2026-07-02_098184f7862c554c4a849a5f3940d5ad_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_098184f7862c554c4a849a5f3940d5ad_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader
Size 4.0MB
Sample260702-qzcppsft8x
SHA256 d0ee890ea50dbb539da2ece17dd162415aed8d0e36ad573b655f9b32b45f5707
MD5 098184f7862c554c4a849a5f3940d5ad
SHA1 5abf83bde10b2e0bcffe052086518ab195ce0a3f
SHA512 d29d433e017be5bd1979ac581f3834e5fb924b960825ad686830a961f6156240513d50ac11e882136016e7705528d9f7cebd03f81e4a4df7106cd6676fbca941
SSDEEP 49152:RMwt+aHYjLOq0k3cLQIDqTWb1pb0f9z5g/T8TKJP5zzH3ET1Qn2gmPu6:RMwlLQIHb0fx5oTFb3sy
TLSH
T18716AE21F761C121E4D305790ABAA73E59387F2C8BA4A1C38BD87D5F89326C3753635A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_098184f7862c554c4a849a5f3940d5ad_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

File Explorer

2026-07-02_098184f7862c554c4a849a5f3940d5ad_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

.exe 4.0MB

2026-07-02_098184f7862c554c4a849a5f3940d5ad_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

IMPHASH 6e326fbca4ca33a83291bae5f5148fa2
SHA256 d0ee890ea50dbb539da2ece17dd162415aed8d0e36ad573b655f9b32b45f5707
MD5 098184f7862c554c4a849a5f3940d5ad
SHA1 5abf83bde10b2e0bcffe052086518ab195ce0a3f
SHA512 d29d433e017be5bd1979ac581f3834e5fb924b960825ad686830a961f6156240513d50ac11e882136016e7705528d9f7cebd03f81e4a4df7106cd6676fbca941
SSDEEP 49152:RMwt+aHYjLOq0k3cLQIDqTWb1pb0f9z5g/T8TKJP5zzH3ET1Qn2gmPu6:RMwlLQIHb0fx5oTFb3sy
TLSH
T18716AE21F761C121E4D305790ABAA73E59387F2C8BA4A1C38BD87D5F89326C3753635A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2269419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\release-reflect-x\Release\x86\Working\Rescue\PEScreenshots.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

mpr

WNetGetUserW WNetGetUniversalNameW WNetCloseEnum WNetEnumResourceW WNetOpenEnumW WNetGetConnectionW WNetCancelConnection2W WNetAddConnection3W

ws2_32

send recv WSASetLastError getservbyname getservbyport closesocket htons inet_addr inet_ntoa WSAStartup WSACleanup WSAAddressToStringW WSAStringToAddressW getnameinfo shutdown socket setsockopt ioctlsocket getsockopt ntohs select gethostbyname WSAGetLastError htonl connect gethostbyaddr

