Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 00:21
General
- Target 2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe
- Size 1.2MB
- Sample260808-anbehael7s
- SHA256 1a0158a718043a8f2ca30e7d2feae856b0d841f089fb9935af0c8ac473e86ced
Malware Config
Extracted
-
C:\ProgramData\Adobe\Setup\README.txt
-
lynx
- Your data is stolen and encrypted. Download TOR Browser to contact with us. ID ~ 675fd0e4e42beed9ed89e0fd Chat site: ~ TOR Network: http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login ~ TOR Mirror #1: http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login ~ TOR Mirror #2: http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login ~ TOR Mirror #3: http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login ~ TOR Mirror #4: http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login ~ TOR Mirror #5: http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login ~ TOR Mirror #6: http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login ~ Mirror #7: http://lynxchat.net/login Our blog: ~ TOR Network: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/ ~ TOR Mirror #1: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/ ~ TOR Mirror #2: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/ ~ TOR Mirror #3: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/ ~ TOR Mirror #4: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/ ~ TOR Mirror #5: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ ~ TOR Mirror #6: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/ ~ Mirror #7: http://lynxblog.net/
-
http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login
-
http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login
-
http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login
-
http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login
-
http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login
-
http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login
-
http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login
-
http://lynxchat.net/login
-
http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/
-
http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/
-
http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/
-
http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/
-
http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/
-
http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/
-
http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/
-
http://lynxblog.net/
Signatures
- Family: Lynx
Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.
- Detects Lynx Ransomware 24 IoCs
- Renames multiple (301) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AFD030FC-1EAD-4EBE-8449-24145750BE50}.xps" 1343062208022800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README.txt
{0983066F-7987-4C2C-8C70-ED634EDC905A}
Open Notebook.onetoc2
memory/5008-167-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-163-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-58-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-53-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-90-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-96-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-105-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-137-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-136-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-146-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-158-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-160-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-166-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-171-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-168-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-0-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-47-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-200-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-170-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-202-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-203-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-1153-0x0000000000370000-0x000000000049F000-memory.dmp
memory/5008-1500-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-1834-0x0000000000370000-0x000000000049F000-memory.dmp
memory/5008-4-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5008-36-0x00000000018D0000-0x00000000018FD000-memory.dmp
memory/5708-1841-0x00007FFB36DB0000-0x00007FFB36DC0000-memory.dmp
memory/5708-1839-0x00007FFB36DB0000-0x00007FFB36DC0000-memory.dmp
memory/5708-1838-0x00007FFB36DB0000-0x00007FFB36DC0000-memory.dmp
memory/5708-1842-0x00007FFB34D00000-0x00007FFB34D10000-memory.dmp
memory/5708-1843-0x00007FFB34D00000-0x00007FFB34D10000-memory.dmp
memory/5708-1840-0x00007FFB36DB0000-0x00007FFB36DC0000-memory.dmp
memory/5708-1837-0x00007FFB36DB0000-0x00007FFB36DC0000-memory.dmp