2026-11-01_c5344314aa1a1f7b013dba84d7a938d4_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c5344314aa1a1f7b013dba84d7a938d4_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.2MB
Sample261102-k7r7gagw21
SHA256 b5f9c3192c07360f123a2184f63f722b761791eae46244863b524799cc7680f7
MD5 c5344314aa1a1f7b013dba84d7a938d4
SHA1 2bab41b01c33144064bd6b626ca60ac7cbf1fbfb
SHA512 ee9b8d3e3f7161706632a9673a847d61c819879093942d88ef089fd9e5f8d66d2b25a7e625482777506cc621882097341512e14b875a768ad1ad1780d81a825f
SSDEEP 49152:lFx+wMpMb02sIMpGC+A3sb8OrAy4R5r5RRBseQ:lFxmMoCMjwCRFQ
TLSH
T191B5D0257B91C171D1B1017054BAAF76D97D7D38AF308ACB93901B2A89302D2F936F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c5344314aa1a1f7b013dba84d7a938d4_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-11-01_c5344314aa1a1f7b013dba84d7a938d4_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.2MB

2026-11-01_c5344314aa1a1f7b013dba84d7a938d4_amadey_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH b0efb1b58bfbb37b495e48d7466fcfd8
SHA256 b5f9c3192c07360f123a2184f63f722b761791eae46244863b524799cc7680f7
MD5 c5344314aa1a1f7b013dba84d7a938d4
SHA1 2bab41b01c33144064bd6b626ca60ac7cbf1fbfb
SHA512 ee9b8d3e3f7161706632a9673a847d61c819879093942d88ef089fd9e5f8d66d2b25a7e625482777506cc621882097341512e14b875a768ad1ad1780d81a825f
SSDEEP 49152:lFx+wMpMb02sIMpGC+A3sb8OrAy4R5r5RRBseQ:lFxmMoCMjwCRFQ
TLSH
T191B5D0257B91C171D1B1017054BAAF76D97D7D38AF308ACB93901B2A89302D2F936F7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

823437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\360cssdk\StatisticalSDK\StatisticalSDK\Release\promoteEngine.pdb

wininet

HttpSendRequestExW InternetSetStatusCallbackW InternetWriteFile InternetGetLastResponseInfoW HttpQueryInfoW HttpQueryInfoA FtpGetFileSize HttpAddRequestHeadersW HttpAddRequestHeadersA InternetCrackUrlW HttpOpenRequestW InternetSetOptionW InternetQueryOptionW InternetReadFile FtpOpenFileW InternetSetOptionA HttpEndRequestW HttpSendRequestW InternetReadFileExA InternetErrorDlg InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW FtpCommandW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

Netbios

shlwapi

SHGetValueW PathGetDriveNumberW SHGetValueA PathCanonicalizeW PathFindFileNameW PathIsRelativeW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW StrStrIW PathIsRootW SHSetValueW PathFindFileNameA PathCombineW PathRemoveBackslashW

ws2_32

WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents send WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAStartup WSACleanup accept htonl listen recvfrom freeaddrinfo sendto ioctlsocket getaddrinfo WSASetLastError gethostname select __WSAFDIsSet WSACloseEvent closesocket

wldap32

ord200 ord30 ord79 ord33 ord32 ord27 ord301 ord22 ord41 ord211 ord46 ord217 ord143 ord60 ord26 ord50 ord35 ord45

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptMsgClose CryptQueryObject CertCloseStore CertGetNameStringW CertOpenStore CryptMsgGetParam CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA

kernel32

TryEnterCriticalSection TlsGetValue GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache SignalObjectAndWait ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW FindFirstFileW GetTempPathW AreFileApisANSI RaiseException GetLastError SetLastError QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject SleepEx WaitForSingleObjectEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess SetThreadPriority CreateThread GetCurrentThreadId CreateProcessW GetThreadTimes IsProcessorFeaturePresent GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW DeviceIoControl DeleteCriticalSection lstrcmpA lstrcmpiA GetSystemWow64DirectoryW GetPrivateProfileIntW CreateDirectoryW SizeofResource GetCommandLineW LockResource LoadResource FindResourceW GetExitCodeProcess GetFileSizeEx FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW DeleteFileW lstrcmpW GetPrivateProfileStringW GetTempFileNameW GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW lstrlenW WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW CopyFileW SetUnhandledExceptionFilter SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetDiskFreeSpaceExW MoveFileW IsBadWritePtr TlsSetValue SetEndOfFile TlsAlloc TlsFree IsBadReadPtr GetProcessHeap QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA GetThreadPriority ChangeTimerQueueTimer GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle GetFullPathNameW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW SwitchToThread CancelWaitableTimer

user32

DefWindowProcW PostQuitMessage CreateWindowExW SetTimer GetSystemMetrics GetDC ReleaseDC GetWindowRect WindowFromPoint GetWindowLongW SetWindowLongW FindWindowW FindWindowExW GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW PostThreadMessageW GetDesktopWindow UnregisterClassW FindWindowA GetClassInfoExW KillTimer PostMessageW SendMessageW FindWindowExA LoadCursorW GetAsyncKeyState IsWindow ShowWindow RegisterClassExW SetWindowTextW SetWindowPos CallWindowProcW GetMessagePos wsprintfW GetKeyState EnumDisplayDevicesW SendMessageTimeoutW GetForegroundWindow GetClassNameW GetWindowTextW MessageBoxW

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptReleaseContext CryptDestroyKey CryptAcquireContextA CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyExW CryptGenRandom

shell32

SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

powrprof

CallNtPowerInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=608, id=1, productName=Unmarked objects,

count=112, id=260, version=27034,

count=38, id=265, version=27054,

count=1, id=261, version=35219,

count=15, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,