2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot
Size 4.7MB
Sample261110-3ef8lsst8q
SHA256 0ae6d288a647f8d0d05bcb6ed101a0cd872eb13cd5035e6b0ed2b220104e3a20
MD5 3004680e4cc4ac1eea5c994240b0265b
SHA1 9127b47f8cbc89b1a6a9e180c89aa13a56c6929b
SHA512 a4f84cefb6e38694ce3f848f5a637d1f2faf649b19b4fb1ef7ffcae751a04c768b2f5e701a336f143c58734d027c446b0b3806e0f347fc914f2ea9dda815e4a1
SSDEEP 98304:mJeV/ztZBem1oiImuUiK9N9EGQKF9lSHbr7axVQ:sS/h3kmg4EpbrO
TLSH
T17936C062BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

File Explorer

2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

.exe 4.7MB

2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

IMPHASH aba7499e03b82a57f9bd5a8efa8507ce
SHA256 0ae6d288a647f8d0d05bcb6ed101a0cd872eb13cd5035e6b0ed2b220104e3a20
MD5 3004680e4cc4ac1eea5c994240b0265b
SHA1 9127b47f8cbc89b1a6a9e180c89aa13a56c6929b
SHA512 a4f84cefb6e38694ce3f848f5a637d1f2faf649b19b4fb1ef7ffcae751a04c768b2f5e701a336f143c58734d027c446b0b3806e0f347fc914f2ea9dda815e4a1
SSDEEP 98304:mJeV/ztZBem1oiImuUiK9N9EGQKF9lSHbr7axVQ:sS/h3kmg4EpbrO
TLSH
T17936C062BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1364589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb

kernel32

SetLastError SystemTimeToFileTime GetSystemTime SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW ReadConsoleA WriteFile RemoveDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapAlloc HeapFree HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode PeekNamedPipe GetFileType ExitProcess InterlockedPushEntrySList RtlUnwind GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW VerifyVersionInfoW FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GetCurrentProcess GlobalAlloc SizeofResource LockResource LoadResource GetModuleFileNameW OpenProcess GetExitCodeProcess SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress Sleep GetCurrentThreadId DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA LeaveCriticalSection EnterCriticalSection GetLastError WaitForSingleObjectEx GetCPInfo ProcessIdToSessionId GetCurrentProcessId DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive OpenEventA SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SetProcessAffinityMask GetProcessHeaps SetErrorMode CloseHandle RemoveDirectoryA GetFileAttributesA MultiByteToWideChar OutputDebugStringA SystemTimeToTzSpecificLocalTime GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileW GetDateFormatW GetTimeFormatW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObject CreateEventA QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation TerminateProcess GlobalMemoryStatusEx VirtualAlloc IsDebuggerPresent GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority TerminateThread GetExitCodeThread SuspendThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadAffinityMask SetEnvironmentVariableW SetCurrentDirectoryW OutputDebugStringW CreateProcessW GetSystemInfo GetProcessAffinityMask SetUnhandledExceptionFilter DebugBreak

user32

CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW GetProcessWindowStation GetWindowThreadProcessId EnumWindows DispatchMessageW IsWindowVisible TranslateMessage GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongW SetWindowLongW GetWindowLongW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow SetTimer MsgWaitForMultipleObjects SetWindowPos MoveWindow GetMessageW ReleaseDC GetDC GetUserObjectInformationW AllowSetForegroundWindow MessageBoxA DestroyWindow ShowWindow

gdi32

AddFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject RemoveFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ReportEventW RegOpenKeyExA RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoW CommandLineToArgvW ord680 SHGetKnownFolderPath

ole32

CoTaskMemFree

oleaut32

VariantClear

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW GetModuleInformation GetProcessMemoryInfo

version

VerQueryValueW

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError WSARecv WSARecvFrom WSASend htonl WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup WSAIoctl setsockopt getsockname ioctlsocket bind send recv connect WSASendTo

wsock32

ord1142

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic