2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader
Size 3.6MB
Sample261104-3efbbavzg1
SHA256 4e7cc0ba0604debc2005a2e6b64239d8d375d09095d6b809a85debc25d669d71
MD5 3a7325ca5b129ee55375665ce5546d38
SHA1 90213a5f235f8aec5758c99c015e87826bc91c59
SHA512 ea289db1edbc0727767c3c5e06eb7bc6ce88b21f3274c8976f0e6a44aae113d73788a5c258061953c76a8e356b9d79f93c133c1991034a8a8512da2536f3bfa2
SSDEEP 49152:IeneOA8VhLD1J1GIYM5g6tXzOYu6RRtPwx/M5emfl1aC+DrCs2PNR5KwkufOmVRP:Ien9dlGviXtjOYuGmx/bmXt1WmVRLUQ
TLSH
T1B506D012FA4249B9EAD35174E2EF537A49396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

File Explorer

2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

.exe 3.6MB

2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

IMPHASH 42941e742f2a8ba9bf90499f83a617d8
SHA256 4e7cc0ba0604debc2005a2e6b64239d8d375d09095d6b809a85debc25d669d71
MD5 3a7325ca5b129ee55375665ce5546d38
SHA1 90213a5f235f8aec5758c99c015e87826bc91c59
SHA512 ea289db1edbc0727767c3c5e06eb7bc6ce88b21f3274c8976f0e6a44aae113d73788a5c258061953c76a8e356b9d79f93c133c1991034a8a8512da2536f3bfa2
SSDEEP 49152:IeneOA8VhLD1J1GIYM5g6tXzOYu6RRtPwx/M5emfl1aC+DrCs2PNR5KwkufOmVRP:Ien9dlGviXtjOYuGmx/bmXt1WmVRLUQ
TLSH
T1B506D012FA4249B9EAD35174E2EF537A49396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1745764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb

kernel32

GetFileSize GetFullPathNameW OutputDebugStringA SetLastError GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock LocalAlloc WTSGetActiveConsoleSessionId MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventA WideCharToMultiByte WriteConsoleW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage DecodePointer SetStdHandle GetConsoleOutputCP CreateDirectoryW GetTimeZoneInformation HeapReAlloc LCMapStringW CompareStringW HeapFree HeapAlloc ExitProcess HeapValidate ExpandEnvironmentStringsW LocalFree GetTickCount OpenProcess TerminateProcess CreateSymbolicLinkW DeviceIoControl GetConsoleWindow SetConsoleTitleW SetConsoleCtrlHandler MoveFileExW CopyFileW GetModuleHandleA Sleep CreateMutexA ReleaseMutex OutputDebugStringW WriteFile SetFilePointer SetFileAttributesW ReadFile GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCommandLineW CreateProcessW GetExitCodeProcess WaitForSingleObject CloseHandle SetCurrentDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FindResourceA LockResource LoadResource HeapSize FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetModuleHandleExW GetLocalTime UnhandledExceptionFilter InitializeCriticalSectionEx VirtualQuery EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertFiberToThread DeleteFiber GetFileType GetEnvironmentVariableW GetStdHandle LoadLibraryExA GetProcAddress FreeLibrary LoadLibraryA SetFilePointerEx GetLogicalProcessorInformationEx GetProcessHeaps QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter GetCurrentDirectoryW TlsFree TlsSetValue TlsGetValue TlsAlloc FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileSizeEx RemoveDirectoryW SetEndOfFile SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetModuleHandleW LoadLibraryExW LoadLibraryW IsDebuggerPresent GlobalMemoryStatusEx VirtualAlloc VirtualProtect IsWow64Process GetModuleFileNameA GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetSystemInfo GetProcessAffinityMask DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread TerminateThread GetExitCodeThread

user32

ShowWindow MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow MessageBoxA GetWindowTextLengthA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextA GetDlgItemInt SetDlgItemInt GetDlgItem GetWindowThreadProcessId EnumWindows GetWindowRect IsWindowVisible wsprintfA SetWindowPos DialogBoxParamA EndDialog

advapi32

QueryServiceStatusEx RegisterEventSourceW DeregisterEventSource RegCloseKey RegCreateKeyExA SetNamedSecurityInfoW RegSetValueExW RegQueryValueExW RegQueryInfoKeyA RegDeleteValueW LookupPrivilegeValueA SetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW ConvertStringSidToSidW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus SetServiceObjectSecurity RegisterServiceCtrlHandlerW ReportEventW QueryServiceStatus QueryServiceObjectSecurity OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegDeleteValueA

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

ws2_32

WSAStartup gethostname closesocket send recv WSACleanup WSAGetLastError WSASetLastError

shlwapi

SHDeleteKeyA

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_3a7325ca5b129ee55375665ce5546d38_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

psapi

bcrypt

generic