2026-08-04_dd8b946b24b4f85bb1d6715818c50f07_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_dd8b946b24b4f85bb1d6715818c50f07_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 6.6MB
Sample260804-fwfbbagk81
SHA256 a4025534d34e441ac744dee636954481611c01127455ce91ffd930143f2812b0
MD5 dd8b946b24b4f85bb1d6715818c50f07
SHA1 f556195c49e8b38830d3ee23d3d5b08acd452328
SHA512 14643975efe79369b439b3f677a6e935862f891963c00803875f910013e7ccfa6b23317ed5f2c0da4dc7a71b3d5f554a3e6f8f0f7a9676eb094d22dceb40ab8e
SSDEEP 98304:+mLK8m9fDHiocj2l+3aYfI2Ix8DKbWOGtdnGLnulxEXe9g7e+kY/xw:LKT1zhcj2l+Bc8DJXGLnTOWeQm
TLSH
T1B066E142FB4781B1F59241B061BB9BBB8C3859285B3185C3D7D41A7988305D27B3FBBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_dd8b946b24b4f85bb1d6715818c50f07_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-08-04_dd8b946b24b4f85bb1d6715818c50f07_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 6.6MB

2026-08-04_dd8b946b24b4f85bb1d6715818c50f07_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH a336e5e31bbf3d839922fef572a0bf5c
SHA256 a4025534d34e441ac744dee636954481611c01127455ce91ffd930143f2812b0
MD5 dd8b946b24b4f85bb1d6715818c50f07
SHA1 f556195c49e8b38830d3ee23d3d5b08acd452328
SHA512 14643975efe79369b439b3f677a6e935862f891963c00803875f910013e7ccfa6b23317ed5f2c0da4dc7a71b3d5f554a3e6f8f0f7a9676eb094d22dceb40ab8e
SSDEEP 98304:+mLK8m9fDHiocj2l+3aYfI2Ix8DKbWOGtdnGLnulxEXe9g7e+kY/xw:LKT1zhcj2l+Bc8DJXGLnTOWeQm
TLSH
T1B066E142FB4781B1F59241B061BB9BBB8C3859285B3185C3D7D41A7988305D27B3FBBA
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3061609

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\991338\out\Release\GameAssistantSetup.pdb

ws2_32

connect getpeername getsockname recv setsockopt WSAIoctl htonl listen getaddrinfo accept recvfrom sendto ioctlsocket gethostname gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname shutdown socket htons WSACleanup WSAStartup ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt bind __WSAFDIsSet WSASetLastError select freeaddrinfo

wldap32

ord219 ord46 ord14 ord216 ord73 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301 ord145

winmm

timeKillEvent timeSetEvent

normaliz

IdnToAscii IdnToUnicode

kernel32

SetFilePointerEx FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetLogicalDriveStringsW GetLongPathNameW RemoveDirectoryW SetEndOfFile GlobalAlloc GlobalFree lstrlenA GetCurrentProcess GetModuleHandleExW lstrcmpiW GetThreadLocale SetThreadLocale GlobalMemoryStatusEx GetVersionExW SystemTimeToTzSpecificLocalTime SystemTimeToFileTime CopyFileW ReleaseMutex GetCommandLineW OpenMutexW GetCurrentDirectoryW CreateDirectoryW LocalFileTimeToFileTime SetFileTime FormatMessageW QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetBinaryTypeW VerifyVersionInfoW GetEnvironmentVariableW TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP TryEnterCriticalSection ReleaseSemaphore CreateSemaphoreA GetSystemDirectoryA LoadLibraryA FormatMessageA GetSystemTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryW GetModuleHandleA OpenProcess ProcessIdToSessionId GetExitCodeProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle FlushFileBuffers EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetConsoleOutputCP WriteConsoleW SetConsoleCtrlHandler GetFileInformationByHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FreeResource GetSystemWindowsDirectoryW lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter MulDiv GlobalSize GlobalUnlock FileTimeToSystemTime HeapWalk HeapUnlock HeapLock CreateFileA GetCPInfo CompareStringEx LCMapStringEx OutputDebugStringA GetFileSize GetExitCodeThread GetCurrentThreadId GetFileAttributesExW GetTempPathW Process32NextW Process32FirstW CreateToolhelp32Snapshot UnmapViewOfFile MapViewOfFile CreateFileMappingW GetTimeZoneInformation MoveFileExW lstrlenW SetFileAttributesW DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW LocalFree LocalAlloc OutputDebugStringW WriteFile SetFilePointer ReadFile GetFileSizeEx ExpandEnvironmentStringsW FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapDestroy GetModuleFileNameW CreateProcessW GetCurrentProcessId DeleteCriticalSection InitializeCriticalSection GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetStringTypeW IsDebuggerPresent GetLocalTime GlobalLock GetFullPathNameW CreateFileW lstrcmpA VerSetConditionMask

