2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil
Size 4.3MB
Sample260708-ja2tzadv6k
SHA256 89bccc47fd42310c65e6a50efa00ed62fb97f2a7ab5ee0878eff6fb1d9a1d01c
MD5 7d8b4e3fe03c80f181080729fddafe44
SHA1 c8cd01f6bd158d6342e49353f792db5cf5fe19b9
SHA512 50b9f4c26ebc551d3443f0c2c54a7f74eae23704f753477f14442298da97d48eb47377efef1733068be2c2fc4b5f1ffc7b20ffeb0a3c1c93d39347a460eb4063
SSDEEP 49152:vaRGf+GDHxuz1vKjxa1CPsFRuk3wwlgZKUxT2WHHF6c9OtutTzx4x8EVep:vaAXHxuz1SjE17FRflgDx2WJix8EVy
TLSH
T1ED26D002F7828171EDD29135287EA77E4E39BD28AB62C5D773902F3548306D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

File Explorer

2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

.exe 4.3MB

2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

IMPHASH 0cc64d938b1dd8acbfc68cbd56373afa
SHA256 89bccc47fd42310c65e6a50efa00ed62fb97f2a7ab5ee0878eff6fb1d9a1d01c
MD5 7d8b4e3fe03c80f181080729fddafe44
SHA1 c8cd01f6bd158d6342e49353f792db5cf5fe19b9
SHA512 50b9f4c26ebc551d3443f0c2c54a7f74eae23704f753477f14442298da97d48eb47377efef1733068be2c2fc4b5f1ffc7b20ffeb0a3c1c93d39347a460eb4063
SSDEEP 49152:vaRGf+GDHxuz1vKjxa1CPsFRuk3wwlgZKUxT2WHHF6c9OtutTzx4x8EVep:vaAXHxuz1SjE17FRflgDx2WJix8EVy
TLSH
T1ED26D002F7828171EDD29135287EA77E4E39BD28AB62C5D773902F3548306D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1524726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB4Uns\bin\Win32\Release\mb4uns.pdb

crypt32

CryptMsgClose CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertGetCertificateContextProperty CertDuplicateCertificateContext CryptQueryObject

iphlpapi

GetAdaptersInfo

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW LeaveCriticalSection RaiseException EnterCriticalSection GetCurrentThreadId SetLastError DeleteCriticalSection GetLastError InitializeCriticalSectionEx LocalFree FormatMessageW LocalAlloc Sleep CallNamedPipeW FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW SetCurrentDirectoryW CreateMutexW DecodePointer WideCharToMultiByte GlobalAlloc GlobalLock GlobalFree LoadLibraryW VerifyVersionInfoW VerSetConditionMask SetThreadUILanguage GetSystemDirectoryW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle OpenProcess K32GetModuleFileNameExA WaitForSingleObject GetExitCodeProcess GetModuleFileNameA GetTickCount OutputDebugStringW CreateFileW SwitchToThread GetTempPathW CopyFileW FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle GetCurrentProcess GetSystemInfo GetCurrentThread FileTimeToSystemTime FindFirstFileW GetFileAttributesW CreateDirectoryW HeapReAlloc GetLocalTime GetSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation HeapAlloc SetEndOfFile FindNextFileW FindClose GetModuleHandleA GetStdHandle GetCurrentDirectoryW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount TerminateProcess GetStartupInfoW SetEvent ResetEvent CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW SystemTimeToFileTime DeleteFiber GetFileType QueryPerformanceCounter ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize GetOEMCP GetACP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx SetConsoleCtrlHandler ExitProcess PeekNamedPipe GetDriveTypeW GetModuleHandleExW GetCommandLineW GetCommandLineA RtlUnwind GetThreadTimes HeapDestroy MulDiv GetProcessHeap HeapFree SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer AreFileApisANSI GetFullPathNameW FindFirstFileExW GetStringTypeW LoadLibraryExA VirtualQuery VirtualProtect

dwmapi

DwmGetWindowAttribute

bcrypt

BCryptGenRandom

ws2_32

WSAGetLastError send recv WSASetLastError closesocket WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

crypt32

iphlpapi

kernel32

dwmapi

bcrypt

ws2_32

generic