2026-08-03_dc86ad8422f0159573903d543d0b3bbb_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_dc86ad8422f0159573903d543d0b3bbb_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 5.2MB
Sample260804-lbsc2astcy
SHA256 3bcb870921766e1b8426eadfd1b2b31213a659dd8776ecf0a621add17bdf486f
MD5 dc86ad8422f0159573903d543d0b3bbb
SHA1 2123225e9737c0e358c414414fb52ac5670fbf04
SHA512 eeb9f99c126d0364d04fe78e955929a794717b0046edd25b869ad968fdc0cbd2c0910ed84a0af37e08e680ae216ebf984608d3475f0268f55d28b20bde1e0878
SSDEEP 98304:5tSmIpRRoT9bdCZl5C7SvvyyY4BDt8jAmY7R7aq/x:CmgRSsdDujY7ROGx
TLSH
T12146BF11F685C5B1F5D201B0297AAB7A943DBE28573088C7A7D11E2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_dc86ad8422f0159573903d543d0b3bbb_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

.exe 5.2MB

2026-08-03_dc86ad8422f0159573903d543d0b3bbb_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

IMPHASH 07ed55193013a62d6372c91fb71ad68d
SHA256 3bcb870921766e1b8426eadfd1b2b31213a659dd8776ecf0a621add17bdf486f
MD5 dc86ad8422f0159573903d543d0b3bbb
SHA1 2123225e9737c0e358c414414fb52ac5670fbf04
SHA512 eeb9f99c126d0364d04fe78e955929a794717b0046edd25b869ad968fdc0cbd2c0910ed84a0af37e08e680ae216ebf984608d3475f0268f55d28b20bde1e0878
SSDEEP 98304:5tSmIpRRoT9bdCZl5C7SvvyyY4BDt8jAmY7R7aq/x:CmgRSsdDujY7ROGx
TLSH
T12146BF11F685C5B1F5D201B0297AAB7A943DBE28573088C7A7D11E2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

b5:4c:96:5d:63:4e:64:d5:fd:c2:90:27:38:04:79:99:63:46:f1:f7:af:ef:d1:b7:f9:e7:5b:4c:34:73:fc:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

Jul 27, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

bc:dc:59:99:86:3c:8f:5d:17:f5:5a:da:88:97:93:37:d8:f4:00:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

Jul 27, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Serial Number

0e:0f:26:60:45:de:0b:3c:da:1a:3d:c2:7b:78:27:91

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Oct 14, 2028

Minor OS version

Major OS version

Entry point

3090071

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource SetDefaultDllDirectories FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount GetModuleHandleW VerSetConditionMask GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetShortPathNameW GetTempFileNameW SetFileTime WriteFile GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetSystemTimeAsFileTime GetVersionExW ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetNativeSystemInfo GetSystemWow64DirectoryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc ExitProcess FreeResource DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateProcessW GetLongPathNameW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock DuplicateHandle DosDateTimeToFileTime GetEnvironmentStringsW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_dc86ad8422f0159573903d543d0b3bbb_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

kernel32

generic