General
- Target 2026-07-15_4f816338531e6de294d2deed61655dcd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil_smoke-loader
- Size 5.5MB
- Sample260716-cctg2saz2j
- SHA256 e41b0b16e1ad6bc97ee5d8f1a2e0e36efad5645e8e9160bfef517fcf42af7053
- MD5 4f816338531e6de294d2deed61655dcd
- SHA1 1928181e52fed7e4c05dccbdea6445b3b619a205
- SHA512 b7a0d40e0ec9978abd72983db02d4fe0bf729c615b1f4efa3d8c9bd99174f3631a0519f222866ad28da39cc6c5e0df8c221b3e99774b873a1f12ef18927ed59c
- SSDEEP 98304:OmZL+wL53Cxi6u+gQRXaqeQ3xGqO4JnKv3TYs97EYrW/jia:VLnL53CxwQ1xbJnKP997zr6jia
- TLSH T19B46B011FB8681F1E59101B0557BBB7A583DAA284B3489C7E7D02E7588302D37A3BB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-15_4f816338531e6de294d2deed61655dcd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_4f816338531e6de294d2deed61655dcd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_4f816338531e6de294d2deed61655dcd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil_smoke-loader
- Size 5.5MB
- SHA256 e41b0b16e1ad6bc97ee5d8f1a2e0e36efad5645e8e9160bfef517fcf42af7053
- MD5 4f816338531e6de294d2deed61655dcd
- SHA1 1928181e52fed7e4c05dccbdea6445b3b619a205
- SHA512 b7a0d40e0ec9978abd72983db02d4fe0bf729c615b1f4efa3d8c9bd99174f3631a0519f222866ad28da39cc6c5e0df8c221b3e99774b873a1f12ef18927ed59c
- SSDEEP 98304:OmZL+wL53Cxi6u+gQRXaqeQ3xGqO4JnKv3TYs97EYrW/jia:VLnL53CxwQ1xbJnKP997zr6jia
- TLSH T19B46B011FB8681F1E59101B0557BBB7A583DAA284B3489C7E7D02E7588302D37A3BB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.