2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 59.8MB
Sample260716-e79hvsds5m
SHA256 3a83abc29abf6576d89ea8feef60d0829e20d67eb5a4efca3721435130f714ae
MD5 0ae137b648de058a859e6917709c31d3
SHA1 2df1a1dfdd4d0627653a4f8dba85aa8d152f4515
SHA512 eedc7c54382fb101c642d849bc1fad4ccb29b6977bde16607267952493d41fd6302bd941d5823533e90dd4651e05eabc34e7de3c208ed3901a9d88a3d4a7f399
SSDEEP 786432:H7eWa4i70hmKLMHvX2jT2O7je28p3TIrgcvY:BaIMHvm+Ee28
TLSH
T151D7F103F682D0FBC58213F1E16F9F7E5D28465697204CD7E7849EA98AF52D4203AB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 59.8MB

2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 77519744bcd4320a4086a6dd869843c1
SHA256 3a83abc29abf6576d89ea8feef60d0829e20d67eb5a4efca3721435130f714ae
MD5 0ae137b648de058a859e6917709c31d3
SHA1 2df1a1dfdd4d0627653a4f8dba85aa8d152f4515
SHA512 eedc7c54382fb101c642d849bc1fad4ccb29b6977bde16607267952493d41fd6302bd941d5823533e90dd4651e05eabc34e7de3c208ed3901a9d88a3d4a7f399
SSDEEP 786432:H7eWa4i70hmKLMHvX2jT2O7je28p3TIrgcvY:BaIMHvm+Ee28
TLSH
T151D7F103F682D0FBC58213F1E16F9F7E5D28465697204CD7E7849EA98AF52D4203AB2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

419440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ipxo\source\repos\nl-reloaded\Release\nl-reloaded.pdb

d3d9

Direct3DCreate9

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCrackUrl WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable WinHttpReceiveResponse

kernel32

ReadFile WriteProcessMemory WriteFile GetProcessId WaitForSingleObject CreateFileW GetSystemDirectoryW GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread DeleteFileA CloseHandle LoadLibraryW Module32FirstW VirtualProtectEx GetProcAddress VirtualAllocEx GetFileSize CreateProcessW GetModuleHandleW FreeLibrary CreateRemoteThread Module32NextW VirtualFreeEx LoadLibraryExW WakeAllConditionVariable GetFileAttributesW GetLastError MultiByteToWideChar SizeofResource GetTempPathW LockResource DeleteFileW LoadResource FindResourceW WideCharToMultiByte GetTempFileNameW OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter FindFirstFileW FindNextFileW FindClose IsProcessorFeaturePresent GetCurrentThreadId SleepConditionVariableSRW Sleep GetSystemTimeAsFileTime GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateDirectoryW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter

user32

GetMessageExtraInfo GetKeyState ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode GetForegroundWindow ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW ScreenToClient UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW GetCapture PeekMessageW SetWindowLongW GetClientRect PostQuitMessage UpdateWindow GetWindowThreadProcessId FindWindowA TranslateMessage

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

msvcp140

_Thrd_join _Query_perf_counter ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_frequency _Mtx_trylock _Thrd_yield _Mtx_lock _Thrd_detach _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_id

winmm

mciSendStringW

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140

_except_handler4_common __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate memchr memcpy memmove memset _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

realloc _callnewh free _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

strncmp wcscat_s _wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf _set_fmode _wfopen fwrite __p__commode __stdio_common_vfprintf fflush __acrt_iob_func fread fseek fclose ftell

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback terminate _controlfp_s _register_onexit_function

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

ceil ldexp _libm_sse2_sqrt_precise _CIfmod _libm_sse2_acos_precise _libm_sse2_cos_precise _libm_sse2_pow_precise _libm_sse2_sin_precise __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_0ae137b648de058a859e6917709c31d3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

d3d9

winhttp

kernel32

user32

advapi32

shell32

msvcp140

winmm

imm32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic