2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 16.8MB
Sample260925-vfcb2sfh35
SHA256 d5b82f8969de5e1d624d18b5505f8ca91738e65602b84f9cecd0347fc86cf5b7
MD5 fae8dde1f6785781dab45b211e682e7d
SHA1 bb7f0d13bcf1fbf580350028d8ebc4e67db32dc5
SHA512 03739892c1238567b767d871670ce637413394bb3b6600fa2aa55b260ab4012b9ecc81964387f066339fd1579f5995ddc915e2d846d06556df890af853e0b65f
SSDEEP 196608:ang534UDh0746Q1cv1YqoHUadXKRnInmG+qAaPxc1qBcr1wlJpbaqw:aq4ucv1Yqo2InBLA2kS+12haqw
TLSH
T18807AF21A606C13BD6C101B4993DDBBF522CDA750B6498C7B2D81ABC5DB26D33F36A07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 16.8MB

2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 56a5e320b76eac0d89dfac1bcb367b31
SHA256 d5b82f8969de5e1d624d18b5505f8ca91738e65602b84f9cecd0347fc86cf5b7
MD5 fae8dde1f6785781dab45b211e682e7d
SHA1 bb7f0d13bcf1fbf580350028d8ebc4e67db32dc5
SHA512 03739892c1238567b767d871670ce637413394bb3b6600fa2aa55b260ab4012b9ecc81964387f066339fd1579f5995ddc915e2d846d06556df890af853e0b65f
SSDEEP 196608:ang534UDh0746Q1cv1YqoHUadXKRnInmG+qAaPxc1qBcr1wlJpbaqw:aq4ucv1Yqo2InBLA2kS+12haqw
TLSH
T18807AF21A606C13BD6C101B4993DDBBF522CDA750B6498C7B2D81ABC5DB26D33F36A07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17657856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dev\sotr_jaas\bld\tbbc\ec069\api_tbbc\bbcomm\build\m_bbcomm\Release\bbcomm.pdb

advapi32

OpenProcessToken OpenThreadToken RegisterServiceCtrlHandlerExA SetServiceStatus RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW LookupAccountSidW GetTokenInformation

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

crypt32

CertCloseStore CertFreeCertificateContext CertDuplicateCertificateContext CertOpenSystemStoreW CertOpenStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertFindCertificateInStore

ws2_32

WSASend WSARecv sendto recvfrom shutdown listen closesocket send recv WSASetLastError getservbyname getaddrinfo gethostbyaddr inet_ntoa inet_addr WSACleanup WSAStartup gethostbyname ioctlsocket htonl WSAGetLastError socket setsockopt select htons getsockopt connect bind accept __WSAFDIsSet ntohs getsockname getpeername gethostname freeaddrinfo getnameinfo WSASocketA getservbyport

