2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

General

Target
2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 4.2MB
Sample260808-jx94vsshkb
SHA256 327519f521cdec968b6b09b831dc2c6e9095e2c9640ee8a0e0bcc20daaae1033
MD5 263adaffcc31c336aab53a799ab39059
SHA1 9503b895248634b4c3f23120170c425974692b62
SHA512 c85def297272fc9eb836aa8ef622e69a117dd10a2cbf05d6801bca8c69a2442be074c630146184acaaf70389def2ea0f78aa3a82d948963936a10580e8720d85
SSDEEP 49152:WHdXSNcLMwkYq1GafDxnqoAN6yn1v0Y68bivO24Gxaqb4zzP0H3/DGBApyz1iQtV:WHdh4E4t18ciRGxhb7XCBAp
TLSH
T18F169E01BBD9C171F5F286B05AB693BA4D3D7C306B71D8D797C0256E4831AC0AA3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 4.2MB

2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH f98042514385677ab43155ea94ccc0ac
SHA256 327519f521cdec968b6b09b831dc2c6e9095e2c9640ee8a0e0bcc20daaae1033
MD5 263adaffcc31c336aab53a799ab39059
SHA1 9503b895248634b4c3f23120170c425974692b62
SHA512 c85def297272fc9eb836aa8ef622e69a117dd10a2cbf05d6801bca8c69a2442be074c630146184acaaf70389def2ea0f78aa3a82d948963936a10580e8720d85
SSDEEP 49152:WHdXSNcLMwkYq1GafDxnqoAN6yn1v0Y68bivO24Gxaqb4zzP0H3/DGBApyz1iQtV:WHdh4E4t18ciRGxhb7XCBAp
TLSH
T18F169E01BBD9C171F5F286B05AB693BA4D3D7C306B71D8D797C0256E4831AC0AA3A727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2486416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\1325523\3104888\FortiClientHS\Win32\Release\Orchestrator.pdb

kernel32

WideCharToMultiByte GetModuleFileNameA GetLocalTime GetCurrentThreadId GetCurrentProcessId CreateFileA GetCurrentProcess CloseHandle DeleteFileA SetLastError QueryPerformanceCounter WaitForSingleObject EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter GetTickCount OutputDebugStringA GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute MultiByteToWideChar GetSystemTimeAsFileTime GetModuleHandleA GetProcAddress InitializeCriticalSection QueryPerformanceFrequency CreateEventW CreateThread SetEvent Sleep DeleteCriticalSection GetLastError WaitForMultipleObjects GetWindowsDirectoryW ExpandEnvironmentStringsW GetSystemDirectoryW GetSystemWow64DirectoryW MoveFileExW CreateProcessW LocalFree LocalAlloc lstrlenW CopyFileW TerminateProcess GetExitCodeProcess ProcessIdToSessionId GetModuleFileNameW ReleaseMutex DuplicateHandle GetModuleHandleW ResetEvent GetWindowsDirectoryA AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA GetUserDefaultLCID SetDefaultDllDirectories SetSearchPathMode GetCommandLineW SetConsoleCtrlHandler InitializeCriticalSectionEx DecodePointer VerifyVersionInfoW VerSetConditionMask CreateWaitableTimerW CancelWaitableTimer SetWaitableTimer CreateFileW GetFileTime GetFinalPathNameByHandleW CreateFileMappingW MapViewOfFile CreateMutexW UnmapViewOfFile OpenFileMappingW OpenMutexW CreateToolhelp32Snapshot Thread32First Thread32Next LoadLibraryW FreeLibrary GetEnvironmentVariableW GetFileType WriteFile InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualProtect VirtualFree GetACP ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA LoadLibraryA GetSystemTime SystemTimeToFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW SetEnvironmentVariableA LoadLibraryExA VirtualQuery WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetFileSize HeapAlloc GetProcessHeap ReadFile SetFilePointer SetEndOfFile HeapFree OpenProcess GetCurrentDirectoryW DeviceIoControl OpenEventW HeapReAlloc HeapSize GetLongPathNameW Process32FirstW Process32NextW K32GetModuleFileNameExW GetVolumePathNameW QueryDosDeviceW GetLogicalDrives GetDriveTypeW GetVolumeNameForVolumeMountPointW FindFirstVolumeMountPointW FindNextVolumeMountPointW FindVolumeMountPointClose FindFirstVolumeW FindNextVolumeW FindVolumeClose K32EnumProcesses GetFileSizeEx WaitNamedPipeW SetNamedPipeHandleState GetOverlappedResult GetFileAttributesExW GetFileAttributesW GetFullPathNameW DeleteFileW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetUserDefaultUILanguage SetThreadLocale GetVersionExW DisconnectNamedPipe OutputDebugStringW CreateNamedPipeW ConnectNamedPipe WaitForMultipleObjectsEx FlushFileBuffers GetComputerNameW GetStringTypeW GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetFileInformationByHandle SetFileInformationByHandle GetTempPathW AreFileApisANSI CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW TryAcquireSRWLockExclusive WaitForSingleObjectEx SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo WakeAllConditionVariable UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW PeekNamedPipe SystemTimeToTzSpecificLocalTime GetTimeZoneInformation ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetStdHandle GetConsoleOutputCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW SetFilePointerEx IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW GlobalMemoryStatus

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

869KB

Virtual Size

869KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

522KB

Virtual Size

522KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_263adaffcc31c336aab53a799ab39059_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

generic