2026-07-06_a1f3300fe677eaf956ffce6ea05c8393_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_a1f3300fe677eaf956ffce6ea05c8393_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil
Size 4.0MB
Sample260706-tyfxhsdv4m
SHA256 da50b5f2685b326d0f23d26b981ea7ce5b8bbbfaf3f44c558ea4b15e6ea40229
MD5 a1f3300fe677eaf956ffce6ea05c8393
SHA1 5ce89da58a4a9e3a0d5544199fa1377f24e46e3b
SHA512 63f7058b7d36ab4773f6b09714de1384bbf20f12daf9126a41e37e6c17ffb24e96b851db99d2ccdcd82bd0a09298f55cdf28383296eba9b2dbac5effaf65a214
SSDEEP 98304:ska5iV8ON9SgwM4NVpzR34zB5MlHCY7wRGpj3:sfQV372VhCMoEF9
TLSH
T1A116AF117601C532E59101B209B97FF5866CAE289F7949CB97C02DAA89353E32F37F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_a1f3300fe677eaf956ffce6ea05c8393_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

File Explorer

2026-07-06_a1f3300fe677eaf956ffce6ea05c8393_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

.exe 4.0MB

2026-07-06_a1f3300fe677eaf956ffce6ea05c8393_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

IMPHASH 0a00ec47bddadde2f79f23669204d6f1
SHA256 da50b5f2685b326d0f23d26b981ea7ce5b8bbbfaf3f44c558ea4b15e6ea40229
MD5 a1f3300fe677eaf956ffce6ea05c8393
SHA1 5ce89da58a4a9e3a0d5544199fa1377f24e46e3b
SHA512 63f7058b7d36ab4773f6b09714de1384bbf20f12daf9126a41e37e6c17ffb24e96b851db99d2ccdcd82bd0a09298f55cdf28383296eba9b2dbac5effaf65a214
SSDEEP 98304:ska5iV8ON9SgwM4NVpzR34zB5MlHCY7wRGpj3:sfQV372VhCMoEF9
TLSH
T1A116AF117601C532E59101B209B97FF5866CAE289F7949CB97C02DAA89353E32F37F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1936416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\GoCart\7.5.0\source\gocartclient\public\ags\binaries\windows\release\AGSService.pdb

netapi32

NetApiBufferFree NetWkstaGetInfo

ws2_32

inet_ntoa

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpReadData WinHttpOpen WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpQueryAuthSchemes WinHttpSetTimeouts WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpSetCredentials WinHttpAddRequestHeaders WinHttpCrackUrl WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption

setupapi

SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW CM_Get_DevNode_Status

kernel32

FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLogicalDriveStringsW QueryDosDeviceW SetLastError GetCurrentProcessId GetCurrentThreadId GetSystemTime GetComputerNameExW GetVersionExW SystemTimeToFileTime GetLocaleInfoA GetTempPathW GetModuleHandleExW GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapCompact LoadLibraryW GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InterlockedIncrement InterlockedDecrement CreateSemaphoreW ReleaseSemaphore GetCurrentThread GetTimeZoneInformation WaitForMultipleObjects HeapSize GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW ReleaseMutex OpenMutexW lstrcmpW GetACP GetStdHandle GetFileType GetModuleHandleW ResetEvent GlobalMemoryStatus SwitchToThread FlushConsoleInputBuffer GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleInputW SetConsoleMode SetStdHandle GetCurrentDirectoryW Process32FirstW CreateToolhelp32Snapshot SetInformationJobObject AssignProcessToJobObject CreateJobObjectW OpenProcess HeapReAlloc ResumeThread DuplicateHandle CreateDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW WideCharToMultiByte lstrlenW VerifyVersionInfoW GetProcAddress GetModuleHandleA VerSetConditionMask CreatePipe SetHandleInformation GetModuleFileNameW MultiByteToWideChar DeleteTimerQueue CopyFileA CreateTimerQueueTimer CreateTimerQueue QueueUserWorkItem GetTickCount CreateProcessW CreateThread CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc RaiseException DecodePointer SetFileAttributesW RemoveDirectoryW LocalFree LocalAlloc Sleep CreateNamedPipeW PeekNamedPipe ConnectNamedPipe GetLastError CloseHandle WriteFile ReadFile CreateFileW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetThreadTimes Process32NextW TerminateProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetConsoleCP SetConsoleCtrlHandler ExitProcess MoveFileExW FreeLibraryAndExitThread ExitThread SetFileTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryExW InterlockedPushEntrySList RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FileTimeToSystemTime CompareFileTime K32GetProcessImageFileNameW MoveFileW lstrcmpA HeapDestroy LocalFileTimeToFileTime lstrcatW GetCurrentProcess DosDateTimeToFileTime GetFileTime TerminateThread GlobalFree

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA

advapi32

EnumDependentServicesW GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf GetUserNameA ReportEventA CryptGenRandom CryptReleaseContext CryptAcquireContextW RegisterEventSourceA OpenThreadToken GetNamedSecurityInfoW CreateWellKnownSid CopySid SetNamedSecurityInfoW GetExplicitEntriesFromAclW ConvertStringSidToSidW ConvertSidToStringSidA LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorSacl InitializeAcl GetTokenInformation GetSecurityDescriptorDacl GetLengthSid GetFileSecurityW GetAclInformation GetAce FreeSid EqualSid DuplicateTokenEx CreateRestrictedToken AddMandatoryAce OpenProcessToken SetThreadToken CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegCloseKey QueryServiceStatus OpenSCManagerW DeleteService CreateServiceW ChangeServiceConfig2W StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ReportEventW RegisterEventSourceW DeregisterEventSource QueryServiceStatusEx OpenServiceW ControlService CloseServiceHandle RegCreateKeyExW AllocateAndInitializeSid

shell32

SHGetKnownFolderPath SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW SHGetFolderLocation

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoTaskMemFree CoInitializeSecurity CoUninitialize

oleaut32

SysStringLen SysAllocStringByteLen VariantClear SysFreeString SysAllocString

shlwapi

PathRemoveBackslashW PathRenameExtensionW PathIsDirectoryW PathAppendW PathFindExtensionW PathFindFileNameW PathIsFileSpecW PathFileExistsW PathRemoveFileSpecW PathRemoveExtensionW PathAddExtensionW PathStripPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

rpcrt4

UuidCreate UuidToStringW RpcStringFreeA UuidToStringA RpcStringFreeW

crypt32

CertFreeCertificateContext CryptQueryObject CryptMsgClose CryptMsgGetParam CertCloseStore CryptDecodeObject CertGetNameStringW CertFindCertificateInStore

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

generic

count=25, id=259, version=26715,

count=221, id=261, version=26715,

count=24, id=260, version=26715,

count=20, id=260, version=28117,

count=26, id=259, version=28117,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=265, version=28316,

count=2, id=262, version=26715,

count=32, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=154, id=261, version=28117,

count=324, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=5, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=7, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=36, id=261, version=24245,

count=39, id=257, version=26715,

count=405, id=1, productName=Unmarked objects,

count=176, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,