2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 3.5MB
Sample260710-dbwrfsct6n
SHA256 4bc49f90c9bf7e11475e81a462e7f9c60d86e498ac7c8e6ccb8f72943be9afd3
MD5 7f0c4ff1c02e62b3f38d9d95ad86b171
SHA1 0fa24a9ea21dc8959a6f3f02427498e53cb1b41e
SHA512 6dbd8f5d88db0da89a5ecb252df30b188466ded0fa52ff31decd695e8e31d2c3a5505793bf57eff9f3d8328aa993ae057861ffa55f0272edde89dc84d1986f94
SSDEEP 98304:W6vYzj/GxZcA3gPAmVT+/gOmtHtD527BWG:LY3KcTIgOm7VQBWG
TLSH
T15EF5CF22BA02847DE9D31175E6EE677E4A7D6E10033584C793C03F6A58316D37B3A39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 3.5MB

2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 9e6e600fbb0491c7421edea48b3c47c8
SHA256 4bc49f90c9bf7e11475e81a462e7f9c60d86e498ac7c8e6ccb8f72943be9afd3
MD5 7f0c4ff1c02e62b3f38d9d95ad86b171
SHA1 0fa24a9ea21dc8959a6f3f02427498e53cb1b41e
SHA512 6dbd8f5d88db0da89a5ecb252df30b188466ded0fa52ff31decd695e8e31d2c3a5505793bf57eff9f3d8328aa993ae057861ffa55f0272edde89dc84d1986f94
SSDEEP 98304:W6vYzj/GxZcA3gPAmVT+/gOmtHtD527BWG:LY3KcTIgOm7VQBWG
TLSH
T15EF5CF22BA02847DE9D31175E6EE677E4A7D6E10033584C793C03F6A58316D37B3A39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1907132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_hotfix_win32\build\src\steamUI\gamestream\secure_desktop_capture\Release\secure_desktop_capture.pdb

kernel32

FreeLibrary GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree MultiByteToWideChar WriteConsoleW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetFilePointerEx SetStdHandle HeapAlloc HeapFree LCMapStringW CompareStringW HeapValidate HeapSize SetConsoleCtrlHandler ExitProcess GetConsoleCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe VirtualQuery GetCurrentProcessId Sleep SetLastError OutputDebugStringA WriteFile FreeEnvironmentStringsW GetFullPathNameW FindFirstFileW FindClose CreateFileW LoadLibraryA GetProcAddress GetCurrentThreadId Process32Next Process32First CreateToolhelp32Snapshot CreateFileMappingA UnmapViewOfFile MapViewOfFile OpenProcess GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent GetLastError CloseHandle LeaveCriticalSection RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx GetCPInfo DecodePointer EncodePointer GetStringTypeW GetModuleHandleExW EnterCriticalSection InitOnceComplete InitOnceBeginInitialize InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetCurrentDirectoryW FindNextFileW WideCharToMultiByte InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetEnvironmentVariableW GetFileType GetModuleHandleW DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime InitializeCriticalSection GetCommandLineW TerminateProcess GlobalMemoryStatusEx VirtualAlloc GetModuleFileNameA IsDebuggerPresent GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation QueryPerformanceFrequency DuplicateHandle RaiseException TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread GetExitCodeThread SetUnhandledExceptionFilter LoadLibraryExA LoadLibraryExW DebugBreak GetProcessHeaps SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFileSizeEx ReadFile SetEndOfFile

user32

OpenClipboard CloseClipboard SetClipboardData SetDlgItemInt GetWindowTextLengthA GetDesktopWindow CloseDesktop OpenDesktopA GetDlgItemInt EmptyClipboard SetDlgItemTextA GetDlgItem GetWindowThreadProcessId EnumWindows GetShellWindow GetWindowRect EndDialog IsWindowVisible ReleaseDC GetDC SetWindowPos ShowWindow GetCursorInfo LoadCursorA GetCursorPos MessageBoxA GetSystemMetrics SendInput GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA DialogBoxParamA

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

advapi32

RegisterEventSourceW ReportEventW RegSetValueExA RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid CreateWellKnownSid CopySid AddAccessAllowedAce OpenProcessToken DeregisterEventSource

shell32

CommandLineToArgvW

oleaut32

VariantClear

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

ws2_32

recv send WSASetLastError closesocket WSAGetLastError WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_7f0c4ff1c02e62b3f38d9d95ad86b171_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

kernel32

user32

gdi32

advapi32

shell32

oleaut32

psapi

bcrypt

ws2_32

generic