General
- Target 2026-07-03_59dfaed7e71ae98d1966c49927c6c88f_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
- Size 8.1MB
- Sample260703-l6ds5ae17t
- SHA256 f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94
- MD5 59dfaed7e71ae98d1966c49927c6c88f
- SHA1 73ac9efed2d998759f1c2b26d7c18edb82410ee6
- SHA512 10e4ca829be60ee316d02c0f12459f4d284a31464b64c7f7a696bffbebf7d2a8e9b5e15466943569738c8a1cd63a55a76c753e7a8045257b2f480e505efb31da
- SSDEEP 98304:M1Lz1E9uK0d1xASmLTaT4lwvLDjRx7GFOHwjjBi:O5E9uK0d1xASmLTrlwxwjjBi
- TLSH T14A869E11E943CED7E77909BA52A8CEECF1A6B6D093D9E1FB118034B4C415FF0687264A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_59dfaed7e71ae98d1966c49927c6c88f_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_59dfaed7e71ae98d1966c49927c6c88f_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
Resource
win11ltsc2024-20260630-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_59dfaed7e71ae98d1966c49927c6c88f_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
- Size 8.1MB
- SHA256 f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94
- MD5 59dfaed7e71ae98d1966c49927c6c88f
- SHA1 73ac9efed2d998759f1c2b26d7c18edb82410ee6
- SHA512 10e4ca829be60ee316d02c0f12459f4d284a31464b64c7f7a696bffbebf7d2a8e9b5e15466943569738c8a1cd63a55a76c753e7a8045257b2f480e505efb31da
- SSDEEP 98304:M1Lz1E9uK0d1xASmLTaT4lwvLDjRx7GFOHwjjBi:O5E9uK0d1xASmLTrlwxwjjBi
- TLSH T14A869E11E943CED7E77909BA52A8CEECF1A6B6D093D9E1FB118034B4C415FF0687264A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL