2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader
Size 2.1MB
Sample260701-e2s9pags8t
SHA256 ae72f68d62008bbf1cfad7d7141dfef4483d60fdb0cfe6213589c3104bd51dfc
MD5 6f9463d0d62b4485daa68e1e64f2c5ff
SHA1 5bbfe8b5f63ed2eaad92fd57db0e27c785a8442f
SHA512 2a73f446a3dd3a6efa151d30b15b82c57b3c860a3638b77affd7fe054d44505eee8566dbe86c44f9372f382ff1973e75d984045198caeb15b0c72dadc26a4b00
SSDEEP 49152:eaXFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedp:ekFYqhzhhVZO0Vuh1oh
TLSH
T17AA5AE02FBC295B2E587057A226B573F4D3AAE205324C9D3D7D129758D302D1AA3F3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 2.1MB

2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 4d86dd54927373b10420f6f7190c002d
SHA256 ae72f68d62008bbf1cfad7d7141dfef4483d60fdb0cfe6213589c3104bd51dfc
MD5 6f9463d0d62b4485daa68e1e64f2c5ff
SHA1 5bbfe8b5f63ed2eaad92fd57db0e27c785a8442f
SHA512 2a73f446a3dd3a6efa151d30b15b82c57b3c860a3638b77affd7fe054d44505eee8566dbe86c44f9372f382ff1973e75d984045198caeb15b0c72dadc26a4b00
SSDEEP 49152:eaXFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedp:ekFYqhzhhVZO0Vuh1oh
TLSH
T17AA5AE02FBC295B2E587057A226B573F4D3AAE205324C9D3D7D129758D302D1AA3F3E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2244608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\kdumprepn.pdb

kernel32

MultiByteToWideChar LockResource FindResourceExW LoadResource FindResourceW WideCharToMultiByte FindClose CreateFileMappingW MapViewOfFile UnmapViewOfFile FindFirstFileW FindNextFileW WritePrivateProfileStringW SetEndOfFile GetFileAttributesExW SetLastError GetFileAttributesW DeleteFileW RemoveDirectoryW InitializeCriticalSectionAndSpinCount GetTickCount GetPrivateProfileIntW OutputDebugStringW GetPrivateProfileStringW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetUserDefaultLangID GetWindowsDirectoryA WaitForSingleObject CreateThread FreeLibrary lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetCurrentThreadId LoadLibraryW GetModuleFileNameW GetFileSizeEx OpenProcess GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx GetCurrentProcessId MoveFileW GetFileInformationByHandle GetLocalTime SystemTimeToFileTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SizeofResource FlushFileBuffers GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc LCMapStringW GetLastError HeapSize LocalAlloc InitializeCriticalSectionEx WriteFile HeapFree CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread SetStdHandle ExitThread GetDriveTypeW ExitProcess RtlUnwind LoadLibraryA ConvertThreadToFiber ConvertFiberToThread WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber Sleep GetFileSize CloseHandle CreateFileW SetFilePointer GetCommandLineW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA GetConsoleOutputCP SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetStringTypeW GetCPInfo SleepEx QueryPerformanceFrequency FormatMessageW MoveFileExW CompareFileTime

user32

GetProcessWindowStation GetUserObjectInformationW CharNextW MessageBoxW GetDesktopWindow DestroyWindow

advapi32

CryptGenRandom RegCreateKeyExW RegCloseKey RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathAppendA PathFileExistsW PathFindExtensionW PathRemoveFileSpecW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dbghelp

StackWalk64 MiniDumpReadDumpStream

ws2_32

getnameinfo WSACleanup shutdown gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup __WSAFDIsSet

psapi

GetModuleFileNameExW EnumProcesses GetProcessMemoryInfo

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertCloseStore

wldap32

ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

dbghelp

ws2_32

psapi

crypt32

wldap32

generic