2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader
Size 3.4MB
Sample261027-mncnsads9n
SHA256 9c0f9a4c536d99947b67310c50a88da4b431d3e1f301a1e4d45037365db14076
MD5 9f6f88690f666aeb7155969a9c46aad3
SHA1 b2205453681a7d81a2dc6a8cc6481c342276e712
SHA512 1dc9b8ba9cff5d3f62a56f09172e1b7f9b1eba856a381fc52db6a1f285d80084ca6766f233896eca719f98ac69f52536cd33a349e7bd5f593acd0f2492c2968f
SSDEEP 49152:DSveOA8VhLD1J1GIYM5g6t6zOYu6RRtPwx/M5emfl1aC+DrCtDU42mLsZFQw:DSv9dlGviXtwOYuGmx/bmVw7mLQuw
TLSH
T18DF5CF12FA4149B9EAD35174E2EF537A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

File Explorer

2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

.exe 3.4MB

2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

IMPHASH 42941e742f2a8ba9bf90499f83a617d8
SHA256 9c0f9a4c536d99947b67310c50a88da4b431d3e1f301a1e4d45037365db14076
MD5 9f6f88690f666aeb7155969a9c46aad3
SHA1 b2205453681a7d81a2dc6a8cc6481c342276e712
SHA512 1dc9b8ba9cff5d3f62a56f09172e1b7f9b1eba856a381fc52db6a1f285d80084ca6766f233896eca719f98ac69f52536cd33a349e7bd5f593acd0f2492c2968f
SSDEEP 49152:DSveOA8VhLD1J1GIYM5g6t6zOYu6RRtPwx/M5emfl1aC+DrCtDU42mLsZFQw:DSv9dlGviXtwOYuGmx/bmVw7mLQuw
TLSH
T18DF5CF12FA4149B9EAD35174E2EF537A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1745764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb

kernel32

GetFileSize GetFullPathNameW OutputDebugStringA SetLastError GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock LocalAlloc WTSGetActiveConsoleSessionId MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventA WideCharToMultiByte WriteConsoleW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage DecodePointer SetStdHandle GetConsoleOutputCP CreateDirectoryW GetTimeZoneInformation HeapReAlloc LCMapStringW CompareStringW HeapFree HeapAlloc ExitProcess HeapValidate ExpandEnvironmentStringsW LocalFree GetTickCount OpenProcess TerminateProcess CreateSymbolicLinkW DeviceIoControl GetConsoleWindow SetConsoleTitleW SetConsoleCtrlHandler MoveFileExW CopyFileW GetModuleHandleA Sleep CreateMutexA ReleaseMutex OutputDebugStringW WriteFile SetFilePointer SetFileAttributesW ReadFile GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCommandLineW CreateProcessW GetExitCodeProcess WaitForSingleObject CloseHandle SetCurrentDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FindResourceA LockResource LoadResource HeapSize FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetModuleHandleExW GetLocalTime UnhandledExceptionFilter InitializeCriticalSectionEx VirtualQuery EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertFiberToThread DeleteFiber GetFileType GetEnvironmentVariableW GetStdHandle LoadLibraryExA GetProcAddress FreeLibrary LoadLibraryA SetFilePointerEx GetLogicalProcessorInformationEx GetProcessHeaps QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter GetCurrentDirectoryW TlsFree TlsSetValue TlsGetValue TlsAlloc FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileSizeEx RemoveDirectoryW SetEndOfFile SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetModuleHandleW LoadLibraryExW LoadLibraryW IsDebuggerPresent GlobalMemoryStatusEx VirtualAlloc VirtualProtect IsWow64Process GetModuleFileNameA GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetSystemInfo GetProcessAffinityMask DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread TerminateThread GetExitCodeThread

user32

ShowWindow MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow MessageBoxA GetWindowTextLengthA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextA GetDlgItemInt SetDlgItemInt GetDlgItem GetWindowThreadProcessId EnumWindows GetWindowRect IsWindowVisible wsprintfA SetWindowPos DialogBoxParamA EndDialog

advapi32

QueryServiceStatusEx RegisterEventSourceW DeregisterEventSource RegCloseKey RegCreateKeyExA SetNamedSecurityInfoW RegSetValueExW RegQueryValueExW RegQueryInfoKeyA RegDeleteValueW LookupPrivilegeValueA SetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW ConvertStringSidToSidW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus SetServiceObjectSecurity RegisterServiceCtrlHandlerW ReportEventW QueryServiceStatus QueryServiceObjectSecurity OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegDeleteValueA

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

ws2_32

WSAStartup gethostname closesocket send recv WSACleanup WSAGetLastError WSASetLastError

shlwapi

SHDeleteKeyA

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

616KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

636KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_9f6f88690f666aeb7155969a9c46aad3_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

psapi

bcrypt

generic