2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat
Size 5.0MB
Sample261102-bys8qset4x
SHA256 bfe906840ddacebbebc4c012e8670bf745ec1745d889cf93ee19ca024300bf99
MD5 fde88f9767013528f49197967cf0814f
SHA1 b37b12c45378abcd0781542f2e4398a593b71af0
SHA512 5bd1a45335043556ccb746c5f3ba5b5ec590d1b84ddde36662667970aa0b0c41ab4db8455ffa1e778027cf6ca82d86823bcb29996f2c0e76cc7c8be4f8f642e9
SSDEEP 98304:dQWC/wmTRUiOPYTxrIA3ZkQCQoa1oiqpuP:KrPrIWZkVtnpu
TLSH
T1FA36BE11BA8184B2D743023534EA977ECD3A7E2C4F2495C3AF97367E4E301C266FA695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

.exe 5.0MB

2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH 254a70fc0067e552d02158cd1b28e3af
SHA256 bfe906840ddacebbebc4c012e8670bf745ec1745d889cf93ee19ca024300bf99
MD5 fde88f9767013528f49197967cf0814f
SHA1 b37b12c45378abcd0781542f2e4398a593b71af0
SHA512 5bd1a45335043556ccb746c5f3ba5b5ec590d1b84ddde36662667970aa0b0c41ab4db8455ffa1e778027cf6ca82d86823bcb29996f2c0e76cc7c8be4f8f642e9
SSDEEP 98304:dQWC/wmTRUiOPYTxrIA3ZkQCQoa1oiqpuP:KrPrIWZkVtnpu
TLSH
T1FA36BE11BA8184B2D743023534EA977ECD3A7E2C4F2495C3AF97367E4E301C266FA695
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

690589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\df_helper\build\bin\Release\df_helper_main.pdb

shlwapi

StrCmpW PathFileExistsW PathRemoveFileSpecW PathStripPathW PathAppendA PathIsRelativeW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW VerQueryValueA

rpcrt4

UuidCreate

kernel32

CreateDirectoryW GetFullPathNameW CreateFileW FindFirstFileW FindNextFileW GetLongPathNameW EnterCriticalSection LeaveCriticalSection ReleaseSemaphore WriteFile FlushFileBuffers SetFileTime GetSystemTime SystemTimeToFileTime MapViewOfFile UnmapViewOfFile CreateSemaphoreW CreateFileMappingW OutputDebugStringA FreeLibrary GetLocalTime DecodePointer CreateWaitableTimerA SetWaitableTimer GetFileAttributesExW CreateFileMappingA InterlockedExchange InterlockedCompareExchange SwitchToThread ReadFile SetEndOfFile SetFilePointer GetPrivateProfileIntA GetPrivateProfileStringA CreateDirectoryA CreateFileA DeleteFileA FindFirstFileA CopyFileA LoadLibraryA GetSystemDirectoryA DeviceIoControl GetVersionExA CreateEventW GetModuleHandleA GetFileAttributesW CreateThread SetThreadPriority GetSystemTimeAsFileTime GetCurrentDirectoryW GetOverlappedResult GetDateFormatW UnlockFileEx UnlockFile LockFileEx LockFile GetFileAttributesA CreateMutexA GetTickCount WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc FindClose HeapDestroy QueryPerformanceFrequency SetThreadAffinityMask GetCurrentThread Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter SetConsoleCtrlHandler GetCommandLineA ExitProcess DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetExitCodeProcess GetModuleFileNameA LoadLibraryW OpenEventA CloseHandle Sleep SetEvent SetLastError GetLastError DuplicateHandle TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetProcAddress Process32First Process32Next SetEnvironmentVariableW FileTimeToSystemTime InterlockedIncrement SystemTimeToTzSpecificLocalTime GetDriveTypeW ResumeThread ExitThread OpenFileMappingW GetSystemInfo Module32FirstW GetSystemPowerStatus GetSystemWow64DirectoryW GetDriveTypeA WritePrivateProfileStringW GetStartupInfoA CreateProcessW CreateProcessA GetLogicalDriveStringsA lstrcpyW lstrcmpA CreatePipe FileTimeToLocalFileTime GetSystemTimes LocalFree LocalAlloc GlobalMemoryStatusEx InterlockedDecrement CancelIo CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe WriteConsoleW FreeEnvironmentStringsW GetFileSizeEx GetFileSize GetFileInformationByHandle CreateEventA ResetEvent TerminateThread HeapAlloc GetCurrentThreadId Module32First GenerateConsoleCtrlEvent TzSpecificLocalTimeToSystemTime GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessAffinityMask GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle GetTimeZoneInformation FormatMessageW FindFirstFileExW GetDiskFreeSpaceExW SetFileAttributesW SetFilePointerEx GetTempPathW AreFileApisANSI CopyFileW CreateHardLinkW SetCurrentDirectoryW RemoveDirectoryW CreateDirectoryExW MoveFileExW TryEnterCriticalSection GetStringTypeW RtlUnwind WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo EncodePointer QueueUserWorkItem GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead InitializeCriticalSection SleepEx ExpandEnvironmentStringsA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects FormatMessageA VerSetConditionMask VerifyVersionInfoA GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx GetConsoleOutputCP

