2026-10-22_4cecfad09ccc227f435830ef2367d0cd_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_4cecfad09ccc227f435830ef2367d0cd_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.2MB
Sample261024-q628yaas91
SHA256 a975846af56fd278744ba085adda96aecfca75caac39bce15de9b258faeaadf9
MD5 4cecfad09ccc227f435830ef2367d0cd
SHA1 59cf53c4631d98cb0f5bf392336e1b620c3db0a7
SHA512 1ae376793924c5a53de16461231cc8c98b40325ed45fdaf7aa7b8d87879a76a822f50ab84b02479931a493a593ca24c5116038b55fadee829c76967abafc15b3
SSDEEP 49152:jFx+wMpMb02sIMpGC+A3sb8OVW+6lwcW/Gfksg1zf+NA:jFxmMoCMju6Zy1zgA
TLSH
T13AB5C0257B518171E1B1017055BAAF72D97D7D38AF308ACBA3901B1A89302D2FD36F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_4cecfad09ccc227f435830ef2367d0cd_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-10-22_4cecfad09ccc227f435830ef2367d0cd_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.2MB

2026-10-22_4cecfad09ccc227f435830ef2367d0cd_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH b0efb1b58bfbb37b495e48d7466fcfd8
SHA256 a975846af56fd278744ba085adda96aecfca75caac39bce15de9b258faeaadf9
MD5 4cecfad09ccc227f435830ef2367d0cd
SHA1 59cf53c4631d98cb0f5bf392336e1b620c3db0a7
SHA512 1ae376793924c5a53de16461231cc8c98b40325ed45fdaf7aa7b8d87879a76a822f50ab84b02479931a493a593ca24c5116038b55fadee829c76967abafc15b3
SSDEEP 49152:jFx+wMpMb02sIMpGC+A3sb8OVW+6lwcW/Gfksg1zf+NA:jFxmMoCMju6Zy1zgA
TLSH
T13AB5C0257B518171E1B1017055BAAF72D97D7D38AF308ACBA3901B1A89302D2FD36F7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

823437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\360cssdk\StatisticalSDK\StatisticalSDK\Release\promoteEngine.pdb

wininet

HttpSendRequestExW InternetSetStatusCallbackW InternetWriteFile InternetGetLastResponseInfoW HttpQueryInfoW HttpQueryInfoA FtpGetFileSize HttpAddRequestHeadersW HttpAddRequestHeadersA InternetCrackUrlW HttpOpenRequestW InternetSetOptionW InternetQueryOptionW InternetReadFile FtpOpenFileW InternetSetOptionA HttpEndRequestW HttpSendRequestW InternetReadFileExA InternetErrorDlg InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW FtpCommandW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

Netbios

shlwapi

SHGetValueW PathGetDriveNumberW SHGetValueA PathCanonicalizeW PathFindFileNameW PathIsRelativeW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW StrStrIW PathIsRootW SHSetValueW PathFindFileNameA PathCombineW PathRemoveBackslashW

ws2_32

WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents send WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAStartup WSACleanup accept htonl listen recvfrom freeaddrinfo sendto ioctlsocket getaddrinfo WSASetLastError gethostname select __WSAFDIsSet WSACloseEvent closesocket

wldap32

ord200 ord30 ord79 ord33 ord32 ord27 ord301 ord22 ord41 ord211 ord46 ord217 ord143 ord60 ord26 ord50 ord35 ord45

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptMsgClose CryptQueryObject CertCloseStore CertGetNameStringW CertOpenStore CryptMsgGetParam CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA

kernel32

TryEnterCriticalSection TlsGetValue GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache SignalObjectAndWait ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW FindFirstFileW GetTempPathW AreFileApisANSI RaiseException GetLastError SetLastError QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject SleepEx WaitForSingleObjectEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess SetThreadPriority CreateThread GetCurrentThreadId CreateProcessW GetThreadTimes IsProcessorFeaturePresent GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW DeviceIoControl DeleteCriticalSection lstrcmpA lstrcmpiA GetSystemWow64DirectoryW GetPrivateProfileIntW CreateDirectoryW SizeofResource GetCommandLineW LockResource LoadResource FindResourceW GetExitCodeProcess GetFileSizeEx FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW DeleteFileW lstrcmpW GetPrivateProfileStringW GetTempFileNameW GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW lstrlenW WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW CopyFileW SetUnhandledExceptionFilter SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetDiskFreeSpaceExW MoveFileW IsBadWritePtr TlsSetValue SetEndOfFile TlsAlloc TlsFree IsBadReadPtr GetProcessHeap QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA GetThreadPriority ChangeTimerQueueTimer GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle GetFullPathNameW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW SwitchToThread CancelWaitableTimer

user32

DefWindowProcW PostQuitMessage CreateWindowExW SetTimer GetSystemMetrics GetDC ReleaseDC GetWindowRect WindowFromPoint GetWindowLongW SetWindowLongW FindWindowW FindWindowExW GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW PostThreadMessageW GetDesktopWindow UnregisterClassW FindWindowA GetClassInfoExW KillTimer PostMessageW SendMessageW FindWindowExA LoadCursorW GetAsyncKeyState IsWindow ShowWindow RegisterClassExW SetWindowTextW SetWindowPos CallWindowProcW GetMessagePos wsprintfW GetKeyState EnumDisplayDevicesW SendMessageTimeoutW GetForegroundWindow GetClassNameW GetWindowTextW MessageBoxW

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptReleaseContext CryptDestroyKey CryptAcquireContextA CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyExW CryptGenRandom

shell32

SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

powrprof

CallNtPowerInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=608, id=1, productName=Unmarked objects,

count=112, id=260, version=27034,

count=38, id=265, version=27054,

count=1, id=261, version=35219,

count=15, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,