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

kernel32

GetModuleHandleA GlobalLock GlobalUnlock GlobalDeleteAtom lstrcmpA lstrcmpW GlobalGetAtomNameW EncodePointer CompareStringW SetThreadPriority SuspendThread ResumeThread GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetFileSize GetFullPathNameW LockFile SetEndOfFile SetFilePointer UnlockFile FileTimeToLocalFileTime GetFileTime InitializeCriticalSection GlobalReAlloc GlobalHandle LocalReAlloc GetCurrentDirectoryW GetSystemDefaultUILanguage GlobalFlags SetErrorMode GetSystemTimeAsFileTime WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW ReadConsoleW LoadLibraryExW OutputDebugStringW GetStringTypeW SwitchToThread GetExitCodeThread TryEnterCriticalSection GetCPInfo LCMapStringW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList WriteConsoleW ExitProcess SetConsoleCtrlHandler GetFileInformationByHandle PeekNamedPipe GetCommandLineA GetCommandLineW ExitThread FreeLibraryAndExitThread SetStdHandle HeapQueryInformation GetConsoleCP IsValidLocale EnumSystemLocalesW IsValidCodePage GetOEMCP GetTimeZoneInformation FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject FormatMessageA LoadLibraryA GetSystemDirectoryA VirtualProtect GetModuleHandleExW GetEnvironmentVariableW GetFileType GetStdHandle TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetFileAttributesExW ExpandEnvironmentStringsW ReadConsoleA SetEvent VirtualFree VirtualAlloc OutputDebugStringA DuplicateHandle CreateSemaphoreW WaitForMultipleObjects ReleaseSemaphore InitializeCriticalSectionAndSpinCount GetTempFileNameW GlobalFindAtomW GlobalAddAtomW MoveFileExW GetSystemTime GetComputerNameW CreateEventW OpenMutexW GetLocalTime GetACP DeleteVolumeMountPointW SetVolumeMountPointW FindVolumeMountPointClose FindNextVolumeMountPointW FindFirstVolumeMountPointW CopyFileW CompareFileTime WaitForSingleObject TerminateThread CreateThread OpenProcess GetProcessTimes FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemDefaultLCID GetLocaleInfoA DeleteFileW GetTempPathW GetUserDefaultLCID GetUserDefaultUILanguage SetThreadLocale GetThreadLocale EnumDateFormatsExW GetDateFormatW UnregisterWait GetThreadTimes InterlockedPopEntrySList GetTimeFormatW GetLocaleInfoW SetConsoleMode WideCharToMultiByte MultiByteToWideChar ProcessIdToSessionId GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW FindVolumeClose FindNextVolumeW FindFirstVolumeW VerifyVersionInfoW GetVersionExW DnsHostnameToComputerNameW GetComputerNameExW GetConsoleMode SetPriorityClass GetVolumeInformationW MoveFileW FindNextFileW FindFirstFileW GetFileAttributesW SetFileAttributesW QueryDosDeviceW RemoveDirectoryW CreateDirectoryW GetDiskFreeSpaceExW GetWindowsDirectoryW GetSystemDirectoryW GetDriveTypeW FindResourceW GetFirmwareEnvironmentVariableA CreateProcessW GetModuleHandleW GetModuleFileNameW LoadLibraryW CreateMutexW lstrlenW GetTickCount FindClose SetFilePointerEx DeviceIoControl FlushFileBuffers ReadFile GetFileSizeEx SizeofResource LoadResource Sleep SetLastError SetThreadExecutionState GetCurrentThread GetExitCodeProcess GetCurrentProcessId GetCurrentProcess LocalFree GetVersion GetProcAddress FreeLibrary LockResource VerSetConditionMask GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree CloseHandle WriteFile CreateFileW GlobalFree GlobalAlloc LocalAlloc FormatMessageW GetLastError QueryDepthSList UnregisterWaitEx ResetEvent

user32

IsMenu GetClassInfoExW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW ReuseDDElParam UnpackDDElParam WinHelpW LoadIconW GetWindow GetLastActivePopup GetWindowThreadProcessId GetClassNameW SetWindowLongW GetWindowLongW EqualRect IntersectRect CopyRect GetSysColor SetCursor InvalidateRect SetActiveWindow UpdateWindow InsertMenuItemW DestroyMenu CreatePopupMenu SetMenu GetMenu LoadMenuW TranslateAcceleratorW LoadAcceleratorsW IsWindowEnabled EnableWindow ReleaseCapture GetPropW RemovePropW GetWindowTextW GetWindowRect AdjustWindowRectEx CheckMenuItem ScreenToClient MapWindowPoints PtInRect GetClassLongW GetTopWindow SetWindowsHookExW GetFocus GetCapture GetKeyState SetFocus GetDlgCtrlID GetDlgItem BringWindowToTop TrackPopupMenu GetForegroundWindow BeginPaint EndPaint ValidateRect RedrawWindow GetScrollPos IsIconic IsWindowVisible SetWindowPos ShowWindow IsWindow GetClassInfoW SendMessageW PostQuitMessage BeginDeferWindowPos GetMenuItemID GetSubMenu GetParent OffsetRect SetRectEmpty GetClientRect GetUserObjectInformationW GetProcessWindowStation SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount SystemParametersInfoW EnumDisplaySettingsW LoadStringW MsgWaitForMultipleObjectsEx GetActiveWindow SendMessageTimeoutW UnhookWindowsHookEx CallNextHookEx MonitorFromWindow GetMonitorInfoW EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW SetWindowTextW GetMessageW GetCursorPos ShowOwnedPopups CharUpperW GetSysColorBrush LoadCursorW ClientToScreen RealChildWindowFromPoint SetTimer KillTimer DrawTextW DrawTextExW GrayStringW TabbedTextOutW GetWindowDC FillRect InflateRect PeekMessageW DispatchMessageW TranslateMessage UnregisterClassW RegisterHotKey DestroyWindow DeferWindowPos EndDeferWindowPos SetForegroundWindow CreateWindowExW ReleaseDC GetDC GetDesktopWindow GetSystemMetrics MessageBoxW PostMessageW SetPropW