user32

PeekMessageW UnregisterClassA MsgWaitForMultipleObjects SetCursor ClipCursor SetWindowTextW OffsetRect SystemParametersInfoA TranslateMessage DispatchMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW SendMessageW CallWindowProcW SetWindowPos EndDialog SetDlgItemTextW GetSystemMetrics GetWindowRect GetWindowLongW SetWindowLongW GetParent LoadStringW EnumDisplayDevicesA RegisterWindowMessageW GetMessageA PostThreadMessageA SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx PeekMessageA

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW SHGetDesktopFolder CommandLineToArgvW SHCreateDirectoryExW SHGetSpecialFolderPathA SHGetFolderPathA SHGetFolderPathW ShellExecuteW

ole32

StringFromCLSID IIDFromString CoTaskMemFree CoCreateGuid CoInitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VarBstrCmp SysStringLen SysFreeString SysAllocString VariantClear GetErrorInfo VariantInit VariantChangeType SetErrorInfo CreateErrorInfo

advapi32

ReportEventW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW CryptReleaseContext CryptGenRandom CryptAcquireContextA DeregisterEventSource RegisterEventSourceW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash GetUserNameW RegQueryValueExA RegOpenKeyExA RegCloseKey CryptSignHashW CryptEnumProvidersW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA

ws2_32

gethostbyname gethostname ioctlsocket htonl getnameinfo sendto recvfrom listen accept freeaddrinfo getaddrinfo ntohl inet_ntoa shutdown select inet_addr ntohs __WSAFDIsSet setsockopt WSAStartup WSACleanup WSAGetLastError socket WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons WSAIoctl

iphlpapi

GetAdaptersInfo

wldap32

ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord217 ord143 ord200 ord35 ord30 ord79 ord301

netapi32

NetApiBufferFree NetWkstaTransportEnum Netbios

gdiplus

GdipCreateFont GdipCreateFontFamilyFromName GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipSaveImageToFile GdipGetImageGraphicsContext GdipDrawString GdipMeasureString GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromFile GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipCreateBitmapFromFileICM

httpapi

HttpReceiveHttpRequest HttpRemoveUrl HttpAddUrl HttpCreateHttpHandle HttpTerminate HttpInitialize HttpSendHttpResponse

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CertGetNameStringA CertGetNameStringW CryptQueryObject

psapi

GetModuleFileNameExW

comdlg32

GetOpenFileNameW

winmm

timeKillEvent timeSetEvent timeGetDevCaps timeBeginPeriod

generic

count=22, id=259, version=27412,

count=225, id=261, version=27412,

count=23, id=260, version=27412,

count=666, id=260, productName=VS2017 v15.9.4 build 27025, version=27025,

count=3, id=170, productName=VS2010 build 30319, version=30319,

count=1, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,

count=16, id=260, productName=VS2017 v15.8.9? build 26730, version=26730,

count=8, id=199, version=41118,

count=26, id=259, version=26706,

count=139, id=261, version=26706,

count=38, id=260, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=457, id=1, productName=Unmarked objects,

count=9, id=265, version=27051,

count=53, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,