bcrypt

BCryptGenRandom

kernel32

GetConsoleOutputCP SetFilePointerEx FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle FreeLibraryAndExitThread ExitThread GetFullPathNameW GetDriveTypeW GetTimeZoneInformation SetConsoleCtrlHandler ExitProcess LoadLibraryExW RtlUnwind InterlockedPushEntrySList RaiseException OutputDebugStringW GetStartupInfoW InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeConditionVariable Sleep SleepEx GetCurrentThreadId WakeConditionVariable GetLastError OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA GetVersionExA CloseHandle WaitForSingleObject GetEnvironmentVariableA SetEnvironmentVariableA CreateEventW GetCurrentProcessId CreateProcessA GetProcessId GetModuleFileNameA RegisterWaitForSingleObject UnregisterWait SetUnhandledExceptionFilter SetEvent GetCurrentProcess TerminateProcess CreateThread VirtualAlloc VirtualFree GetOEMCP CreateFileA SetNamedPipeHandleState TransactNamedPipe ResetEvent WaitForMultipleObjects UnregisterWaitEx WaitNamedPipeA DecodePointer InitializeCriticalSectionEx WideCharToMultiByte CreateDirectoryA GetTempPathA CreateMutexA HeapReAlloc FormatMessageA GetSystemInfo GetModuleHandleA ReleaseSemaphore WakeAllConditionVariable CreateSemaphoreA InitOnceExecuteOnce GetModuleHandleExW SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW WriteConsoleW DeleteFiber CreateFiberEx MultiByteToWideChar GetSystemTimeAsFileTime GetStdHandle GetFileType WriteFile GetSystemDirectoryA GetACP InitializeCriticalSection GetExitCodeThread ConvertFiberToThread ConvertThreadToFiberEx GetSystemTime SystemTimeToFileTime LoadLibraryW FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW HeapAlloc HeapFree GetProcessHeap GetCurrentThread LocalAlloc LocalFree DeleteFileA FindFirstFileExA FindNextFileA GetFileAttributesA LockFileEx ReadFile RemoveDirectoryA FileTimeToSystemTime GetConsoleWindow VirtualQuery GetModuleFileNameW CreateFileW DeleteFileW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileSizeEx RemoveDirectoryW SetEndOfFile UnlockFileEx GetTempPathW SleepConditionVariableCS QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent RtlCaptureStackBackTrace GetProcessTimes ResumeThread ReleaseMutex SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW CreateEventA IsValidCodePage HeapSize GetModuleHandleW SwitchToFiber TryAcquireSRWLockExclusive GetStringTypeW EncodePointer LCMapStringEx

activeds

ord15 ord3

secur32

GetUserNameExW

iphlpapi

GetAdaptersAddresses

shlwapi

PathIsRelativeA

ole32

CoInitializeEx CoUninitialize

pcre2_callout_enumerate_8 pcre2_code_copy_8 pcre2_code_copy_with_tables_8 pcre2_code_free_8 pcre2_compile_8 pcre2_compile_context_copy_8 pcre2_compile_context_create_8 pcre2_compile_context_free_8 pcre2_convert_context_copy_8 pcre2_convert_context_create_8 pcre2_convert_context_free_8 pcre2_general_context_copy_8 pcre2_general_context_create_8 pcre2_general_context_free_8 pcre2_get_error_message_8 pcre2_get_mark_8 pcre2_get_match_data_size_8 pcre2_get_ovector_count_8 pcre2_get_ovector_pointer_8 pcre2_get_startchar_8 pcre2_jit_compile_8 pcre2_jit_free_unused_memory_8 pcre2_jit_match_8 pcre2_jit_stack_assign_8 pcre2_jit_stack_create_8 pcre2_jit_stack_free_8 pcre2_match_8 pcre2_match_context_copy_8 pcre2_match_context_create_8 pcre2_match_context_free_8 pcre2_match_data_create_8 pcre2_match_data_create_from_pattern_8 pcre2_match_data_free_8 pcre2_pattern_info_8 pcre2_set_bsr_8 pcre2_set_callout_8 pcre2_set_character_tables_8 pcre2_set_compile_extra_options_8 pcre2_set_compile_recursion_guard_8 pcre2_set_depth_limit_8 pcre2_set_glob_escape_8 pcre2_set_glob_separator_8 pcre2_set_heap_limit_8 pcre2_set_match_limit_8 pcre2_set_max_pattern_length_8 pcre2_set_newline_8 pcre2_set_offset_limit_8 pcre2_set_parens_nest_limit_8 pcre2_set_recursion_limit_8 pcre2_set_recursion_memory_management_8 pcre2_set_substitute_callout_8 pcre2_substitute_8 pcre2_substring_copy_byname_8 pcre2_substring_copy_bynumber_8 pcre2_substring_free_8 pcre2_substring_get_byname_8 pcre2_substring_get_bynumber_8 pcre2_substring_length_byname_8 pcre2_substring_length_bynumber_8 pcre2_substring_list_free_8 pcre2_substring_list_get_8 pcre2_substring_nametable_scan_8 pcre2_substring_number_from_name_8

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_fae8dde1f6785781dab45b211e682e7d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

advapi32

user32

crypt32

ws2_32

bcrypt

kernel32

activeds

secur32

iphlpapi

shlwapi

ole32

generic