2026-10-25_cb59fc100769e01a3ba18976dbb7f73e_amadey_coinminer_elex_glassworm_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_cb59fc100769e01a3ba18976dbb7f73e_amadey_coinminer_elex_glassworm_smoke-loader_stop
Size 8.0MB
Sample261026-pf2daady2w
SHA256 275b23fc0451bb0ae54c58bb68e80fd960f21ae6afdf4a0173c231e03630118b
MD5 cb59fc100769e01a3ba18976dbb7f73e
SHA1 d110c8a756bb9ac08272d143fcaeea7884e81b0f
SHA512 daa325a34a3e248e366b87f82f6012db31b17292b9037dd0092a7875c8c5fccf7c80895b7e79d7c1490f76302e659964471c3ba997b4c67312b2b69f2af9420e
SSDEEP 98304:RhTvHOTJm0BoWOXee4Vv9Wu0b9h6Gqj21YcCkdzeYZu7M3bkbjCSH3Cd:RhTfOTJm0eXe0b9h61S1YcBex4LkHHS
TLSH
T1B4861920E603C03DDAF719B292FE57BF94285A18531930D3A2DC2E777B965E2B93211D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_cb59fc100769e01a3ba18976dbb7f73e_amadey_coinminer_elex_glassworm_smoke-loader_stop

File Explorer

2026-10-25_cb59fc100769e01a3ba18976dbb7f73e_amadey_coinminer_elex_glassworm_smoke-loader_stop

.exe 8.0MB

2026-10-25_cb59fc100769e01a3ba18976dbb7f73e_amadey_coinminer_elex_glassworm_smoke-loader_stop

IMPHASH fed2c5c56210089e28951646d0446c5a
SHA256 275b23fc0451bb0ae54c58bb68e80fd960f21ae6afdf4a0173c231e03630118b
MD5 cb59fc100769e01a3ba18976dbb7f73e
SHA1 d110c8a756bb9ac08272d143fcaeea7884e81b0f
SHA512 daa325a34a3e248e366b87f82f6012db31b17292b9037dd0092a7875c8c5fccf7c80895b7e79d7c1490f76302e659964471c3ba997b4c67312b2b69f2af9420e
SSDEEP 98304:RhTvHOTJm0BoWOXee4Vv9Wu0b9h6Gqj21YcCkdzeYZu7M3bkbjCSH3Cd:RhTfOTJm0eXe0b9h61S1YcBex4LkHHS
TLSH
T1B4861920E603C03DDAF719B292FE57BF94285A18531930D3A2DC2E777B965E2B93211D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4727567

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Work\RF\DevClient1.0_For_Release\Bin\Release\RF_Online.pdb

kernel32

FindResourceA SizeofResource LockResource LoadResource FindResourceExA ReadProcessMemory GetCurrentProcess UnhandledExceptionFilter GetCurrentThread GetCurrentProcessId GetCurrentThreadId ReleaseMutex CreateMutexA Process32Next Process32First CreateToolhelp32Snapshot GetSystemTime GetPrivateProfileSectionNamesA GetPrivateProfileSectionA CreateEventA ResetEvent EnterCriticalSection LeaveCriticalSection SetEvent GetTempFileNameA GetTempPathA SystemTimeToTzSpecificLocalTime GlobalFree FormatMessageA CreateDirectoryA SystemTimeToFileTime DebugBreak GetFileAttributesExA SetFileAttributesW DeleteFileW PeekConsoleInputA SetConsoleMode ReadConsoleInputA ResumeThread InterlockedDecrement InterlockedIncrement GetProcessHeap HeapAlloc HeapFree lstrcatW IsDBCSLeadByteEx LoadLibraryA GetProcAddress FreeLibrary GetACP GetVersionExA IsDBCSLeadByte ExitProcess GetFileSize ReadFile GetFileAttributesA SetFileAttributesA lstrcatA SetFilePointer DeleteFileA DeleteCriticalSection InitializeCriticalSection GlobalAlloc GlobalLock GlobalUnlock GetSystemDirectoryA GetModuleHandleA GetModuleFileNameA GetPrivateProfileIntW GetPrivateProfileStringW OutputDebugStringA lstrcpyA lstrcmpiW GetLocalTime GetPrivateProfileStringA GetTickCount FlushConsoleInputBuffer GlobalMemoryStatus OutputDebugStringW QueryPerformanceFrequency FindFirstFileA FindNextFileA GetFullPathNameA GetDriveTypeA CreateFileW SetEnvironmentVariableA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW QueryPerformanceCounter Sleep WaitForSingleObject WritePrivateProfileStringA GetPrivateProfileIntA lstrlenW GetLastError CreateFileA WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetCurrentDirectoryA GetCurrentDirectoryA GetFullPathNameW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID FlushFileBuffers SetConsoleCtrlHandler GetStringTypeW GetStringTypeA GetFileType SetHandleCount GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapCreate FatalAppExitA IsValidCodePage GetOEMCP GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW LCMapStringA GetStartupInfoA GetCommandLineA CreateDirectoryW FindFirstFileW GetDriveTypeW FileTimeToLocalFileTime FileTimeToSystemTime FindClose GetDateFormatA GetTimeFormatA IsDebuggerPresent SetUnhandledExceptionFilter CloseHandle lstrlenA lstrcmpiA GetStringTypeExA GetStringTypeExW WideCharToMultiByte CompareStringA CompareStringW GetEnvironmentVariableA MultiByteToWideChar GetVersion InterlockedExchange GetEnvironmentVariableW GetSystemTimeAsFileTime ExitThread VirtualQuery RtlUnwind lstrcmpA lstrcpynA TerminateProcess GetExitCodeProcess SetLastError GetWindowsDirectoryA CreateProcessA UnmapViewOfFile SetEndOfFile CreateFileMappingA MapViewOfFile IsBadReadPtr VirtualProtect LoadLibraryExA LocalFree VirtualAlloc DuplicateHandle VirtualFree GetSystemInfo ReleaseSemaphore MulDiv CreateSemaphoreA CreateThread WaitForMultipleObjects GetThreadPriority SetThreadPriority RaiseException HeapSize HeapReAlloc HeapDestroy GetThreadLocale GetLocaleInfoA InterlockedCompareExchange GetNumberOfConsoleInputEvents

