2026-10-31_73979f75da8b0e1a6bdabccf6b523560_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_73979f75da8b0e1a6bdabccf6b523560_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.3MB
Sample261102-aes8ysdz7x
SHA256 b447e23535cccc499eb6a4d4add1744ff4d3612029bf8e3d87fe133b9efda053
MD5 73979f75da8b0e1a6bdabccf6b523560
SHA1 f10f8b8885a038fbcebcebda46abd635f4a3ecb4
SHA512 ac4ae3d51af830104690af431ce5c6974d76bd12ad9cc17f2d8442fb10600d1e525f7b05249912f292f434e8bce83bc41e59840bc526112b5ed2c60de7043dde
SSDEEP 49152:Tb5UR3VIUJNRojcbNncZIt695g/86DERhTqq3a:H5q3VI+NJZjNupa
TLSH
T10BB5BF117B91C272E2B1163065795F76947D7E38AF3086CBA3D00B6A55302E2F936F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_73979f75da8b0e1a6bdabccf6b523560_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-10-31_73979f75da8b0e1a6bdabccf6b523560_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.3MB

2026-10-31_73979f75da8b0e1a6bdabccf6b523560_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 44b79669f625799124b126e5e997a6a0
SHA256 b447e23535cccc499eb6a4d4add1744ff4d3612029bf8e3d87fe133b9efda053
MD5 73979f75da8b0e1a6bdabccf6b523560
SHA1 f10f8b8885a038fbcebcebda46abd635f4a3ecb4
SHA512 ac4ae3d51af830104690af431ce5c6974d76bd12ad9cc17f2d8442fb10600d1e525f7b05249912f292f434e8bce83bc41e59840bc526112b5ed2c60de7043dde
SSDEEP 49152:Tb5UR3VIUJNRojcbNncZIt695g/86DERhTqq3a:H5q3VI+NJZjNupa
TLSH
T10BB5BF117B91C272E2B1163065795F76947D7E38AF3086CBA3D00B6A55302E2F936F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

942936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\360cssdk\StatisticalSDK\StatisticalSDK\Release\cssdk.pdb

wininet

FtpOpenFileW InternetSetStatusCallbackW InternetWriteFile InternetGetLastResponseInfoW InternetErrorDlg HttpQueryInfoA InternetSetOptionA HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW InternetSetOptionW InternetQueryOptionW InternetCrackUrlW FtpGetFileSize HttpEndRequestW InternetReadFileExA HttpSendRequestW HttpSendRequestExW FtpCommandW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

Netbios

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathAppendW PathAddBackslashW PathGetDriveNumberW SHGetValueA SHGetValueW PathCanonicalizeW PathIsRelativeW SHSetValueW StrStrIW PathIsRootW PathRemoveBackslashW PathCombineW PathFindFileNameA

ws2_32

WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents send WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAStartup WSACleanup accept htonl listen recvfrom freeaddrinfo sendto ioctlsocket getaddrinfo WSASetLastError gethostname select __WSAFDIsSet WSACloseEvent closesocket

wldap32

ord30 ord79 ord35 ord33 ord32 ord27 ord301 ord22 ord41 ord211 ord46 ord217 ord143 ord50 ord60 ord26 ord200 ord45

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptMsgClose CryptQueryObject CryptMsgGetParam CertCloseStore CertGetNameStringW CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertEnumCertificatesInStore

powrprof

CallNtPowerInformation

kernel32

TryEnterCriticalSection TlsGetValue GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache UnhandledExceptionFilter GetStartupInfoW SignalObjectAndWait SetThreadPriority GetThreadPriority ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW FindFirstFileW GetTempPathW AreFileApisANSI RaiseException GetLastError SetLastError QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject SleepEx WaitForSingleObjectEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects CreateWaitableTimerW GetCurrentProcess ChangeTimerQueueTimer TerminateProcess SwitchToThread CreateThread GetCurrentThreadId CreateProcessW GetThreadTimes IsProcessorFeaturePresent GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW LockResource GetExitCodeProcess DeleteCriticalSection LoadResource SizeofResource FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW FindResourceW DeviceIoControl lstrcmpA lstrcmpiA GetSystemWow64DirectoryW RemoveDirectoryW GetFullPathNameW DeleteFileW CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW GetPrivateProfileIntW CreateDirectoryW GetFileSizeEx FindNextFileW FindClose GetFileAttributesW SetFileAttributesW lstrcmpW lstrlenW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetModuleHandleA GetDiskFreeSpaceExW MoveFileW GetPrivateProfileStringW GetTempFileNameW WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW SetUnhandledExceptionFilter GetProcessHeap TlsSetValue SetEndOfFile CancelWaitableTimer TlsAlloc TlsFree IsBadReadPtr QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GetCurrentProcessId IsBadWritePtr

user32

DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage CreateWindowExW DestroyWindow SetTimer GetSystemMetrics GetDC ReleaseDC GetWindowRect WindowFromPoint GetWindowLongW SetWindowLongW FindWindowW FindWindowExW GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW IsWindow IsWindowVisible IntersectRect GetDesktopWindow FindWindowA TranslateMessage GetMessageW BringWindowToTop GetKeyState KillTimer FindWindowExA LoadCursorW PostThreadMessageW EnumDisplayDevicesW SendMessageTimeoutW GetLastInputInfo GetForegroundWindow GetWindowTextW GetClassNameW SetWindowTextW wsprintfW MessageBoxW GetAsyncKeyState ShowWindow SetWindowPos GetMessagePos SetForegroundWindow

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptReleaseContext CryptDestroyKey CryptAcquireContextA CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyExW CryptGenRandom

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW SHGetFolderPathW ShellExecuteW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wintrust

WinVerifyTrust

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=614, id=1, productName=Unmarked objects,

count=112, id=260, version=27034,

count=36, id=265, version=27054,

count=1, id=261, version=35219,

count=21, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,