2026-10-11_8d1e1adc3465ca8f3e4c8082e681a08a_amadey_coinminer_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_8d1e1adc3465ca8f3e4c8082e681a08a_amadey_coinminer_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader
Size 4.8MB
Sample261012-twragaysat
SHA256 38a88fbd32f56a8b8e67ea5fbf983d6752a6e2863b5e5fbaf8e4a78c13ae85a0
MD5 8d1e1adc3465ca8f3e4c8082e681a08a
SHA1 6e48c1e1a2c865b196ae6d25fd0abfe1c09ccd49
SHA512 22b6bd1eb851eeb21b4c3032cc9b0fd0c003f1c279e2546363db8a4a83c83086f54a3e3f8a434936a3e95e13910e3c8066c5ac9a6bf47279c2fe1ed0eb3b0589
SSDEEP 98304:eCWNOfE3S83iaAfWgWC9dvEE5JUr9mcWxHE3e/oIgs:0NgKiFEoOIcCH0pIp
TLSH
T1A736C003FB818832D7D3017156AAD73E8A3979304B25C6C3E7A5257E9D309D2E73A399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_8d1e1adc3465ca8f3e4c8082e681a08a_amadey_coinminer_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-10-11_8d1e1adc3465ca8f3e4c8082e681a08a_amadey_coinminer_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

.exe 4.8MB

2026-10-11_8d1e1adc3465ca8f3e4c8082e681a08a_amadey_coinminer_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

IMPHASH c4b60f8dc5548768394711b778b675fa
SHA256 38a88fbd32f56a8b8e67ea5fbf983d6752a6e2863b5e5fbaf8e4a78c13ae85a0
MD5 8d1e1adc3465ca8f3e4c8082e681a08a
SHA1 6e48c1e1a2c865b196ae6d25fd0abfe1c09ccd49
SHA512 22b6bd1eb851eeb21b4c3032cc9b0fd0c003f1c279e2546363db8a4a83c83086f54a3e3f8a434936a3e95e13910e3c8066c5ac9a6bf47279c2fe1ed0eb3b0589
SSDEEP 98304:eCWNOfE3S83iaAfWgWC9dvEE5JUr9mcWxHE3e/oIgs:0NgKiFEoOIcCH0pIp
TLSH
T1A736C003FB818832D7D3017156AAD73E8A3979304B25C6C3E7A5257E9D309D2E73A399
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2301873

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkSpace\jenkins\workspace\Emulator_Build_Api4\Emulator_Check_AppsInstaller_EN_V5_ROM7_1\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

kernel32

DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExA GetCurrentThreadId SetThreadPriority GetPrivateProfileStringA lstrcpynW GlobalMemoryStatusEx RaiseException SetLastError InitializeCriticalSectionAndSpinCount lstrcmpW GetSystemDefaultLangID GetVersion VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID GetCommandLineW GetEnvironmentVariableA GetDriveTypeW DecodePointer SetUnhandledExceptionFilter ExitProcess GetLocalTime LoadLibraryExW SetEvent ResetEvent CreateEventW CreateFileA CompareFileTime CreateDirectoryA GetFileTime SetFileAttributesA GetModuleFileNameA SetEndOfFile QueueUserWorkItem GetStartupInfoW GetSystemInfo GetACP FormatMessageA InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SuspendThread GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber LoadLibraryA ConvertFiberToThread ConvertThreadToFiber TryEnterCriticalSection TerminateThread CreateThread GetCurrentProcessId WaitForSingleObject GetLastError RemoveDirectoryW ReadFile GetVolumeInformationW WriteConsoleW CopyFileW EnterCriticalSection OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetTimeZoneInformation GetFullPathNameA GetFullPathNameW FlushFileBuffers HeapSize SetStdHandle EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleCP HeapReAlloc SetConsoleCtrlHandler SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetCommandLineA FreeLibraryAndExitThread ResumeThread ExitThread GetFileAttributesExW InterlockedFlushSList RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetStringTypeW InitializeCriticalSection Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcatW lstrcpyW lstrcmpiW lstrcmpiA LeaveCriticalSection GetModuleHandleW GetModuleFileNameW GetLongPathNameW FindNextFileW FindFirstFileW FindClose CreateDirectoryW WideCharToMultiByte WritePrivateProfileStructW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW lstrlenW MulDiv LocalFree LocalAlloc CloseHandle WriteFile SetFileAttributesW CreateFileW FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource SizeofResource LockResource OpenProcess GetExitCodeProcess Sleep CreatePipe SetHandleInformation OutputDebugStringW DebugBreak RemoveDirectoryA QueryDosDeviceW GetTempFileNameW GetLogicalDriveStringsW GetFileSize FindNextFileA FindFirstFileA DeleteFileA SetCurrentDirectoryW DosDateTimeToFileTime GetCurrentProcess DuplicateHandle SetFileTime SetFilePointer GetFileType GetCurrentDirectoryW lstrlenA lstrcpyA lstrcpynA GetTempPathW GetDiskFreeSpaceExW DeviceIoControl SystemTimeToFileTime LoadLibraryW GetProcAddress FreeLibrary GetSystemTime GetVersionExW MultiByteToWideChar FindFirstFileExA MoveFileExW GetTickCount FindFirstFileExW CreateProcessW LoadResource FormatMessageW

