2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil
Size 3.0MB
Sample260703-rmpdeaay2w
SHA256 e6b4f2cb2e8c349335008e18c5287ea0afb2b9bfcb2f382c63122d01f8334016
MD5 53101c9dbdbf3064721914e8844ded27
SHA1 2306a2ae9e0629304ea8d5518d5d66ae06ca5359
SHA512 5695f353e1c85927e5bd319f58d3fec537088a8a4ad78b33072f5bacdec7ca4008f93c7a9b372ccf2d690b03224541d3d14a6cabb7f6530d17f55411cc1d9b8a
SSDEEP 98304:lgsoKuxSBdkrvYYxhaXi1IzsqzE4ZweGiM:lAKuxSBerwYLYitYZwT
TLSH
T183E5AD12FE018572E4920171E2AE4FB69C3CAE28133855D7A6D179784A313E3BB3975F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

.exe 3.0MB

2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 880db6f0d18830f9b8984f475a642a5a
SHA256 e6b4f2cb2e8c349335008e18c5287ea0afb2b9bfcb2f382c63122d01f8334016
MD5 53101c9dbdbf3064721914e8844ded27
SHA1 2306a2ae9e0629304ea8d5518d5d66ae06ca5359
SHA512 5695f353e1c85927e5bd319f58d3fec537088a8a4ad78b33072f5bacdec7ca4008f93c7a9b372ccf2d690b03224541d3d14a6cabb7f6530d17f55411cc1d9b8a
SSDEEP 98304:lgsoKuxSBdkrvYYxhaXi1IzsqzE4ZweGiM:lAKuxSBerwYLYitYZwT
TLSH
T183E5AD12FE018572E4920171E2AE4FB69C3CAE28133855D7A6D179784A313E3BB3975F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bb:80:d8:63:3b:d4:69:39:e7:e5:60:d5:49:c5:d7:8f:2b:74:90:83:34:71:1f:6a:9c:51:02:3a:f6:a0:2c:45

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Chains

Jan 1, 0001

PE Signature issue

Digest

14:b2:fb:53:40:8d:c5:d8:e0:9f:af:07:6b:81:1a:6e:80:7c:0c:61

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Chains

Jan 1, 0001

Subject

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Serial Number

36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Datacollect Limited,O=Datacollect Limited,ST=Herefordshire,C=GB

Serial Number

e3:09:72:a2:2b:64:a6:6c:89:0e:05:e9:98:cd:8a:e2

Issuer

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 27, 2024 - Nov 27, 2027

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Serial Number

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 28, 2023 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2115871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

getnameinfo gethostname ioctlsocket sendto recvfrom freeaddrinfo send listen htonl accept select __WSAFDIsSet WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getaddrinfo shutdown

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext

wldap32

ord41 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord145 ord208 ord216 ord219 ord46 ord14

psapi

GetModuleBaseNameW EnumProcesses

kernel32

GetUserDefaultLCID FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetFileAttributesW CreateThread TerminateThread LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar RaiseException GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep GetCurrentThreadId GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock MulDiv lstrcmpW GetTempPathW CloseHandle GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW WriteConsoleW GetCurrentProcessId TerminateProcess OpenProcess LocalFree FormatMessageW WideCharToMultiByte IsBadWritePtr GetSystemTime WaitForSingleObject GetExitCodeProcess FindResourceExW GlobalHandle GlobalFree DecodePointer CreateMutexW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW lstrcmpiW SetFilePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetSystemDirectoryW LoadLibraryW QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask GetModuleHandleA VerifyVersionInfoW SetConsoleMode GetEnvironmentVariableW ReadConsoleA GetConsoleMode ReadConsoleW TlsSetValue TlsAlloc TlsGetValue TlsFree GetModuleHandleExW DeleteFiber SwitchToFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryA SystemTimeToFileTime SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead SetEnvironmentVariableW GetTimeZoneInformation OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread SetFilePointerEx SetConsoleCtrlHandler EnumSystemLocalesW ExitProcess GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW WriteFile IsValidLocale

user32

TranslateMessage DispatchMessageW GetProcessWindowStation GetUserObjectInformationW CreateDialogIndirectParamW FillRect GetSysColor ScreenToClient ClientToScreen SetWindowContextHelpId GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetMessageW MapWindowPoints CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem EndDialog SetWindowPos MoveWindow PostThreadMessageW IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW GetMonitorInfoW MonitorFromWindow IsDialogMessageW PostQuitMessage RegisterWindowMessageW PeekMessageW LoadIconW GetWindowRect DestroyAcceleratorTable MessageBoxW SetForegroundWindow ShowWindow MapDialogRect LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow KillTimer SetWindowLongW GetDC GetWindowLongW DestroyWindow

gdi32

DeleteDC DeleteObject GetObjectW GetDeviceCaps GetStockObject SelectObject CreateCompatibleBitmap CreateSolidBrush CreateCompatibleDC BitBlt

advapi32

CryptSignHashW CryptSetHashParam CryptDestroyHash CryptDestroyKey CryptGetUserKey CryptAcquireContextW CryptEnumProvidersW CryptDecrypt CryptExportKey RegCloseKey RegCreateKeyExW RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW ReportEventW RegisterEventSourceW DeregisterEventSource CryptReleaseContext CryptGetProvParam CryptCreateHash

shell32

ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize OleLockRunning OleUninitialize OleInitialize CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CreateStreamOnHGlobal CoTaskMemFree

oleaut32

SysAllocStringLen VarUI4FromStr DispCallFunc OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantChangeType VariantClear SysStringByteLen VariantInit SysFreeString SysAllocStringByteLen

comctl32

InitCommonControlsEx

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_53101c9dbdbf3064721914e8844ded27_amadey_coinminer_elex_floxif_glassworm_luca-stealer_lynx_njrat_revil

PE Signature issue

PE Signature issue

ws2_32

crypt32

wldap32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

generic