2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat

General

Target
2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat
Size 1.6MB
Sample260716-b2hamsaw2l
SHA256 f181185ee46a1f783bbe27c5070498fc8429448d3add93713d24300348925939
MD5 9c3f268a6c7b762c34cc52020a7f0859
SHA1 a786c2f48509afdebec09ed2c421ccbae308cdf3
SHA512 233973eb85df1fd0fa653793c1cc8ed95fa3973db0d7e5d410880103e1aedf664ccaa14538a49c9387bf4898e74770f47a0e00ad80db52725144e8f28f35a3ec
SSDEEP 24576:9sWBaeHKy4H068QSQ6X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9PBRKn6XLNiXicJFFRGNzj3
TLSH
T17975229172C1C1B0E9B914394029C9746A5CFD394F61AEF76380393F6F746C29A39E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat

File Explorer

2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat

.exe 1.6MB

2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat

IMPHASH 7900e2c82a66551c474c6ff61a4e5a60
SHA256 f181185ee46a1f783bbe27c5070498fc8429448d3add93713d24300348925939
MD5 9c3f268a6c7b762c34cc52020a7f0859
SHA1 a786c2f48509afdebec09ed2c421ccbae308cdf3
SHA512 233973eb85df1fd0fa653793c1cc8ed95fa3973db0d7e5d410880103e1aedf664ccaa14538a49c9387bf4898e74770f47a0e00ad80db52725144e8f28f35a3ec
SSDEEP 24576:9sWBaeHKy4H068QSQ6X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9PBRKn6XLNiXicJFFRGNzj3
TLSH
T17975229172C1C1B0E9B914394029C9746A5CFD394F61AEF76380393F6F746C29A39E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadFile GetModuleFileNameA SizeofResource WriteFile ExpandEnvironmentStringsA SetFilePointer FindResourceA GetModuleHandleA Sleep GetTempPathA GetTickCount64 CopyFileA GetLastError GetFileAttributesA CreateFileA LockResource DeleteFileA lstrcpyA CloseHandle LoadResource GetCurrentDirectoryW IsDebuggerPresent WriteConsoleW SetEndOfFile HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW GetProcessHeap CreateFileW FlushFileBuffers ReadConsoleW DecodePointer

shell32

ShellExecuteExA ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat

kernel32

shell32

generic