2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil
Size 4.3MB
Sample260708-kdzdpadt2x
SHA256 4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8
MD5 8277c5f8ae5615b7f78123d7baedf277
SHA1 f2a29f57ebe6dea850ca5130812115a231384fff
SHA512 9b834a504e39f5aee1eccfe09b7f4def2ad0de27f2b485985d3f3a8879ac1391c453303f8284098788f01ce6e2b5b5bd4d2bb707cbe359bef45421a862d95a13
SSDEEP 49152:QJABRjHZHCHglfiwz2wkCPhiwi4XWwlgZKUxT2igHF6c9OtZkN6x4x8EVep:vNMHglfPzrkOiw5lgDx2i5ix8EVy
TLSH
T1B726D002F7828170EDC29135287E977E4E39BD28AB62D5DB73902F3548316D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

File Explorer

2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

.exe 4.3MB

2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

IMPHASH 6c8427301bca1520e59e66080236c26f
SHA256 4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8
MD5 8277c5f8ae5615b7f78123d7baedf277
SHA1 f2a29f57ebe6dea850ca5130812115a231384fff
SHA512 9b834a504e39f5aee1eccfe09b7f4def2ad0de27f2b485985d3f3a8879ac1391c453303f8284098788f01ce6e2b5b5bd4d2bb707cbe359bef45421a862d95a13
SSDEEP 49152:QJABRjHZHCHglfiwz2wkCPhiwi4XWwlgZKUxT2igHF6c9OtZkN6x4x8EVep:vNMHglfPzrkOiw5lgDx2i5ix8EVy
TLSH
T1B726D002F7828170EDC29135287E977E4E39BD28AB62D5DB73902F3548316D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1524649

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB4Uns\bin\Win32\Release\mb4uns.pdb

crypt32

CryptMsgClose CertEnumCertificatesInStore CertGetCertificateContextProperty CertCloseStore CertOpenStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertDuplicateCertificateContext CryptQueryObject

iphlpapi

GetAdaptersInfo

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW LeaveCriticalSection RaiseException EnterCriticalSection GetCurrentThreadId SetLastError DeleteCriticalSection GetLastError InitializeCriticalSectionEx LocalFree FormatMessageW LocalAlloc Sleep CallNamedPipeW FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW SetCurrentDirectoryW CreateMutexW DecodePointer WideCharToMultiByte GlobalAlloc GlobalLock GlobalFree LoadLibraryW VerifyVersionInfoW VerSetConditionMask SetThreadUILanguage GetSystemDirectoryW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle OpenProcess K32GetModuleFileNameExA WaitForSingleObject GetExitCodeProcess GetTickCount OutputDebugStringW SwitchToThread GetTempPathW CopyFileW FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle CreateFileW GetCurrentThread FileTimeToSystemTime GetCurrentProcess FindFirstFileW GetFileAttributesW CreateDirectoryW HeapReAlloc GetLocalTime GetSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation HeapAlloc GetSystemInfo SetEndOfFile FindNextFileW FindClose GetModuleHandleA GetStdHandle GetCurrentDirectoryW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount TerminateProcess GetStartupInfoW SetEvent ResetEvent CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW SystemTimeToFileTime DeleteFiber GetFileType QueryPerformanceCounter ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize GetOEMCP GetACP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx SetConsoleCtrlHandler ExitProcess PeekNamedPipe GetDriveTypeW GetModuleHandleExW GetCommandLineW GetCommandLineA RtlUnwind GetThreadTimes HeapDestroy MulDiv GetProcessHeap HeapFree SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer AreFileApisANSI GetFullPathNameW FindFirstFileExW GetStringTypeW LoadLibraryExA VirtualQuery VirtualProtect

dwmapi

DwmGetWindowAttribute

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

bcrypt

BCryptGenRandom

ws2_32

send WSAGetLastError recv WSASetLastError WSACleanup WSAStartup closesocket

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat_revil

crypt32

iphlpapi

kernel32

dwmapi

rpcrt4

bcrypt

ws2_32

generic