2026-07-15_f8684e80aa04b998d4fbb7b876f18e01_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_f8684e80aa04b998d4fbb7b876f18e01_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 2.9MB
Sample260715-m5xehsdz21
SHA256 9ce860093a5302fc6a63a096ac8350ec9f1d8d2dd7e6628700e0e1aa6a44d479
MD5 f8684e80aa04b998d4fbb7b876f18e01
SHA1 2300de386459c62811d47c9d357633a9edd63330
SHA512 865b198fcd5cf29660d7c1f4dc90605d01e590362136aacfc595f74968c904bff4ac0abc1a59ffe2958dc3694049592e30b6ead223420673c6ce7744e3192b0f
SSDEEP 49152:/nvqW84ahRM+HnGMGLHGQx+QYepVLALFPrgASw82TgKi1AfcG:/nvmFRMsnT6GnQYenMFgAS
TLSH
T1A6E5CF02FB42C0B6E98302B5516B9BBF4D3DAA305335E8D397D11E3A89705D2273E799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_f8684e80aa04b998d4fbb7b876f18e01_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

File Explorer

2026-07-15_f8684e80aa04b998d4fbb7b876f18e01_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

.exe 2.9MB

2026-07-15_f8684e80aa04b998d4fbb7b876f18e01_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

IMPHASH 34904e41f3ab0afdf77bef30562a064c
SHA256 9ce860093a5302fc6a63a096ac8350ec9f1d8d2dd7e6628700e0e1aa6a44d479
MD5 f8684e80aa04b998d4fbb7b876f18e01
SHA1 2300de386459c62811d47c9d357633a9edd63330
SHA512 865b198fcd5cf29660d7c1f4dc90605d01e590362136aacfc595f74968c904bff4ac0abc1a59ffe2958dc3694049592e30b6ead223420673c6ce7744e3192b0f
SSDEEP 49152:/nvqW84ahRM+HnGMGLHGQx+QYepVLALFPrgASw82TgKi1AfcG:/nvmFRMsnT6GnQYenMFgAS
TLSH
T1A6E5CF02FB42C0B6E98302B5516B9BBF4D3DAA305335E8D397D11E3A89705D2273E799
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

764952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\kenping\codes\fourone_kpnet\fade\projects\Release\fade_service.pdb

kernel32

CreateMutexA ReleaseMutex Sleep CreateEventA CloseHandle SetEvent WaitForSingleObject FreeLibrary GetProcAddress GetLastError GetModuleHandleA WaitForMultipleObjects WriteConsoleW HeapSize SetEndOfFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW GetConsoleOutputCP FlushFileBuffers GetFileSizeEx MultiByteToWideChar WideCharToMultiByte GetCurrentProcess OutputDebugStringA ExpandEnvironmentStringsA GetCurrentThreadId CreateFileA GetLocalTime SystemTimeToFileTime GetSystemTime FormatMessageA SetUnhandledExceptionFilter ReadFile GetModuleFileNameA SetHandleInformation VerifyVersionInfoA GetStdHandle LoadLibraryExA K32GetMappedFileNameA CreatePipe QueryDosDeviceA UnmapViewOfFile FileTimeToSystemTime GetSystemDirectoryA LoadLibraryA GetLogicalDriveStringsA CreateFileMappingA LocalFree GetFileSize VerSetConditionMask VerifyVersionInfoW CreateProcessA GetComputerNameExA MapViewOfFile MoveFileA WriteFile SetFilePointer DeleteFileA GetCurrentProcessId EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetFileAttributesExA OpenFile FindClose CreateDirectoryA QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW InitializeCriticalSectionAndSpinCount ResetEvent CreateEventW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW SetLastError GetModuleHandleExW TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindFirstFileW FindNextFileW FormatMessageW GetEnvironmentVariableW GetFileType ConvertFiberToThread ConvertThreadToFiber LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemInfo LocalAlloc GetTickCount SetWaitableTimer CreateWaitableTimerA CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus ReleaseSemaphore CreateSemaphoreA RtlUnwind InterlockedPushEntrySList RaiseException LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetCommandLineA GetCommandLineW ExitProcess CreateFileW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetModuleFileNameW SetConsoleCtrlHandler SetStdHandle SetFilePointerEx HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc

ws2_32

getnameinfo accept listen WSARecv getprotobynumber recvfrom getaddrinfo freeaddrinfo WSACleanup __WSAFDIsSet bind WSAIoctl WSASend select shutdown WSASetLastError WSAStartup getpeername send socket connect recv getsockopt sendto ioctlsocket setsockopt WSAGetLastError inet_pton inet_ntop ntohl getsockname ntohs htons htonl closesocket getservbyname WSAGetOverlappedResult

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

iphlpapi

if_nametoindex GetTcpTable2 GetNetworkParams FreeMibTable ConvertInterfaceLuidToNameA SetIpInterfaceEntry GetAdaptersAddresses CreateIpForwardEntry2 GetUnicastIpAddressTable InitializeUnicastIpAddressEntry DeleteUnicastIpAddressEntry InitializeIpInterfaceEntry DeleteIpForwardEntry2 InitializeIpForwardEntry CreateUnicastIpAddressEntry GetIpForwardTable2

dbghelp

MiniDumpWriteDump

wtsapi32

WTSQuerySessionInformationA WTSEnumerateSessionsA WTSQueryUserToken WTSFreeMemory

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

shlwapi

PathRemoveExtensionA PathRemoveFileSpecA PathFileExistsA PathIsDirectoryA PathFindFileNameA

bcrypt

BCryptGenRandom

user32

DispatchMessageA GetUserObjectInformationW GetProcessWindowStation GetMessageA MessageBoxW PeekMessageA TranslateMessage

advapi32

RegEnumKeyExA RegQueryInfoKeyA OpenProcessToken LookupAccountSidA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegDeleteKeyA ConvertSidToStringSidA RegCloseKey CryptGenRandom CryptAcquireContextA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceA StartServiceCtrlDispatcherA CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA DeleteService ControlService ChangeServiceConfig2A OpenServiceA GetTokenInformation

shell32

ord680

generic

count=16, id=259, version=27412,

count=202, id=261, version=27412,

count=25, id=260, version=27412,

count=23, id=260, version=31107,

count=21, productName=Unmarked objects (old),

count=557, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,

count=2, id=253, version=30818,

count=19, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=26, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=90, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=1, id=262, version=27412,

count=33, id=257, version=27412,

count=358, id=1, productName=Unmarked objects,

count=54, id=265, version=31107,

count=1, id=256, version=31107,

count=1, id=255, version=31107,

count=1, id=151,

count=1, id=258, version=31107,