2026-09-16_9efc5c24888780591c52b17371128d68_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_9efc5c24888780591c52b17371128d68_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil
Size 3.9MB
Sample260916-maxf2aae45
SHA256 9750d4b4b7bf5047addf73f0b8d6609ec4fa86b896af4c5b672e65050c058d6a
MD5 9efc5c24888780591c52b17371128d68
SHA1 910b159b6fa6e07578c080db50de7355c05fd3bc
SHA512 c3f1855202edd2959a760c807c7b1cee70269ff4a7c9fa886b51d7f8f0f5ef9dec1ec43cbe89b6ae074662ce43f9a0ff519ba5f7184e02d3f64968b597b66e1e
SSDEEP 98304:u/X3XZCFVMS2KfL7DV4ID+pqfZ17jD527BWG:u/HXALb/DUujVQBWG
TLSH
T16D16BF11B605C533E19241F109B86FB5856DBE28AB7889C797C02D6B44353E32F3BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_9efc5c24888780591c52b17371128d68_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

File Explorer

2026-09-16_9efc5c24888780591c52b17371128d68_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

.exe 3.9MB

2026-09-16_9efc5c24888780591c52b17371128d68_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

IMPHASH 069957add90ad37be3ac417e1165cd77
SHA256 9750d4b4b7bf5047addf73f0b8d6609ec4fa86b896af4c5b672e65050c058d6a
MD5 9efc5c24888780591c52b17371128d68
SHA1 910b159b6fa6e07578c080db50de7355c05fd3bc
SHA512 c3f1855202edd2959a760c807c7b1cee70269ff4a7c9fa886b51d7f8f0f5ef9dec1ec43cbe89b6ae074662ce43f9a0ff519ba5f7184e02d3f64968b597b66e1e
SSDEEP 98304:u/X3XZCFVMS2KfL7DV4ID+pqfZ17jD527BWG:u/HXALb/DUujVQBWG
TLSH
T16D16BF11B605C533E19241F109B86FB5856DBE28AB7889C797C02D6B44353E32F3BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1892848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\GoCart\7.3.0\source\gocartclient\public\ags\binaries\windows\release\AGSService.pdb

netapi32

NetApiBufferFree NetWkstaGetInfo

ws2_32

inet_ntoa

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpSetTimeouts WinHttpOpen WinHttpCrackUrl WinHttpQueryAuthSchemes WinHttpSetStatusCallback WinHttpSetOption WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData

setupapi

SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW CM_Get_DevNode_Status

kernel32

FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLogicalDriveStringsW QueryDosDeviceW SetLastError GetCurrentProcessId GetCurrentThreadId GetSystemTime GetComputerNameExW GetVersionExW SystemTimeToFileTime GetLocaleInfoA GetTempPathW GetModuleHandleExW GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapCompact LoadLibraryW GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InterlockedIncrement InterlockedDecrement CreateSemaphoreW ReleaseSemaphore GetCurrentThread GetTimeZoneInformation WaitForMultipleObjects HeapSize GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW ReleaseMutex OpenMutexW lstrcmpW GetACP GetStdHandle GetFileType GetModuleHandleW ResetEvent GlobalMemoryStatus SwitchToThread FlushConsoleInputBuffer GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleInputW SetConsoleMode SetStdHandle GetCurrentDirectoryW Process32FirstW CreateToolhelp32Snapshot SetInformationJobObject AssignProcessToJobObject CreateJobObjectW OpenProcess HeapReAlloc ResumeThread DuplicateHandle CreateDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW WideCharToMultiByte lstrlenW VerifyVersionInfoW GetProcAddress GetModuleHandleA VerSetConditionMask CreatePipe SetHandleInformation GetModuleFileNameW MultiByteToWideChar DeleteTimerQueue CopyFileA CreateTimerQueueTimer CreateTimerQueue QueueUserWorkItem GetTickCount CreateProcessW CreateThread CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc RaiseException DecodePointer SetFileAttributesW RemoveDirectoryW LocalFree LocalAlloc Sleep CreateNamedPipeW PeekNamedPipe ConnectNamedPipe GetLastError CloseHandle WriteFile ReadFile CreateFileW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetThreadTimes Process32NextW TerminateProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetConsoleCP SetConsoleCtrlHandler ExitProcess MoveFileExW FreeLibraryAndExitThread ExitThread SetFileTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryExW InterlockedPushEntrySList RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FileTimeToSystemTime CompareFileTime K32GetProcessImageFileNameW MoveFileW lstrcmpA HeapDestroy LocalFileTimeToFileTime lstrcatW GetCurrentProcess DosDateTimeToFileTime GetFileTime TerminateThread GlobalFree

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA

advapi32

EnumDependentServicesW GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf GetUserNameA ReportEventA CryptGenRandom CryptReleaseContext CryptAcquireContextW RegisterEventSourceA OpenThreadToken GetNamedSecurityInfoW CreateWellKnownSid CopySid SetNamedSecurityInfoW GetExplicitEntriesFromAclW ConvertStringSidToSidW ConvertSidToStringSidA LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorSacl InitializeAcl GetTokenInformation GetSecurityDescriptorDacl GetLengthSid GetFileSecurityW GetAclInformation GetAce FreeSid EqualSid DuplicateTokenEx CreateRestrictedToken AddMandatoryAce OpenProcessToken SetThreadToken CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegCloseKey QueryServiceStatus OpenSCManagerW DeleteService CreateServiceW ChangeServiceConfig2W StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ReportEventW RegisterEventSourceW DeregisterEventSource QueryServiceStatusEx OpenServiceW ControlService CloseServiceHandle RegCreateKeyExW AllocateAndInitializeSid

shell32

SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW SHGetFolderLocation

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoTaskMemFree CoInitializeSecurity CoUninitialize

oleaut32

SysStringLen SysAllocStringByteLen VariantClear SysFreeString SysAllocString

shlwapi

PathRemoveBackslashW PathRenameExtensionW PathIsDirectoryW PathAppendW PathFindExtensionW PathFindFileNameW PathFileExistsW PathIsFileSpecW PathRemoveFileSpecW PathRemoveExtensionW PathAddExtensionW PathStripPathW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

rpcrt4

UuidToStringW UuidCreate RpcStringFreeA UuidToStringA RpcStringFreeW

crypt32

CryptDecodeObject CryptQueryObject CryptMsgGetParam CertCloseStore CertFindCertificateInStore CryptMsgClose CertGetNameStringW CertFreeCertificateContext

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

generic

count=25, id=259, version=26715,

count=221, id=261, version=26715,

count=24, id=260, version=26715,

count=20, id=260, version=28117,

count=26, id=259, version=28117,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=265, version=28316,

count=1, id=262, version=26715,

count=32, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=154, id=261, version=28117,

count=324, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=5, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=7, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=36, id=261, version=24245,

count=39, id=257, version=26715,

count=404, id=1, productName=Unmarked objects,

count=170, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,