2026-08-12_2650c6dcaae0280d92583ccdb68bf8ba_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_2650c6dcaae0280d92583ccdb68bf8ba_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 11.0MB
Sample260812-jcbessbc24
SHA256 6ef22c5323e452896c3479e63cd540ab73ebfc4068844ecc56e72ebe0561f342
MD5 2650c6dcaae0280d92583ccdb68bf8ba
SHA1 fd0b5b49ca0414a3ad20df7bfea9baad105e3324
SHA512 399579dcd44cfd8fbb3f6b43999e5ba4015d2190d73fbc4955f936fb8652702fa5c33424abb6971d791ab592715e972691a5a26489078ed654b53e4107dcdf5a
SSDEEP 196608:vF4+FYm+olORYrnAZGF/9i+JlqL1Y+MVF69S3TG5c:vF3Ymd4OAI1GLK+M+Zc
TLSH
T198C6AE21B246C135C18312F35469AFFE962CBD348779A9E3DBD82E7948202C75637B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-12_2650c6dcaae0280d92583ccdb68bf8ba_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 11.0MB

2026-08-12_2650c6dcaae0280d92583ccdb68bf8ba_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 18e9ff37b3eeb5736fb97e595955b867
SHA256 6ef22c5323e452896c3479e63cd540ab73ebfc4068844ecc56e72ebe0561f342
MD5 2650c6dcaae0280d92583ccdb68bf8ba
SHA1 fd0b5b49ca0414a3ad20df7bfea9baad105e3324
SHA512 399579dcd44cfd8fbb3f6b43999e5ba4015d2190d73fbc4955f936fb8652702fa5c33424abb6971d791ab592715e972691a5a26489078ed654b53e4107dcdf5a
SSDEEP 196608:vF4+FYm+olORYrnAZGF/9i+JlqL1Y+MVF69S3TG5c:vF3Ymd4OAI1GLK+M+Zc
TLSH
T198C6AE21B246C135C18312F35469AFFE962CBD348779A9E3DBD82E7948202C75637B4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

4f:f7:e7:77:91:dc:ad:92:66:f9:f7:7e:bf:07:37:4d:cc:41:2d:a0:ea:93:1a:5f:94:98:5d:b2:8d:8c:cd:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Chains

Jul 29, 2026

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Serial Number

33:00:03:de:cd:f1:f9:9c:69:82:13:12:dd:00:00:00:03:de:cd

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 27, 2026 - Jul 30, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

7633347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\W10_installer_build\dev\build\bin\CoordinatorServiceDelphi.pdb

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

advapi32

CreateServiceA ReportEventW CryptAcquireContextW CryptReleaseContext InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenProcessToken CopySid GetLengthSid GetTokenInformation IsValidSid DeregisterEventSource RegisterEventSourceA ReportEventA GetUserNameA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA ChangeServiceConfigA ChangeServiceConfig2A CloseServiceHandle ControlService RegisterEventSourceW DeleteService OpenSCManagerA OpenServiceA QueryServiceStatus RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey

ws2_32

WSAStartup WSACleanup getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr sendto recvfrom WSASocketA WSAIoctl WSAStringToAddressW WSAAddressToStringW WSASocketW WSARecv WSASetLastError closesocket getnameinfo freeaddrinfo getaddrinfo socket shutdown send select recv ntohs ntohl listen htons htonl getsockopt getsockname connect bind accept __WSAFDIsSet WSASend WSAGetLastError setsockopt ioctlsocket getpeername

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

kernel32

SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler LoadLibraryExW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetStdHandle GetFileSizeEx WriteFile CreateFile2 OutputDebugStringA CloseHandle GetLastError SetLastError PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject WaitForMultipleObjects QueueUserAPC GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId TerminateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile LocalFree FormatMessageA FormatMessageW GetDynamicTimeZoneInformation WideCharToMultiByte GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemInfo IsDebuggerPresent SetHandleInformation Sleep OpenProcess QueryFullProcessImageNameA GetEnvironmentVariableW CreateFileW GetLongPathNameW GetSystemTimeAsFileTime GetModuleFileNameW IsWow64Process GetTimeZoneInformation MultiByteToWideChar K32GetProcessMemoryInfo CreateIoCompletionPort GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount SleepEx CreateEventW SetWaitableTimer GetProcAddress LoadLibraryA CreateEventA FileTimeToSystemTime GetModuleFileNameA CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFullPathNameA DuplicateHandle RaiseException QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection GetProcessTimes GetCurrentThread SetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessA GetThreadTimes GetVersion CopyFileW MoveFileExW ReadFile CancelIoEx GetModuleHandleA CreateWaitableTimerA AreFileApisANSI GetSystemDirectoryW GetExitCodeProcess UnregisterWaitEx RegisterWaitForSingleObject FreeLibrary SetFilePointer GetUserDefaultLCID SetEnvironmentVariableW GetCurrentDirectoryW FlushFileBuffers GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFilePointerEx DeviceIoControl GetModuleHandleW WriteConsoleW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime SystemTimeToFileTime GetSystemDirectoryA TryEnterCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx SetConsoleMode ReadConsoleA ReadConsoleW GetTickCount GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx LockFile GetDiskFreeSpaceW HeapFree HeapCreate InitializeCriticalSectionEx IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle CreateProcessW CreatePipe GetConsoleOutputCP GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW ExitProcess GetLocaleInfoEx TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetTickCount64

mswsock

AcceptEx GetAcceptExSockaddrs

ntdll

RtlUnwind

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_2650c6dcaae0280d92583ccdb68bf8ba_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

ole32

shell32

advapi32

ws2_32

user32

kernel32

mswsock

ntdll

crypt32

generic