2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 2.7MB
Sample260710-xtltraft4n
SHA256 6ac9a0485c0c4872d179a1fc939bd4ccc1430f67177b791ac8efeeef6035718d
MD5 eed76ce449ea79f09ab75e19a95bb408
SHA1 1178f6f4d64d8fcfddec1ba436b09b9bbe5cfc75
SHA512 379884ca59cddf1e2f57849570fc205e52dae24b926e9fba5e87d2dfa24f7e0268f390672e31735c1acb0c821e6ee98b4f4fa0cfda386ef1c163c18386b950af
SSDEEP 49152:l5XFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedpoMbyX8YJ:l5FYqhzhhVZO0Vuh1ohaz
TLSH
T171D5C002FBC295B2E5870579226B573F8D3AAE205324C9D3D7D12975CD302D1AA3E3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 2.7MB

2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 4d86dd54927373b10420f6f7190c002d
SHA256 6ac9a0485c0c4872d179a1fc939bd4ccc1430f67177b791ac8efeeef6035718d
MD5 eed76ce449ea79f09ab75e19a95bb408
SHA1 1178f6f4d64d8fcfddec1ba436b09b9bbe5cfc75
SHA512 379884ca59cddf1e2f57849570fc205e52dae24b926e9fba5e87d2dfa24f7e0268f390672e31735c1acb0c821e6ee98b4f4fa0cfda386ef1c163c18386b950af
SSDEEP 49152:l5XFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedpoMbyX8YJ:l5FYqhzhhVZO0Vuh1ohaz
TLSH
T171D5C002FBC295B2E5870579226B573F8D3AAE205324C9D3D7D12975CD302D1AA3E3E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\kdumprepn.pdb

kernel32

MultiByteToWideChar LockResource FindResourceExW LoadResource FindResourceW WideCharToMultiByte FindClose CreateFileMappingW MapViewOfFile UnmapViewOfFile FindFirstFileW FindNextFileW WritePrivateProfileStringW SetEndOfFile GetFileAttributesExW SetLastError GetFileAttributesW DeleteFileW RemoveDirectoryW InitializeCriticalSectionAndSpinCount GetTickCount GetPrivateProfileIntW OutputDebugStringW GetPrivateProfileStringW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetUserDefaultLangID GetWindowsDirectoryA WaitForSingleObject CreateThread FreeLibrary lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetCurrentThreadId LoadLibraryW GetModuleFileNameW GetFileSizeEx OpenProcess GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx GetCurrentProcessId MoveFileW GetFileInformationByHandle GetLocalTime SystemTimeToFileTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SizeofResource FlushFileBuffers GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc LCMapStringW GetLastError HeapSize LocalAlloc InitializeCriticalSectionEx WriteFile HeapFree CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread SetStdHandle ExitThread GetDriveTypeW ExitProcess RtlUnwind LoadLibraryA ConvertThreadToFiber ConvertFiberToThread WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber Sleep GetFileSize CloseHandle CreateFileW SetFilePointer GetCommandLineW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA GetConsoleOutputCP SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetStringTypeW GetCPInfo SleepEx QueryPerformanceFrequency FormatMessageW MoveFileExW CompareFileTime

user32

GetProcessWindowStation GetUserObjectInformationW CharNextW MessageBoxW GetDesktopWindow DestroyWindow

advapi32

CryptGenRandom RegCreateKeyExW RegCloseKey RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathAppendA PathFileExistsW PathFindExtensionW PathRemoveFileSpecW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dbghelp

StackWalk64 MiniDumpReadDumpStream

ws2_32

getnameinfo WSACleanup shutdown gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup __WSAFDIsSet

psapi

GetModuleFileNameExW EnumProcesses GetProcessMemoryInfo

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertCloseStore

wldap32

ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_eed76ce449ea79f09ab75e19a95bb408_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

dbghelp

ws2_32

psapi

crypt32

wldap32

generic