreateBitmap StretchBlt GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW SetWorldTransform ExtTextOutW GetTextFaceW GdiFlush BitBlt CreateCompatibleDC EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegQueryValueExW GetUserNameA RegDeleteValueW RegCreateKeyExW RegSetValueExW CryptEnumProvidersW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW Shell_NotifyIconW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ord680 ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance OleUninitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemFree OleLockRunning IIDFromString CoCreateGuid CreateBindCtx StringFromGUID2 CreateStreamOnHGlobal OleInitialize

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen SysStringLen LoadTypeLi VariantInit VariantClear OleCreateFontIndirect DispCallFunc SysFreeString LoadRegTypeLi VarUdateFromDate

shlwapi

PathFileExistsW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAppendW StrToIntExW PathQuoteSpacesW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom shutdown sendto gethostname socket getnameinfo

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

wldap32

ord208 ord41 ord46 ord145 ord216 ord14 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord301 ord133 ord147 ord219

usp10

ScriptShape ScriptItemize ScriptFreeCache

generic

count=41, id=241, version=40116,

count=206, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=28, id=259, version=26706,

count=8, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=22, id=260, version=27041,

count=41, id=260, version=26706,

count=136, id=261, version=26706,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, productName=Unmarked objects (old),

count=658, id=260, version=27038,

count=5, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=690, id=1, productName=Unmarked objects,

count=344, id=261, version=27041,

count=85, id=261, version=27054,

count=7, id=261, version=27051,

count=144, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,