2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat

General

Target
2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat
Size 7.7MB
Sample261113-vbvylays2q
SHA256 662d7c75602d5a26df12da5c653a4474ecf4edbc426fd3e850801924af279747
MD5 171e9bd22230c670ef6973e171799631
SHA1 836fa23cd7c62d956df0dd917259ae8c6eccd4dc
SHA512 74db12541399592afe49c2f4ec55b06e25cd628cd23f00b9868cd1853aeccd534366b6081770ef2323e8a876dd671d82f774d0f55926661734e2818a1c036294
SSDEEP 196608:9Xw+odl0tO71sn/1VzsEUxZP1seMpGuLCJIHxl74msvdVQBWG:S+2yOO9atxZt8l71B
TLSH
T1E3868C23ABD4C436F1B63A306E7DA75E40BBFA7138B0801F63D4154DDAB098295E57A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat

.exe 7.7MB

2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH e130bdf47c33964ed16106de28727f6d
SHA256 662d7c75602d5a26df12da5c653a4474ecf4edbc426fd3e850801924af279747
MD5 171e9bd22230c670ef6973e171799631
SHA1 836fa23cd7c62d956df0dd917259ae8c6eccd4dc
SHA512 74db12541399592afe49c2f4ec55b06e25cd628cd23f00b9868cd1853aeccd534366b6081770ef2323e8a876dd671d82f774d0f55926661734e2818a1c036294
SSDEEP 196608:9Xw+odl0tO71sn/1VzsEUxZP1seMpGuLCJIHxl74msvdVQBWG:S+2yOO9atxZt8l71B
TLSH
T1E3868C23ABD4C436F1B63A306E7DA75E40BBFA7138B0801F63D4154DDAB098295E57A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4278116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupBootstrapper.pdb

oleaut32

GetErrorInfo SysStringLen SysAllocString VariantClear VariantInit SysFreeString SetErrorInfo

kernel32

SetWaitableTimerEx VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle CompareStringW VirtualProtect EnumSystemLocalesW GetOEMCP CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy GetFileAttributesExW CreateEventExW WriteFile DeleteFileW WideCharToMultiByte IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName FlsFree FlsAlloc AttachConsole AllocConsole GetStdHandle FreeConsole LocaleNameToLCID FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FormatMessageA GetSystemTimeAsFileTime GetTickCount64 K32GetProcessMemoryInfo GlobalMemoryStatusEx OpenProcess IsValidCodePage GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW RaiseException LoadLibraryExW GetVersionExW GetExitCodeProcess GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation GetSystemDirectoryW HeapAlloc GetTempPathW CreateDirectoryW SetFileAttributesW OpenEventW CreateMutexExW OpenMutexW WaitForSingleObjectEx ReleaseMutex ReleaseSemaphore SetEvent CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent EnterCriticalSection LeaveCriticalSection GetLongPathNameW GetFinalPathNameByHandleW TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime IsDebuggerPresent FindFirstFileExW MoveFileExW FindNextFileW RemoveDirectoryW ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle WaitForMultipleObjects K32EnumProcessModulesEx RtlCaptureStackBackTrace GetFileType SetFilePointer GetOverlappedResult GetFileAttributesW GetFileTime QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW ExitProcess CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetTickCount InitOnceExecuteOnce GetCurrentThread OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc GetSystemPowerStatus GetTimeZoneInformation AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile GetPhysicallyInstalledSystemMemory GetProductInfo WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic InitializeCriticalSectionAndSpinCount FindFirstFileW GetThreadLocale lstrcmpW CopyFileW ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW PeekNamedPipe CreatePipe SetHandleInformation GetPriorityClass K32EnumProcesses IsValidLocale GetSystemDefaultLocaleName GetUserGeoID GetLocaleInfoEx LCIDToLocaleName LCMapStringEx GetSystemDefaultLCID ResolveLocaleName EnumSystemLocalesEx LoadLibraryExA LockResource GetLocaleInfoW GetUserPreferredUILanguages GetACP SwitchToThread GetConsoleOutputCP ReadConsoleW GetDriveTypeW GetTimeFormatW GetDateFormatW K32GetProcessImageFileNameW GetSystemPreferredUILanguages TryAcquireSRWLockExclusive GetStringTypeW GetFileInformationByHandle CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete IsProcessorFeaturePresent EncodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwind CreateTimerQueueTimer DeleteTimerQueueTimer GetThreadTimes FreeLibraryAndExitThread ExitThread GetConsoleMode GetLocalTime

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

190KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

944KB

Virtual Size

948KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat

oleaut32

kernel32

generic