user32

CopyRect SetWindowLongA GetWindowLongA InflateRect DestroyCursor LoadCursorFromFileA SetClassLongA ShowCursor DefWindowProcA EndPaint BeginPaint SetFocus UnregisterClassA GetClassInfoA DestroyWindow CreateWindowExA ClientToScreen GetSystemMetrics GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW KillTimer SetTimer SetCursor GetMenu DestroyMenu GetAsyncKeyState MessageBoxA OffsetRect SetRectEmpty RegisterWindowMessageA GetKeyboardLayout wsprintfA ScreenToClient LoadAcceleratorsA GetActiveWindow TranslateAcceleratorA DialogBoxParamA RegisterClassA LoadMenuA AdjustWindowRect EnumDisplaySettingsA ChangeDisplaySettingsA PostQuitMessage SetWindowPos GetClassLongA ClipCursor GetDlgItem EndDialog EnableWindow SetMenu SetCapture ReleaseCapture GetCursorPos ReleaseDC CharUpperBuffA GetQueueStatus PostThreadMessageA wvsprintfA MsgWaitForMultipleObjects RegisterClassExA LoadIconA SetWindowTextA MoveWindow ShowWindow DispatchMessageA TranslateMessage SetRect MapVirtualKeyA OpenClipboard SetActiveWindow PeekMessageA GetWindowRect LoadStringA MapWindowPoints GetWindow GetDC CharNextA EmptyClipboard SetClipboardData CloseClipboard GetMessageA GetClientRect GetKeyState SetCursorPos PostMessageA CharUpperA CharUpperW CharLowerA CharLowerW SendMessageA

gdi32

CreateCompatibleDC CreateDCA CreateCompatibleBitmap SetLayout TextOutA SetDeviceGammaRamp AddFontResourceA RemoveFontResourceA GetStockObject GetTextExtentPoint32W GetTextExtentExPointW GetTextExtentPointA SetTextAlign GetObjectA SetTextColor SelectObject CreateFontA GetDeviceCaps SetMapMode CreateDIBSection SetBkColor DeleteDC DeleteObject ExtTextOutW GetTextExtentPoint32A GetTextExtentExPointA ExtTextOutA GetBitmapBits BitBlt

advapi32

RegCreateKeyExA RegisterEventSourceA ReportEventA DeregisterEventSource RegEnumValueA RegDeleteKeyA RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegQueryValueExA RegSetValueExA

shell32

SHFileOperationA SHGetSpecialFolderPathA ShellExecuteA

ole32

CoFreeUnusedLibraries CoTaskMemAlloc CoCreateInstance CLSIDFromString CoInitialize CoUninitialize CoTaskMemFree

oleaut32

VariantInit SafeArrayUnaccessData SafeArrayCreate SafeArrayAccessData SysAllocString VariantClear SysAllocStringLen SysFreeString

