2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
Size 3.6MB
Sample260712-nwskmsg17k
SHA256 7bbbea3ae818424d1b544022ca7f8f303ac822f5d3833501bf73c6d81b310c37
MD5 bf0ee1c11c9984710cb7c860823d45ec
SHA1 104200432cfda9fcb3bcff940fc111be54804f1a
SHA512 13f450bae36b860119d43607a89e83a4fb744b4bd238da7e5337c3cdb617578cfc50518ce512a2735eafa768ff411ae70b44db289e5a46d392a77d1bed4ecb0a
SSDEEP 49152:SfxdJknPT1z9Df0gjpqLvgff7fciEu5ebIHvtP7hOn//Pv8xuGv3mmG+8K4u:Sfxd2PJziLvMf7kseb+vNhOGGXK4u
TLSH
T13406CF22B7418072F4A702B15579ABBE493DFD301B7488D7A3C03E6E68716C27B3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

.exe 3.6MB

2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

IMPHASH 665d24942ba39c7c41c83fd5c3460233
SHA256 7bbbea3ae818424d1b544022ca7f8f303ac822f5d3833501bf73c6d81b310c37
MD5 bf0ee1c11c9984710cb7c860823d45ec
SHA1 104200432cfda9fcb3bcff940fc111be54804f1a
SHA512 13f450bae36b860119d43607a89e83a4fb744b4bd238da7e5337c3cdb617578cfc50518ce512a2735eafa768ff411ae70b44db289e5a46d392a77d1bed4ecb0a
SSDEEP 49152:SfxdJknPT1z9Df0gjpqLvgff7fciEu5ebIHvtP7hOn//Pv8xuGv3mmG+8K4u:Sfxd2PJziLvMf7kseb+vNhOGGXK4u
TLSH
T13406CF22B7418072F4A702B15579ABBE493DFD301B7488D7A3C03E6E68716C27B3A756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1249002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGBizLauncher.pdb

kernel32

WideCharToMultiByte GetThreadId IsDebuggerPresent SetThreadPriority WaitForSingleObject GetCurrentThreadId DuplicateHandle Sleep GetCurrentThread GetThreadPriority RaiseException CreateThread GetFileSizeEx SetEndOfFile GetFileInformationByHandle SetFilePointerEx FlushFileBuffers QueryThreadCycleTime FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter GetProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW GetSystemDirectoryW GetWindowsDirectoryW TryAcquireSRWLockExclusive AcquireSRWLockExclusive TerminateProcess OpenProcess GetExitCodeProcess VirtualFree VirtualAlloc OpenFileMappingW VirtualQuery TlsGetValue GetProcessTimes SetEnvironmentVariableW GetEnvironmentVariableW GetVersionExW GetNativeSystemInfo TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter CreateEventW SetEvent ResetEvent GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort ExpandEnvironmentStringsW FindFirstFileExW LoadLibraryW lstrlenW SetFilePointer FormatMessageW lstrcatW CreateProcessW lstrcpyW FreeLibrary OpenMutexW GlobalFree GetTempFileNameW GetFileTime FindFirstFileW ExitThread GetFileSize OpenEventW HeapFree GetFullPathNameW LocalAlloc HeapAlloc GetProcessHeap EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryExW CreateMutexW FindClose InitializeCriticalSection WaitForSingleObjectEx TransactNamedPipe SetNamedPipeHandleState WaitNamedPipeW ProcessIdToSessionId SetErrorMode InitializeSRWLock GetExitCodeThread EncodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetConsoleOutputCP GetConsoleMode SetStdHandle GetFileType ExitProcess GetModuleHandleExW ResumeThread FreeLibraryAndExitThread GetTimeZoneInformation GetStdHandle HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetDriveTypeW IsValidCodePage GetACP GetOEMCP SetConsoleCtrlHandler GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteConsoleW DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA LocalFree GetCommandLineW ReleaseSRWLockExclusive GetModuleHandleW GetProcAddress MapViewOfFile CreateFileMappingW MoveFileExW SetCurrentDirectoryW GetFileAttributesExW SetFileAttributesW UnmapViewOfFile GetFileAttributesW GetTempPathW RemoveDirectoryW GetCurrentProcess ReadFile CreateDirectoryW GetTickCount FormatMessageA GetCurrentProcessId GetCurrentDirectoryW GetLocalTime CloseHandle DeleteFileW OutputDebugStringW CreateFileW GetModuleFileNameW WriteFile SetLastError MultiByteToWideChar ReleaseMutex FindNextFileW PeekNamedPipe VerSetConditionMask VerifyVersionInfoW DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx

user32

GetSystemMetrics SetRectEmpty wvsprintfW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW DispatchMessageW SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus KillTimer GetProcessWindowStation FindWindowExW PostMessageW UnregisterClassW RemovePropW GetClassInfoW RegisterClassW LoadIconW LoadCursorW GetPropW ReplyMessage SetPropW GetWindowTextW IsWindow MessageBoxW TranslateMessage SendMessageTimeoutW PeekMessageW GetUserObjectInformationW GetMessageW PostQuitMessage wsprintfW

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

imm32

ImmDisableIME

winmm

timeBeginPeriod timeEndPeriod timeGetTime

shlwapi

PathMatchSpecW

ws2_32

WSASetLastError send recv WSACleanup closesocket WSAGetLastError

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore

advapi32

CryptSetKeyParam BuildExplicitAccessWithNameW CryptEncrypt CryptImportKey SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorSacl CryptEnumProvidersW EventUnregister CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt EventRegister CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateProcessWithTokenW DuplicateTokenEx LookupAccountSidW GetSecurityDescriptorSacl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid EventWrite GetTokenInformation OpenProcessToken RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegOpenKeyW RegEnumKeyW

shell32

SHFileOperationW ShellExecuteW SHGetKnownFolderPath CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

bcrypt

BCryptGenRandom

wininet

InternetConnectA HttpSendRequestExW HttpEndRequestW HttpOpenRequestW InternetQueryOptionW HttpQueryInfoA InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetCrackUrlA InternetCloseHandle InternetConnectW InternetSetOptionW InternetReadFile HttpAddRequestHeadersW InternetOpenUrlW HttpOpenRequestA InternetWriteFile

winhttp

WinHttpReadData WinHttpWriteData WinHttpOpen WinHttpSetTimeouts WinHttpQueryHeaders WinHttpOpenRequest WinHttpQueryOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpGetIEProxyConfigForCurrentUser WinHttpReceiveResponse WinHttpConnect WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpCrackUrl

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_bf0ee1c11c9984710cb7c860823d45ec_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

kernel32

user32

psapi

version

imm32

winmm

shlwapi

ws2_32

crypt32

advapi32

shell32

ole32

oleaut32

bcrypt

wininet

winhttp

generic