gdi32

SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx CreateFontIndirectW GetTextExtentPoint32W ExtTextOutW TextOutW SetMapMode SetBkMode SaveDC RestoreDC RectVisible PtVisible GetObjectW GetDIBits CreateCompatibleDC CreateCompatibleBitmap GetStockObject BitBlt DeleteDC DeleteObject GetDeviceCaps SetBkColor SetTextColor CreateBitmap CreatePatternBrush CreateSolidBrush Escape GetClipBox ScaleWindowExtEx SelectObject GetPixel

comdlg32

GetSaveFileNameW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

ConvertStringSidToSidW OpenThreadToken GetTokenInformation AdjustTokenPrivileges AllocateAndInitializeSid FreeSid RegQueryValueW RegEnumKeyW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ImpersonateAnonymousToken ImpersonateLoggedOnUser SetThreadToken RevertToSelf RegQueryInfoKeyW OpenProcessToken ReportEventW RegisterEventSourceW DeregisterEventSource LogonUserW ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW SetEntriesInAclW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegUnLoadKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegLoadKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW LookupAccountSidW

shell32

DragFinish DragQueryFileW ShellExecuteW SHFileOperationW SHChangeNotify SHGetFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHCreateDirectoryExW

comctl32

ord329 ord334 ord332 ord338 ord328

shlwapi

UrlUnescapeW PathStripToRootW PathIsUNCW PathFindFileNameW PathAppendW PathMatchSpecW PathFindExtensionW PathIsNetworkPathW PathFileExistsW

ole32

StringFromGUID2 CoTaskMemFree CoCreateGuid CoInitialize CoCreateInstance CLSIDFromString CoUninitialize

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayAccessData SafeArrayUnaccessData GetErrorInfo VariantTimeToSystemTime VariantInit VariantClear VariantChangeType SysAllocString

setupapi

SetupDiGetClassDevsW CM_Get_Parent CM_Get_Device_ID_ListW SetupDiGetDeviceInterfaceDetailW CM_Get_Device_Interface_ListW CM_Locate_DevNodeW CM_Get_Device_IDW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces CM_Get_Device_ID_List_SizeW

ntdll

RtlInitUnicodeString NtClose NtCreateFile

winhttp

WinHttpGetIEProxyConfigForCurrentUser

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData

oleacc

CreateStdAccessibleObject LresultFromObject

wininet

HttpAddRequestHeadersW HttpSendRequestW HttpSendRequestExW HttpEndRequestW HttpQueryInfoW HttpOpenRequestW InternetSetStatusCallbackW InternetGetLastResponseInfoW InternetQueryDataAvailable InternetWriteFile InternetSetFilePointer InternetReadFile InternetSetOptionW InternetCrackUrlW InternetCanonicalizeUrlW InternetOpenW InternetCloseHandle InternetConnectW

netapi32

NetServerGetInfo NetShareGetInfo NetApiBufferFree

iphlpapi

GetBestInterfaceEx GetAdaptersInfo GetAdaptersAddresses GetIpAddrTable GetTcpTable

generic

count=22, id=259, version=26213,

count=215, id=261, version=26213,

count=23, id=260, version=26213,

count=2, id=257, version=26213,

count=1, id=150, version=20413,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=38, id=260, version=26706,

count=28, id=259, version=26706,

count=214, id=261, version=26706,

count=1, id=260, version=27054,

count=8, id=260, version=27048,

count=698, id=260, version=27050,

count=23, productName=Unmarked objects (old),

count=28, id=261, version=27054,

count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=826, id=1, productName=Unmarked objects,

count=18, id=265, version=27054,

count=1, id=255, version=27054,

count=5, id=151,

count=1, id=258, version=27054,