2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 2.7MB
Sample260804-wxc6cafa48
SHA256 9693ca7c18135018a1f0bec97abed259b842b4c283a5747eb6fd3751003d1111
MD5 c434fa5f0a22be41809a9e599c9ea6f1
SHA1 432a2dffb669f6bc22fddddf0250a8f651767dfc
SHA512 9db331a4c1e9c203077ae9672e65f364d0c3e9c4b30faf789ca28b9455bc6cb922c4c5de67cea391106030ae74e6f68b5553e44ae6243ff9f3e4944f3e9968fb
SSDEEP 49152:l4XFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedp6e30jaNf1TWbdz:lKFYqhzhhVZO0Vuh1oh8U023W
TLSH
T1ABD5CF02FBC295B2E587057A226B573F4D3AAE205324C9D3D7D129758D302D1AB3F3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 2.7MB

2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 4d86dd54927373b10420f6f7190c002d
SHA256 9693ca7c18135018a1f0bec97abed259b842b4c283a5747eb6fd3751003d1111
MD5 c434fa5f0a22be41809a9e599c9ea6f1
SHA1 432a2dffb669f6bc22fddddf0250a8f651767dfc
SHA512 9db331a4c1e9c203077ae9672e65f364d0c3e9c4b30faf789ca28b9455bc6cb922c4c5de67cea391106030ae74e6f68b5553e44ae6243ff9f3e4944f3e9968fb
SSDEEP 49152:l4XFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedp6e30jaNf1TWbdz:lKFYqhzhhVZO0Vuh1oh8U023W
TLSH
T1ABD5CF02FBC295B2E587057A226B573F4D3AAE205324C9D3D7D129758D302D1AB3F3A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\kdumprepn.pdb

kernel32

MultiByteToWideChar LockResource FindResourceExW LoadResource FindResourceW WideCharToMultiByte FindClose CreateFileMappingW MapViewOfFile UnmapViewOfFile FindFirstFileW FindNextFileW WritePrivateProfileStringW SetEndOfFile GetFileAttributesExW SetLastError GetFileAttributesW DeleteFileW RemoveDirectoryW InitializeCriticalSectionAndSpinCount GetTickCount GetPrivateProfileIntW OutputDebugStringW GetPrivateProfileStringW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetUserDefaultLangID GetWindowsDirectoryA WaitForSingleObject CreateThread FreeLibrary lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetCurrentThreadId LoadLibraryW GetModuleFileNameW GetFileSizeEx OpenProcess GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx GetCurrentProcessId MoveFileW GetFileInformationByHandle GetLocalTime SystemTimeToFileTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SizeofResource FlushFileBuffers GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc LCMapStringW GetLastError HeapSize LocalAlloc InitializeCriticalSectionEx WriteFile HeapFree CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread SetStdHandle ExitThread GetDriveTypeW ExitProcess RtlUnwind LoadLibraryA ConvertThreadToFiber ConvertFiberToThread WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber Sleep GetFileSize CloseHandle CreateFileW SetFilePointer GetCommandLineW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA GetConsoleOutputCP SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetStringTypeW GetCPInfo SleepEx QueryPerformanceFrequency FormatMessageW MoveFileExW CompareFileTime

user32

GetProcessWindowStation GetUserObjectInformationW CharNextW MessageBoxW GetDesktopWindow DestroyWindow

advapi32

CryptGenRandom RegCreateKeyExW RegCloseKey RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathAppendA PathFileExistsW PathFindExtensionW PathRemoveFileSpecW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dbghelp

StackWalk64 MiniDumpReadDumpStream

ws2_32

getnameinfo WSACleanup shutdown gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup __WSAFDIsSet

psapi

GetModuleFileNameExW EnumProcesses GetProcessMemoryInfo

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertCloseStore

wldap32

ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_c434fa5f0a22be41809a9e599c9ea6f1_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

dbghelp

ws2_32

psapi

crypt32

wldap32

generic