2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 3.4MB
Sample260929-24jjlayblf
SHA256 0ebf18b4264f16c3529b16e4b2e03ec21ab66e105e8266722dac51b63d181814
MD5 6934f21b3d4f89a152f16a080e9ab28d
SHA1 7e042dd0aef7afdfb15ffdda632db1616dbb51e7
SHA512 f5a473db69130c0a7320e4e20827a9d8a81dd0dca2c1a0908654b691d1aeb71076f9cdf21edc0f1611e9689333dbdb0b43fe35c9cdbbb4c3b45d85619e5e0cd8
SSDEEP 98304:SE6YqhzhhVZO0Vuh1ohJfJ4kzprGvwb5/rn:fiVU1ohJfJ46/VD
TLSH
T1D6F5E102FBC294B2E9870579226B573F4D3AAE205324C5D3DBD12975DD302D1AB3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 3.4MB

2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 4d86dd54927373b10420f6f7190c002d
SHA256 0ebf18b4264f16c3529b16e4b2e03ec21ab66e105e8266722dac51b63d181814
MD5 6934f21b3d4f89a152f16a080e9ab28d
SHA1 7e042dd0aef7afdfb15ffdda632db1616dbb51e7
SHA512 f5a473db69130c0a7320e4e20827a9d8a81dd0dca2c1a0908654b691d1aeb71076f9cdf21edc0f1611e9689333dbdb0b43fe35c9cdbbb4c3b45d85619e5e0cd8
SSDEEP 98304:SE6YqhzhhVZO0Vuh1ohJfJ4kzprGvwb5/rn:fiVU1ohJfJ46/VD
TLSH
T1D6F5E102FBC294B2E9870579226B573F4D3AAE205324C5D3DBD12975DD302D1AB3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\kdumprepn.pdb

kernel32

MultiByteToWideChar LockResource FindResourceExW LoadResource FindResourceW WideCharToMultiByte FindClose CreateFileMappingW MapViewOfFile UnmapViewOfFile FindFirstFileW FindNextFileW WritePrivateProfileStringW SetEndOfFile GetFileAttributesExW SetLastError GetFileAttributesW DeleteFileW RemoveDirectoryW InitializeCriticalSectionAndSpinCount GetTickCount GetPrivateProfileIntW OutputDebugStringW GetPrivateProfileStringW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetUserDefaultLangID GetWindowsDirectoryA WaitForSingleObject CreateThread FreeLibrary lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetCurrentThreadId LoadLibraryW GetModuleFileNameW GetFileSizeEx OpenProcess GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx GetCurrentProcessId MoveFileW GetFileInformationByHandle GetLocalTime SystemTimeToFileTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SizeofResource FlushFileBuffers GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc LCMapStringW GetLastError HeapSize LocalAlloc InitializeCriticalSectionEx WriteFile HeapFree CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread SetStdHandle ExitThread GetDriveTypeW ExitProcess RtlUnwind LoadLibraryA ConvertThreadToFiber ConvertFiberToThread WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber Sleep GetFileSize CloseHandle CreateFileW SetFilePointer GetCommandLineW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA GetConsoleOutputCP SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetStringTypeW GetCPInfo SleepEx QueryPerformanceFrequency FormatMessageW MoveFileExW CompareFileTime

user32

GetProcessWindowStation GetUserObjectInformationW CharNextW MessageBoxW GetDesktopWindow DestroyWindow

advapi32

CryptGenRandom RegCreateKeyExW RegCloseKey RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathAppendA PathFileExistsW PathFindExtensionW PathRemoveFileSpecW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dbghelp

StackWalk64 MiniDumpReadDumpStream

ws2_32

getnameinfo WSACleanup shutdown gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup __WSAFDIsSet

psapi

GetModuleFileNameExW EnumProcesses GetProcessMemoryInfo

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertCloseStore

wldap32

ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_6934f21b3d4f89a152f16a080e9ab28d_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

dbghelp

ws2_32

psapi

crypt32

wldap32

generic