user32

SendMessageW KillTimer GetClientRect MapWindowPoints GetWindowLongW GetParent GetWindow MonitorFromWindow SetFocus SetWindowTextW GetProcessWindowStation GetUserObjectInformationW SetWindowPos PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW DestroyWindow DefWindowProcW LoadImageW SendMessageTimeoutW FindWindowW CharLowerW GetDesktopWindow DrawTextW SetClipboardData EmptyClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard GetAsyncKeyState GetSysColor ClientToScreen SetCursor UnionRect MonitorFromPoint IsZoomed GetCursorPos GetKeyState ScreenToClient SetWindowRgn UpdateLayeredWindow IsRectEmpty GetUpdateRect MoveWindow EndPaint BeginPaint InvalidateRect ReleaseCapture SetCapture GetFocus GetDC CallWindowProcW RegisterClassW LoadCursorW ReleaseDC RegisterClassExW CreateWindowExW SetWindowLongW GetSystemMetrics IntersectRect OffsetRect EqualRect PtInRect GetMonitorInfoW EnumDisplayMonitors AttachThreadInput IsWindow ShowWindow IsWindowVisible IsIconic BringWindowToTop MessageBoxW wsprintfW GetWindowThreadProcessId PostQuitMessage GetClassNameW EnumWindows PostMessageW GetWindowRect SetForegroundWindow GetForegroundWindow SetActiveWindow

gdi32

GetStockObject CreateRectRgnIndirect SaveDC ExtSelectClipRgn RestoreDC CreateDIBSection CreateCompatibleDC SelectObject SetWindowOrgEx SetStretchBltMode StretchBlt SetTextColor SetBkColor SetBkMode GetObjectA CreateFontIndirectW GetObjectW DeleteObject CreateRoundRectRgn BitBlt GetDeviceCaps DeleteDC GetWindowOrgEx

advapi32

CryptHashData RegCloseKey RegCreateKeyExW RegEnumKeyExA RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW CloseServiceHandle OpenSCManagerW OpenServiceW OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameW ChangeServiceConfigW QueryServiceObjectSecurity QueryServiceStatus SetServiceObjectSecurity StartServiceW ConvertSidToStringSidW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryInfoKeyW RegEnumKeyExW

shell32

SHGetPathFromIDListW SHGetSpecialFolderPathW SHBrowseForFolderW CommandLineToArgvW ShellExecuteW SHFileOperationW SHGetFolderPathW ord165

ole32

CoTaskMemFree CoUninitialize OleUninitialize OleInitialize CoTaskMemRealloc CoInitializeEx CoCreateInstance CoInitialize CreateStreamOnHGlobal CoTaskMemAlloc CoCreateGuid CoSetProxyBlanket

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString SysFreeString

shlwapi

StrTrimA StrCmpIW StrStrIA PathRemoveFileSpecW SHGetValueW ord176 StrCmpNIW StrFormatByteSizeW PathCanonicalizeW PathIsPrefixW PathCombineW PathIsRootW PathRemoveBackslashW SHSetValueW PathAppendW StrStrIW PathFileExistsW SHDeleteValueW SHGetValueA SHSetValueA PathFindFileNameW PathIsRelativeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryW CryptStringToBinaryA CertGetNameStringA CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CryptBinaryToStringA CertGetNameStringW CertGetCertificateContextProperty CertOpenSystemStoreW CertFreeCertificateChain CertDuplicateCertificateContext

gdiplus

GdipGetPropertyItemSize GdipGetPropertyItem GdipDisposeImage GdipCloneImage GdipCreateFromHDC GdipAlloc GdipSetSmoothingMode GdipSetPixelOffsetMode GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreatePathGradientFromPath GdipDeleteBrush GdipCloneBrush GdipSetPathGradientPresetBlend GdipImageSelectActiveFrame GdipDeleteGraphics GdipAddPathEllipse GdiplusStartup GdiplusShutdown GdipMeasureString GdipFillEllipse GdipDrawEllipse GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipSetPenDashArray GdipSetPenDashStyle GdipDrawLineI GdipCreateLineBrushFromRectI GdipFillPath GdipCreateSolidFill GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipImageGetFrameDimensionsCount GdipClosePathFigure GdipAddPathArc GdipAddPathLine GdipFree GdipAddPathRectangle GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipSetPathGradientWrapMode GdipLoadImageFromFile GdipImageRotateFlip GdipDrawImageRect GdipSetWorldTransform GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipCreatePen2 GdipSetLineBlend GdipCreateLineBrushFromRect GdipDrawArc GdipDeletePen GdipCreatePen1 GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipFillRegion GdipSetPathGradientFocusScales GdipDeleteRegion GdipCreateRegionPath

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

msimg32

AlphaBlend

rpcrt4

RpcStringFreeW UuidToStringA UuidToStringW UuidCreate

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersInfo

generic

count=38, id=259, version=29395,

count=220, id=261, version=29395,

count=4, id=261, version=30148,

count=10, id=253, version=28518,

count=19, id=260, version=30034,

count=26, id=259, version=30034,

count=1, id=263, version=28900,

count=6, id=257, version=28900,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=2, id=253, version=23601,

count=101, id=261, version=30034,

count=34, id=260, version=29395,

count=2, id=262, version=29395,

count=732, id=260, version=30154,

count=23, productName=Unmarked objects (old),

count=160, id=260, version=30159,

count=773, id=1, productName=Unmarked objects,

count=49, id=257, version=29395,

count=45, id=264, version=30147,

count=1, id=261, version=28106,

count=1, id=260, version=30147,

count=54, id=261, version=30147,

count=1, id=255, version=30147,

count=1, id=151,

count=1, id=258, version=30147,