2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop

General

Target
2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop
Size 63.6MB
Sample261016-2ltlvaxy2j
SHA256 d25aef4b1a8ad800cbf455dffdde4b83caa83f849ea49df3cb01d122a9b29c12
MD5 1489cf39f76a07052bd4f21e5c29bbbc
SHA1 55b6386daae76fd0f7d88d697c7331c41b9fe42a
SHA512 7e774c5b5d4282230f5fa15cb24d93b5cb591215b27d66e6ead4a859747a9d2a13c6b9a74782e18b5b5f02a36ddbdf2ded1a7cc83d70609914da2a9d3a15203b
SSDEEP 393216:KDPiKn6J/q4OoVdaOoGHnDLl/MyXpeNAsM27W:aixpIOFQN7W
TLSH
T173E74A00B3E49A72C0BB4A35A5A3CA65E634BDA267244BD731DC364C2F736941E3637D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop

.exe 63.6MB

2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH da9d0b8b1b65807fc29a8f6c7f6cee37
SHA256 d25aef4b1a8ad800cbf455dffdde4b83caa83f849ea49df3cb01d122a9b29c12
MD5 1489cf39f76a07052bd4f21e5c29bbbc
SHA1 55b6386daae76fd0f7d88d697c7331c41b9fe42a
SHA512 7e774c5b5d4282230f5fa15cb24d93b5cb591215b27d66e6ead4a859747a9d2a13c6b9a74782e18b5b5f02a36ddbdf2ded1a7cc83d70609914da2a9d3a15203b
SSDEEP 393216:KDPiKn6J/q4OoVdaOoGHnDLl/MyXpeNAsM27W:aixpIOFQN7W
TLSH
T173E74A00B3E49A72C0BB4A35A5A3CA65E634BDA267244BD731DC364C2F736941E3637D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

5356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-18970417\vos3\thinstall\modules\boot_loader64.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess NtQueryInformationProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtProtectVirtualMemory NtCreateEvent LdrUnloadDll LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError NtClearEvent RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop

kernel32

user32

ntdll

generic