7ba38c975e80d5a768382e8dd1c5312a2335d550a78d732f54ed9800cabdeb0a | Triage™

Login
Reports

Overview

overview

7

Static

static

1

2026-08-17...il.exe

windows10-2004-x64

2026-08-17...il.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_d8e002385c6aaf14fe7d49d5ee130354_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 14.2MB
Sample260817-b7wefs1dke
SHA256 7ba38c975e80d5a768382e8dd1c5312a2335d550a78d732f54ed9800cabdeb0a
MD5 d8e002385c6aaf14fe7d49d5ee130354
SHA1 b47e29e1f649759103143ec0cfbd1b1da11d43ef
SHA512 b283242baaf2b60a5df284065e861d69510d30fb2d3b6001510d84ce233b09ee791a74ecd740b7897d7163755bd377744777ac8455966b3aea2395417bfaff54
SSDEEP 196608:HzGzWmduKhKSuy4TQWl8AhYAXmc2hRLiy82hujFdjSy3HFLOyomFHKnPq:HzGz41xHTQi8App+8CujFBSyXFD
TLSH
T1CBE6BF11BA414861E5820171CC6AE7B6573D3D2817F240F3F2DCBAEDEB31AD23A35A56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Static task

static1

Behavioral task

behavioral1

Sample

2026-08-17_d8e002385c6aaf14fe7d49d5ee130354_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

15 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Behavioral task

behavioral2

Sample

2026-08-17_d8e002385c6aaf14fe7d49d5ee130354_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

16 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Malware Config

Targets

- Target
  2026-08-17_d8e002385c6aaf14fe7d49d5ee130354_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
- Size 14.2MB
- SHA256 7ba38c975e80d5a768382e8dd1c5312a2335d550a78d732f54ed9800cabdeb0a
- MD5 d8e002385c6aaf14fe7d49d5ee130354
- SHA1 b47e29e1f649759103143ec0cfbd1b1da11d43ef
- SHA512 b283242baaf2b60a5df284065e861d69510d30fb2d3b6001510d84ce233b09ee791a74ecd740b7897d7163755bd377744777ac8455966b3aea2395417bfaff54
- SSDEEP 196608:HzGzWmduKhKSuy4TQWl8AhYAXmc2hRLiy82hujFdjSy3HFLOyomFHKnPq:HzGz41xHTQi8App+8CujFBSyXFD
- TLSH
  T1CBE6BF11BA414861E5820171CC6AE7B6573D3D2817F240F3F2DCBAEDEB31AD23A35A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation

© 2018-2026

Terms | Privacy