d3dx9_36

D3DXMatrixRotationZ D3DXLoadSurfaceFromSurface D3DXCreateLine D3DXMatrixPerspectiveFovLH D3DXCreateTexture D3DXVec3Normalize D3DXVec3TransformCoord D3DXMatrixRotationY D3DXVec3Transform D3DXCreateCubeTextureFromFileInMemoryEx D3DXCreateTextureFromFileInMemoryEx D3DXCreateSprite D3DXQuaternionRotationMatrix D3DXQuaternionRotationAxis D3DXQuaternionSlerp D3DXMatrixRotationQuaternion D3DXSaveSurfaceToFileA D3DXMatrixRotationX D3DXCreateEffectPool D3DXCreateEffectFromFileA D3DXCreateEffect D3DXCompileShaderFromFileA D3DXCreateTextureFromFileA D3DXCompileShader D3DXAssembleShaderFromFileA D3DXAssembleShader D3DXMatrixTranslation D3DXCreateTextureFromFileExA D3DXCreateTextureFromFileInMemory D3DXCreateRenderToSurface D3DXMatrixScaling D3DXVec3Project D3DXMatrixOrthoLH D3DXMatrixTranspose D3DXMatrixPerspectiveOffCenterLH D3DXMatrixLookAtLH D3DXMatrixInverse D3DXMatrixMultiply D3DXPlaneFromPoints

winmm

timeEndPeriod timeBeginPeriod timeGetTime timeKillEvent timeSetEvent

shlwapi

PathFileExistsW PathFileExistsA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

imm32

ImmGetDefaultIMEWnd ImmGetContext ImmAssociateContext ImmGetIMEFileNameA ImmSetConversionStatus ImmGetConversionStatus ImmSetCompositionStringA ImmGetCompositionStringW ImmGetCandidateListW ImmNotifyIME ImmGetCompositionStringA ImmReleaseContext

dbghelp

StackWalk SymGetModuleBase SymFunctionTableAccess

ws2_32

listen socket WSACreateEvent shutdown htonl bind accept WSASetLastError WSACloseEvent WSAEventSelect getsockname WSAWaitForMultipleEvents WSAEnumNetworkEvents send recv WSAGetLastError gethostname WSACleanup WSAStartup inet_ntoa getpeername __WSAFDIsSet select connect ioctlsocket closesocket gethostbyname inet_addr getservbyname htons

wininet

InternetCloseHandle HttpOpenRequestA InternetConnectA InternetSetStatusCallback InternetOpenA HttpSendRequestA

stringloadera

?GetAt@CStringLoader@@QBEPBDI@Z ?GetStringCount@CStringLoader@@QBEIXZ ?DestroyStringLoader@CStringLoader@@SAXPAPAV1@@Z ?CreateStringLoader@CStringLoader@@SAPAV1@PBD@Z

purifiera

?DestroyInstance@CPurifier@@SAXXZ ?GetInstance@CPurifier@@SAPAV1@XZ ?CreateInstance@CPurifier@@SA_NPBD@Z

mss32

_AIL_service_stream@8 _AIL_set_stream_volume_pan@12 _AIL_pause_stream@8 _AIL_close_stream@4 _AIL_start_sample@4 _AIL_release_sample_handle@4 _AIL_set_sample_volume_pan@12 _AIL_init_sample@4 _AIL_active_sample_count@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_distances@12 _AIL_set_3D_sample_file@8 _AIL_decompress_ADPCM@12 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_file_type@8 _AIL_file_size@4 _AIL_allocate_3D_sample_handle@4 _AIL_set_3D_orientation@28 _AIL_3D_sample_status@4 _AIL_stream_status@4 _AIL_set_3D_position@16 _AIL_set_3D_sample_effects_level@8 _AIL_stop_3D_sample@4 _AIL_set_3D_room_type@8 _AIL_open_3D_listener@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_open_digital_driver@16 _AIL_startup@0 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_close_digital_driver@4 _AIL_close_3D_provider@4 _AIL_close_3D_listener@4 _AIL_stream_info@20 _AIL_set_stream_loop_count@8 _AIL_open_stream@12 _AIL_start_stream@4 _AIL_file_read@8 _AIL_allocate_sample_handle@4 _AIL_end_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_set_3D_sample_volume@8 _AIL_end_sample@4 _AIL_set_named_sample_file@20 _AIL_mem_free_lock@4 _AIL_last_error@0 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_start_3D_sample@4 _AIL_stop_sample@4

comdlg32

GetOpenFileNameA

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

netapi32

Netbios

generic

count=54, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=126, version=50327,

count=61, id=125, productName=VS2005 build 50727, version=50727,

count=45, id=10, version=8966,

count=12, id=11, version=8966,

count=1, id=28, version=9178,

count=8, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=35, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=456, id=1, productName=Unmarked objects,

count=609, id=109, productName=VS2005 build 50727, version=50727,

count=845, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,