2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil
Size 3.0MB
Sample260703-rhdfcaax2s
SHA256 2320622c336a67606b840e6a35d554db79b4f992cb5274b9e730954e751ec3d6
MD5 6b5dd2e1e5b6a74e499cd65434186daa
SHA1 3d264542b2af507d9b261365f35dd6100cf1a726
SHA512 16f2eded02b79a1c8cf1f8f73e52d3ecfa24592aabcc36df68787199974229fcbccd34af5778e581b16d6e9cd02046ee66c9d699a8b866d34afa90608c64de3b
SSDEEP 98304:1gsoKuxSBdKrvYYxhaXimIzsqzE4ZweGib:1AKuxSBIrwYLYisYZwE
TLSH
T1B8E5AD12FE008572E4920171E2AE4FB69C3CAE28133855D7A6D179784A353E3BB3975F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

.exe 3.0MB

2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 880db6f0d18830f9b8984f475a642a5a
SHA256 2320622c336a67606b840e6a35d554db79b4f992cb5274b9e730954e751ec3d6
MD5 6b5dd2e1e5b6a74e499cd65434186daa
SHA1 3d264542b2af507d9b261365f35dd6100cf1a726
SHA512 16f2eded02b79a1c8cf1f8f73e52d3ecfa24592aabcc36df68787199974229fcbccd34af5778e581b16d6e9cd02046ee66c9d699a8b866d34afa90608c64de3b
SSDEEP 98304:1gsoKuxSBdKrvYYxhaXimIzsqzE4ZweGib:1AKuxSBIrwYLYisYZwE
TLSH
T1B8E5AD12FE008572E4920171E2AE4FB69C3CAE28133855D7A6D179784A353E3BB3975F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f9:e6:79:65:26:0d:9f:e4:7c:cb:20:81:10:cc:60:8c:42:b4:56:47:a9:0a:8e:32:c0:32:9a:00:17:97:f1:61

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Chains

Jan 1, 0001

PE Signature issue

Digest

63:b3:36:4d:db:7b:b0:f5:05:98:d5:a4:1f:59:0c:5e:0f:79:24:3e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Chains

Jan 1, 0001

Subject

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Serial Number

36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Serial Number

e3:09:72:a2:2b:64:a6:6c:89:0e:05:e9:98:cd:8a:e2

Issuer

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 27, 2024 - Nov 27, 2027

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Serial Number

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 28, 2023 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2115871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

getnameinfo gethostname ioctlsocket sendto recvfrom freeaddrinfo send listen htonl accept select __WSAFDIsSet WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getaddrinfo shutdown

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext

wldap32

ord41 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord145 ord208 ord216 ord219 ord46 ord14

psapi

GetModuleBaseNameW EnumProcesses

kernel32

GetUserDefaultLCID FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetFileAttributesW CreateThread TerminateThread LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar RaiseException GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep GetCurrentThreadId GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock MulDiv lstrcmpW GetTempPathW CloseHandle GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW WriteConsoleW GetCurrentProcessId TerminateProcess OpenProcess LocalFree FormatMessageW WideCharToMultiByte IsBadWritePtr GetSystemTime WaitForSingleObject GetExitCodeProcess FindResourceExW GlobalHandle GlobalFree DecodePointer CreateMutexW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW lstrcmpiW SetFilePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetSystemDirectoryW LoadLibraryW QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask GetModuleHandleA VerifyVersionInfoW SetConsoleMode GetEnvironmentVariableW ReadConsoleA GetConsoleMode ReadConsoleW TlsSetValue TlsAlloc TlsGetValue TlsFree GetModuleHandleExW DeleteFiber SwitchToFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryA SystemTimeToFileTime SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead SetEnvironmentVariableW GetTimeZoneInformation OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread SetFilePointerEx SetConsoleCtrlHandler EnumSystemLocalesW ExitProcess GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW WriteFile IsValidLocale

user32

TranslateMessage DispatchMessageW GetProcessWindowStation GetUserObjectInformationW CreateDialogIndirectParamW FillRect GetSysColor ScreenToClient ClientToScreen SetWindowContextHelpId GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetMessageW MapWindowPoints CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem EndDialog SetWindowPos MoveWindow PostThreadMessageW IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW GetMonitorInfoW MonitorFromWindow IsDialogMessageW PostQuitMessage RegisterWindowMessageW PeekMessageW LoadIconW GetWindowRect DestroyAcceleratorTable MessageBoxW SetForegroundWindow ShowWindow MapDialogRect LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow KillTimer SetWindowLongW GetDC GetWindowLongW DestroyWindow

gdi32

DeleteDC DeleteObject GetObjectW GetDeviceCaps GetStockObject SelectObject CreateCompatibleBitmap CreateSolidBrush CreateCompatibleDC BitBlt

advapi32

CryptSignHashW CryptSetHashParam CryptDestroyHash CryptDestroyKey CryptGetUserKey CryptAcquireContextW CryptEnumProvidersW CryptDecrypt CryptExportKey RegCloseKey RegCreateKeyExW RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW ReportEventW RegisterEventSourceW DeregisterEventSource CryptReleaseContext CryptGetProvParam CryptCreateHash

shell32

ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize OleLockRunning OleUninitialize OleInitialize CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CreateStreamOnHGlobal CoTaskMemFree

oleaut32

SysAllocStringLen VarUI4FromStr DispCallFunc OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantChangeType VariantClear SysStringByteLen VariantInit SysFreeString SysAllocStringByteLen

comctl32

InitCommonControlsEx

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_6b5dd2e1e5b6a74e499cd65434186daa_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

PE Signature issue

PE Signature issue

ws2_32

crypt32

wldap32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

generic