2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom
Size 5.5MB
Sample260511-d45vtsd19q
SHA256 e300dcc838fefa9abadbda12af853a0b83a0927a027d16065c54961766d27eca
MD5 3feae916b8091362ebf5efda73b87621
SHA1 4553a25ea2f2793355eeb9a490f99e72743a85fa
SHA512 bff8d0c8331e2d058506e0d293849d588dba33a84b3e80c979bdb54f1131a369a0596cffe79c29c28da1417b5f1a84df54315357e92cec1a42ccc7ccfa7cc03e
SSDEEP 98304:8tX28DwStyL/owSpO27bMz49JOrLhPGnxXjqpP4ox+X7BrWc8WboB1fJ4k:8w8DbyL/vmO27bMseymbjc8mOfJ4
TLSH
T18F46BF217641C172E99201B1A67CABFE497DA9311B2A54CBF3D41F6E19306C23F3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom

File Explorer

2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom

.exe 5.5MB

2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom

IMPHASH 68a94defaf7fbd32d630ee7b51f69373
SHA256 e300dcc838fefa9abadbda12af853a0b83a0927a027d16065c54961766d27eca
MD5 3feae916b8091362ebf5efda73b87621
SHA1 4553a25ea2f2793355eeb9a490f99e72743a85fa
SHA512 bff8d0c8331e2d058506e0d293849d588dba33a84b3e80c979bdb54f1131a369a0596cffe79c29c28da1417b5f1a84df54315357e92cec1a42ccc7ccfa7cc03e
SSDEEP 98304:8tX28DwStyL/owSpO27bMz49JOrLhPGnxXjqpP4ox+X7BrWc8WboB1fJ4k:8w8DbyL/vmO27bMseymbjc8mOfJ4
TLSH
T18F46BF217641C172E99201B1A67CABFE497DA9311B2A54CBF3D41F6E19306C23F3A727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2750693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\userNetSchedule.pdb

wininet

HttpSendRequestExW HttpQueryInfoW HttpQueryInfoA InternetConnectW HttpSendRequestW HttpOpenRequestW InternetGetConnectedState InternetCrackUrlA InternetWriteFile HttpOpenRequestA InternetCanonicalizeUrlW HttpAddRequestHeadersA InternetConnectA InternetReadFile HttpAddRequestHeadersW HttpEndRequestW InternetSetOptionW InternetCloseHandle InternetOpenW InternetQueryOptionW

kernel32

GetSystemDirectoryW LocalAlloc ReleaseMutex OpenMutexW GetCurrentDirectoryW OutputDebugStringA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VerSetConditionMask LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW OpenFileMappingW MoveFileExW CopyFileW SetFileAttributesW GetTempFileNameW GetCurrentThreadId GetLocalTime GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW GetModuleHandleA LoadLibraryA DeleteFileA AreFileApisANSI HeapCompact UnlockFile CreateFileMappingA LocalFree LockFileEx GetFileSize SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime ReadFile GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CloseHandle WaitForSingleObject GetModuleHandleW GetProcAddress GetSystemInfo Sleep GetDiskFreeSpaceExW FindClose FindNextFileW FindFirstFileW DeleteFileW GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW GetStartupInfoW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree CreateFileA SwitchToThread GetEnvironmentVariableW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage HeapCreate GetFullPathNameW WriteFile LoadLibraryW GetDiskFreeSpaceW SetLastError EnumSystemLocalesW ReadConsoleA SetConsoleMode ConvertFiberToThread GetUserDefaultLCID DeleteFiber VerifyVersionInfoW ReleaseSRWLockExclusive IsDebuggerPresent GetCurrentProcess DuplicateHandle RaiseException CreateThread GetCommandLineW SetPriorityClass TerminateProcess OpenProcess GetExitCodeProcess TryAcquireSRWLockExclusive AcquireSRWLockExclusive VirtualFree VirtualAlloc VirtualQuery TlsGetValue GetProcessId FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetFileSizeEx GetFileInformationByHandle SetFilePointerEx TlsSetValue TlsAlloc TlsFree CreateDirectoryW RemoveDirectoryW GetVersionExW GetNativeSystemInfo SetUnhandledExceptionFilter FindFirstFileExW CreateEventW SetEvent ResetEvent IsValidLocale GetQueuedCompletionStatus CreateIoCompletionPort ExitThread GlobalFree lstrlenW CreateProcessW GetFileTime OpenEventW LoadLibraryExW GetWindowsDirectoryW WaitForSingleObjectEx TransactNamedPipe SetNamedPipeHandleState WaitNamedPipeW lstrcatW lstrcpyW GetStringTypeW InitializeSRWLock GetExitCodeThread InitOnceBeginInitialize InitOnceComplete CompareStringEx InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead RtlUnwind ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SetEnvironmentVariableW GetFileType PeekNamedPipe GetConsoleMode ReadConsoleW GetConsoleOutputCP ExitProcess SetStdHandle GetTimeZoneInformation GetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

user32

SetRectEmpty wsprintfW wvsprintfW GetProcessWindowStation GetUserObjectInformationW FindWindowW GetSystemMetrics LoadIconW CreateWindowExW DestroyWindow PostMessageW MessageBoxW

advapi32

CryptReleaseContext CryptEncrypt CryptDestroyKey CryptSetKeyParam CryptDecrypt CryptAcquireContextW GetTokenInformation OpenProcessToken RegSetValueExW RegOpenKeyW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW SetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW SetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorSacl GetLengthSid AddAccessAllowedAceEx RegCloseKey RegOpenKeyExW RegQueryValueExW LookupAccountSidW DeregisterEventSource RegisterEventSourceW ReportEventW CryptImportKey

shell32

SHGetFolderPathW ShellExecuteW SHFileOperationW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW SHGetKnownFolderPath

ole32

CoCreateGuid StringFromCLSID CoTaskMemFree

imm32

ImmDisableIME

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

shlwapi

PathMatchSpecW

ws2_32

closesocket WSASetLastError send recv WSAGetLastError WSACleanup

winmm

timeGetTime

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpQueryOption WinHttpOpenRequest WinHttpConnect WinHttpSetTimeouts WinHttpOpen WinHttpWriteData WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpGetProxyForUrl WinHttpCrackUrl WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertGetCertificateContextProperty CertCloseStore CertOpenStore CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_3feae916b8091362ebf5efda73b87621_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_royal-ransom

wininet

kernel32

user32

advapi32

shell32

ole32

imm32

version

psapi

shlwapi

ws2_32

winmm

winhttp

crypt32

bcrypt

generic