user32

GetWindowRect SendMessageW GetDesktopWindow ReleaseDC GetDC LoadStringW FillRect EnumDisplaySettingsW GetClipboardData RegisterClipboardFormatW IsClipboardFormatAvailable GetAsyncKeyState SetCapture ReleaseCapture SetCursor GetCursorPos CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor IntersectRect UnionRect PtInRect RegisterWindowMessageW PostThreadMessageW FindWindowW GetMonitorInfoW MonitorFromWindow TrackMouseEvent IsIconic IsWindowEnabled MapWindowPoints wsprintfW CopyRect SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetParent FindWindowExW GetWindowThreadProcessId TranslateMessage DispatchMessageW PeekMessageW AttachThreadInput BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxW CharNextW PostMessageW WaitMessage DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer IsRectEmpty CallWindowProcW GetClassInfoExW IsWindow ShowWindow SetFocus SetWindowTextW GetWindowTextW GetWindowTextLengthW GetWindowLongW SetWindowLongW LoadCursorW BeginPaint EndPaint InvalidateRect DrawIcon DrawTextW LoadImageW DrawIconEx GetFocus GetKeyState GetClientRect UpdateWindow GetMessagePos IsZoomed EnableWindow SetWindowRgn ScreenToClient OffsetRect SetClassLongW ChangeDisplaySettingsW GetUserObjectInformationW SystemParametersInfoW GetWindow GetProcessWindowStation

gdi32

SetViewportOrgEx SetBkColor MoveToEx GetObjectA SetTextColor RoundRect Rectangle LineTo SetBkMode GetTextExtentPoint32W GetCurrentObject GetClipBox ExcludeClipRect CreateSolidBrush SetWindowOrgEx CreateFontIndirectW DeleteObject CreatePatternBrush CreateFontW CreateCompatibleBitmap GetObjectW CreateDIBSection SelectObject GetDIBits GetDeviceCaps DeleteDC CreateCompatibleDC BitBlt GetStockObject CombineRgn CreateRectRgn CreateRoundRectRgn CreateRectRgnIndirect SelectClipRgn GdiSetBatchLimit CreatePen StretchBlt

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegEnumValueW CreateWellKnownSid RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW OpenProcessToken CreateProcessAsUserW SetTokenInformation DuplicateTokenEx AllocateAndInitializeSid FreeSid GetLengthSid SystemFunction036 RegCloseKey

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation SHGetMalloc CommandLineToArgvW Shell_NotifyIconW SHFileOperationW ShellExecuteW SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHGetPathFromIDListW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoLoadLibrary StringFromGUID2 CoInitializeEx CoUninitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

OleLoadPicture SysAllocString VarUI4FromStr GetErrorInfo VariantClear VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString

shlwapi

PathAppendW PathCanonicalizeW PathFindExtensionW PathIsDirectoryW PathIsRootW PathMatchSpecW SHRegGetUSValueA PathRemoveExtensionW PathRemoveFileSpecW SHGetValueW PathIsDirectoryEmptyW PathAppendA PathCombineA PathFileExistsA PathFindFileNameA PathIsDirectoryA StrCmpIW StrStrIW StrStrW PathFileExistsW PathRemoveFileSpecA PathFindFileNameW SHRegSetUSValueA PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateBitmapFromHBITMAP GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipDrawString GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipReleaseDC GdipSetImageAttributesColorKeys GdipGetPropertyItem GdipCreateFontFromLogfontA GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipTranslateTextureTransform GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusStartup GdipFree GdipAlloc GdipGetPropertyItemSize

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetSetOptionW InternetSetCookieA InternetSetCookieW InternetErrorDlg InternetGetCookieW InternetOpenA InternetConnectW InternetOpenUrlA HttpOpenRequestW HttpSendRequestA InternetReadFile InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname gethostbyname getnameinfo bind send recv socket WSAGetLastError shutdown

wldap32

ord147 ord133 ord79 ord142 ord301 ord127 ord27 ord26 ord118 ord167 ord41 ord208 ord216 ord14 ord46 ord219 ord145

generic

count=15, id=241, version=40116,

count=186, id=243, version=40116,

count=28, id=242, version=40116,

count=1, id=264, version=23026,

count=17, id=170, productName=VS2010 build 30319, version=30319,

count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=209, version=65501,

count=6, id=199, version=41118,

count=26, id=259, version=23013,

count=75, id=261, version=23013,

count=66, id=260, version=23013,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=666, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=47, id=203, version=65501,

count=595, id=1, productName=Unmarked objects,

count=108, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=151,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,