2026-11-01_bce84cb34394f4aa6739caf87c1f31bf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bce84cb34394f4aa6739caf87c1f31bf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.3MB
Sample261102-l8llrasvhs
SHA256 d0b9aec1958d465abb52224835d6121c59ea6b18d5dd7704a37ba9165498be18
MD5 bce84cb34394f4aa6739caf87c1f31bf
SHA1 f558ddc5f960fafe776511d752c74439c8747abb
SHA512 16b8121304162d79d79f8676f187e42bf02cbe58e4a8db998a095d573ffa01cb444241b31971148cb82a6b71d58830a6539e71acf013fef1a7797fc25187f4c6
SSDEEP 49152:1y5UR3VIUJNRojcbNncZI/uEFSZzhj3v1/E:85q3VI+NJCzJF3VE
TLSH
T10AB5BF117A91C272E2B1063065795FB6947D7D38AF3086CBA3D00B6A95307E2F935F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bce84cb34394f4aa6739caf87c1f31bf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-11-01_bce84cb34394f4aa6739caf87c1f31bf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.3MB

2026-11-01_bce84cb34394f4aa6739caf87c1f31bf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 44b79669f625799124b126e5e997a6a0
SHA256 d0b9aec1958d465abb52224835d6121c59ea6b18d5dd7704a37ba9165498be18
MD5 bce84cb34394f4aa6739caf87c1f31bf
SHA1 f558ddc5f960fafe776511d752c74439c8747abb
SHA512 16b8121304162d79d79f8676f187e42bf02cbe58e4a8db998a095d573ffa01cb444241b31971148cb82a6b71d58830a6539e71acf013fef1a7797fc25187f4c6
SSDEEP 49152:1y5UR3VIUJNRojcbNncZI/uEFSZzhj3v1/E:85q3VI+NJCzJF3VE
TLSH
T10AB5BF117A91C272E2B1063065795FB6947D7D38AF3086CBA3D00B6A95307E2F935F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

942936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\360cssdk\StatisticalSDK\StatisticalSDK\Release\cssdk.pdb

wininet

FtpOpenFileW InternetSetStatusCallbackW InternetWriteFile InternetGetLastResponseInfoW InternetErrorDlg HttpQueryInfoA InternetSetOptionA HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW InternetSetOptionW InternetQueryOptionW InternetCrackUrlW FtpGetFileSize HttpEndRequestW InternetReadFileExA HttpSendRequestW HttpSendRequestExW FtpCommandW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

Netbios

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathAppendW PathAddBackslashW PathGetDriveNumberW SHGetValueA SHGetValueW PathCanonicalizeW PathIsRelativeW SHSetValueW StrStrIW PathIsRootW PathRemoveBackslashW PathCombineW PathFindFileNameA

ws2_32

WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents send WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAStartup WSACleanup accept htonl listen recvfrom freeaddrinfo sendto ioctlsocket getaddrinfo WSASetLastError gethostname select __WSAFDIsSet WSACloseEvent closesocket

wldap32

ord30 ord79 ord35 ord33 ord32 ord27 ord301 ord22 ord41 ord211 ord46 ord217 ord143 ord50 ord60 ord26 ord200 ord45

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptMsgClose CryptQueryObject CryptMsgGetParam CertCloseStore CertGetNameStringW CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertEnumCertificatesInStore

powrprof

CallNtPowerInformation

kernel32

TryEnterCriticalSection TlsGetValue GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache UnhandledExceptionFilter GetStartupInfoW SignalObjectAndWait SetThreadPriority GetThreadPriority ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW FindFirstFileW GetTempPathW AreFileApisANSI RaiseException GetLastError SetLastError QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject SleepEx WaitForSingleObjectEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects CreateWaitableTimerW GetCurrentProcess ChangeTimerQueueTimer TerminateProcess SwitchToThread CreateThread GetCurrentThreadId CreateProcessW GetThreadTimes IsProcessorFeaturePresent GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW LockResource GetExitCodeProcess DeleteCriticalSection LoadResource SizeofResource FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW FindResourceW DeviceIoControl lstrcmpA lstrcmpiA GetSystemWow64DirectoryW RemoveDirectoryW GetFullPathNameW DeleteFileW CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW GetPrivateProfileIntW CreateDirectoryW GetFileSizeEx FindNextFileW FindClose GetFileAttributesW SetFileAttributesW lstrcmpW lstrlenW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetModuleHandleA GetDiskFreeSpaceExW MoveFileW GetPrivateProfileStringW GetTempFileNameW WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW SetUnhandledExceptionFilter GetProcessHeap TlsSetValue SetEndOfFile CancelWaitableTimer TlsAlloc TlsFree IsBadReadPtr QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GetCurrentProcessId IsBadWritePtr

user32

DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage CreateWindowExW DestroyWindow SetTimer GetSystemMetrics GetDC ReleaseDC GetWindowRect WindowFromPoint GetWindowLongW SetWindowLongW FindWindowW FindWindowExW GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW IsWindow IsWindowVisible IntersectRect GetDesktopWindow FindWindowA TranslateMessage GetMessageW BringWindowToTop GetKeyState KillTimer FindWindowExA LoadCursorW PostThreadMessageW EnumDisplayDevicesW SendMessageTimeoutW GetLastInputInfo GetForegroundWindow GetWindowTextW GetClassNameW SetWindowTextW wsprintfW MessageBoxW GetAsyncKeyState ShowWindow SetWindowPos GetMessagePos SetForegroundWindow

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptReleaseContext CryptDestroyKey CryptAcquireContextA CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyExW CryptGenRandom

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW SHGetFolderPathW ShellExecuteW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wintrust

WinVerifyTrust

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=614, id=1, productName=Unmarked objects,

count=112, id=260, version=27034,

count=36, id=265, version=27054,

count=1, id=261, version=35219,

count=21, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,