2026-07-22_c4999ef70f01847c31125c468e81bc31_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_c4999ef70f01847c31125c468e81bc31_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
Size 5.0MB
Sample260723-bz6v8acm21
SHA256 9ce296b7b9a77e0a117e9868f2672308896ea16f806798d6d0892de531df1228
MD5 c4999ef70f01847c31125c468e81bc31
SHA1 eb7811110d8fa120436987bebe000c4c404c019d
SHA512 db6126ead438f70b1fd0162369ed216a302ce76e4e4d147ca423bac9c5b87bf7c0564bdade2b4aa52946723674c7b716c5b67070bff5c70f898e6d1544ba3e3e
SSDEEP 98304:9/pmZyGmZUmuLhGLu9AwYL6hMSJ8lQs/NBc:9YZJmZUfLhGLu9VYLoJ8is/NBc
TLSH
T16E366A72E645FCB5D540213411B5FAA6042F1B244B2685CFBE9CF86888F33C179EAE9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_c4999ef70f01847c31125c468e81bc31_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

.exe 5.0MB

2026-07-22_c4999ef70f01847c31125c468e81bc31_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

IMPHASH 532495b4dd991924bc251de6586bc450
SHA256 9ce296b7b9a77e0a117e9868f2672308896ea16f806798d6d0892de531df1228
MD5 c4999ef70f01847c31125c468e81bc31
SHA1 eb7811110d8fa120436987bebe000c4c404c019d
SHA512 db6126ead438f70b1fd0162369ed216a302ce76e4e4d147ca423bac9c5b87bf7c0564bdade2b4aa52946723674c7b716c5b67070bff5c70f898e6d1544ba3e3e
SSDEEP 98304:9/pmZyGmZUmuLhGLu9AwYL6hMSJ8lQs/NBc:9YZJmZUfLhGLu9VYLoJ8is/NBc
TLSH
T16E366A72E645FCB5D540213411B5FAA6042F1B244B2685CFBE9CF86888F33C179EAE9D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

1c:b4:0d:d8:64:ff:1f:d6:a2:06:e0:cd:78:fe:83:c2:dd:f1:23:a2:fc:2c:0c:2e:82:00:c8:ef:3d:91:a8:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3506913,CN=Rocket Software\, Inc.,O=Rocket Software\, Inc.,L=Waltham,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 25, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:2c:80:7f:a1:7e:99:fe:1f:38:e9:56:c4:0c:da:80

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 23, 2024 - May 25, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3096752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\etx12.5.3\obj-x86\etxlauncher\etxlauncher\win\etxlauncher.pdb

msimg32

TransparentBlt

psapi

GetModuleFileNameExW EnumProcessModules

advapi32

RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext RegQueryValueExW RegEnumValueW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegFlushKey RegDeleteKeyW RegQueryInfoKeyW RegCloseKey CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource

ws2_32

gethostbyname inet_addr getservbyport getservbyname inet_ntoa gethostbyaddr WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo ioctlsocket htonl __WSAFDIsSet select bind shutdown closesocket getsockname socket connect recv htons setsockopt WSASetLastError ntohs inet_ntop WSACloseEvent WSACreateEvent WSAEventSelect WSAResetEvent send WSAWaitForMultipleEvents getsockopt WSAEnumNetworkEvents inet_pton WSAIoctl

normaliz

IdnToAscii IdnToUnicode

kernel32

GetCommandLineW GetCommandLineA ExitProcess SizeofResource FindFirstFileW SetLastError FindNextFileW GetCurrentProcess GetStdHandle WriteFile ExpandEnvironmentStringsW SetConsoleMode GetStringTypeExW RemoveDirectoryW GetModuleFileNameW GetThreadLocale SetFilePointer GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetVersionExW GetSystemDirectoryW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetConsoleMode FormatMessageW GetLastError Process32NextW OutputDebugStringW DeleteFileW Process32FirstW CloseHandle LoadLibraryW FindResourceW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetProcAddress LocalFree MoveFileExW GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte MoveFileW GetExitCodeProcess Sleep GetSystemTimeAsFileTime GlobalFree CreateDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency SleepEx GetFullPathNameW GetModuleHandleA VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableA QueryPerformanceCounter GetTickCount CompareFileTime ReadFile CreateFile2 SetFilePointerEx GetFileSizeEx HeapReAlloc SetFileTime SystemTimeToFileTime GetDriveTypeW VirtualQuery GetFileTime ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared GetConsoleOutputCP TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetModuleHandleExW GetSystemDirectoryA LoadLibraryA FormatMessageA GetFileType GetACP ConvertFiberToThread ConvertThreadToFiberEx SetStdHandle LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo SetEndOfFile SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable LCMapStringEx DecodePointer GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetSystemTime SetConsoleCtrlHandler EncodePointer DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree HeapAlloc GetStringTypeW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap HeapSize WriteConsoleW InitializeCriticalSection GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetCurrentThreadId FlushFileBuffers CreateThread ExitThread FreeLibraryAndExitThread

user32

LoadStringA MsgWaitForMultipleObjects LoadStringW EndPaint BeginPaint GetCursorPos InvalidateRect UpdateWindow PtInRect GetParent KillTimer GetClientRect SetWindowLongW LoadCursorW LoadBitmapW MessageBoxW SendMessageW SetTimer GetUserObjectInformationW GetProcessWindowStation GetWindowTextLengthW PostMessageW EndDialog DialogBoxParamW GetMessageW CreateDialogParamW DestroyWindow CheckRadioButton GetSystemMetrics SetWindowTextW ShowWindow DispatchMessageW IsDialogMessageW SetDlgItemTextW GetDlgItemTextW IsDlgButtonChecked TranslateMessage LoadIconW GetDlgItem CheckDlgButton PostQuitMessage LoadImageW EnableWindow GetWindowLongW DefWindowProcW ScreenToClient SetFocus RegisterClassExW

gdi32

BitBlt SelectObject CreateCompatibleDC DeleteDC DeleteObject

shell32

ShellExecuteW

ole32

CoUninitialize CoInitialize CoCreateInstance

comdlg32

GetOpenFileNameW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_c4999ef70f01847c31125c468e81bc31_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

msimg32

psapi

advapi32

ws2_32

normaliz

kernel32

user32

gdi32

shell32

ole32

comdlg32

winhttp

bcrypt

crypt32

generic