2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader
Size 3.5MB
Sample261027-ye2gbsed49
SHA256 7d72b634f95ef08a5e049491d78a3a2fab416d3f2b02fa69732d0d0ab96f018b
MD5 fdb0021c6c4cda7f296e6b4882106c79
SHA1 70d00439ffcfa215d829535cb0a6ce5ca3f2da5c
SHA512 d35c17831e1fae119dc5349b7765ec99256bdfac9b0f55d585e08cce66fe37715f62d70138087325ad1b39cecb819c52b40214aba1074bb80630b58f1c15747b
SSDEEP 98304:/Yyc/ZcGrpSmxmd/FWMx5u7mPLg4E2Drpti:BcxcEMlxw7mPLREgrpt
TLSH
T1B006C012FA4149B9EAD31174E2EF577A4A396F20033588C787D03FA958325D2BB3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader

File Explorer

2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader

.exe 3.5MB

2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader

IMPHASH 9ad9ee83a6b1f8f0f0b277c19b9e93b1
SHA256 7d72b634f95ef08a5e049491d78a3a2fab416d3f2b02fa69732d0d0ab96f018b
MD5 fdb0021c6c4cda7f296e6b4882106c79
SHA1 70d00439ffcfa215d829535cb0a6ce5ca3f2da5c
SHA512 d35c17831e1fae119dc5349b7765ec99256bdfac9b0f55d585e08cce66fe37715f62d70138087325ad1b39cecb819c52b40214aba1074bb80630b58f1c15747b
SSDEEP 98304:/Yyc/ZcGrpSmxmd/FWMx5u7mPLg4E2Drpti:BcxcEMlxw7mPLREgrpt
TLSH
T1B006C012FA4149B9EAD31174E2EF577A4A396F20033588C787D03FA958325D2BB3E395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1740785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb

kernel32

GetFileSize GetFullPathNameW OutputDebugStringA SetLastError GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId GetVersionExA GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock LocalAlloc VerifyVersionInfoW WTSGetActiveConsoleSessionId MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventA WideCharToMultiByte GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateDirectoryW ExpandEnvironmentStringsW WriteConsoleW VerSetConditionMask GetCPInfo GetOEMCP GetACP IsValidCodePage DecodePointer SetStdHandle GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation HeapReAlloc LocalFree GetTickCount OpenProcess TerminateProcess CreateSymbolicLinkW DeviceIoControl GetConsoleWindow SetConsoleTitleW SetConsoleCtrlHandler MoveFileExW CopyFileW GetModuleHandleA Sleep CreateMutexA ReleaseMutex OutputDebugStringW WriteFile SetFilePointer SetFileAttributesW ReadFile GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCommandLineW CreateProcessW GetExitCodeProcess WaitForSingleObject CloseHandle SetCurrentDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FindResourceA LockResource LoadResource LoadLibraryExA FreeLibrary GetProcAddress WakeAllConditionVariable SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode LCMapStringW CompareStringW HeapFree HeapAlloc ExitProcess HeapValidate HeapSize FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetModuleHandleExW ConvertFiberToThread DeleteFiber GetFileType GetEnvironmentVariableW GetStdHandle SetProcessAffinityMask GetProcessHeaps DebugBreak GetLocalTime VirtualQuery QueryPerformanceFrequency QueryPerformanceCounter EncodePointer SetUnhandledExceptionFilter GetCurrentDirectoryW LoadLibraryA GetStringTypeW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue RtlUnwind FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileSizeEx RemoveDirectoryW SetEndOfFile SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetModuleHandleW LoadLibraryExW LoadLibraryW GlobalMemoryStatusEx VirtualAlloc VirtualProtect IsWow64Process GetModuleFileNameA IsDebuggerPresent GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetSystemInfo GetProcessAffinityMask DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread TerminateThread GetExitCodeThread TlsAlloc InitializeSListHead

user32

SetDlgItemInt MessageBoxW IsWindowVisible GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow MessageBoxA GetWindowTextLengthA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextA GetDlgItemInt GetDlgItem EndDialog GetWindowThreadProcessId EnumWindows GetWindowRect wsprintfA SetWindowPos DialogBoxParamA ShowWindow

advapi32

QueryServiceObjectSecurity RegisterEventSourceW SetNamedSecurityInfoW RegSetValueExW RegQueryValueExW RegQueryInfoKeyA RegEnumValueW RegDeleteValueW LookupPrivilegeValueA SetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW ConvertStringSidToSidW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus SetServiceObjectSecurity RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus ReportEventW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegDeleteValueA RegCreateKeyExA RegCloseKey DeregisterEventSource

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

ws2_32

WSAGetLastError recv send WSACleanup closesocket gethostname WSAStartup WSASetLastError

shlwapi

SHDeleteKeyA

wintrust

WinVerifyTrust

psapi

GetProcessMemoryInfo GetModuleFileNameExW

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_fdb0021c6c4cda7f296e6b4882106c79_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_qakbot_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

psapi

bcrypt

generic