2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

General

Target
2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 4.8MB
Sample260930-qanexazfkf
SHA256 a685d883d95f4be1cc5132b7ab8181d41266aa0cb8d94ea7d9fe7e178bb80c52
MD5 2401046de1626d6dab0d178ced1cf314
SHA1 a5e398734fa7ce80ffc4940757917873f0180fb0
SHA512 eaf9296dbe4dd0b3c8011602676d3725fba01c009d6584064d567b814b40b4a214edc08a54c5cd68ec959e30cb3800dca1d3fc98223dedfd95becaf9bdfe33d5
SSDEEP 98304:4P4DtRTAi0NmcP4FuP0sqAVU76DPlUGEQ92:HDtCiwV5DyGEO2
TLSH
T12A36C001B786C1B1E59101B0557AAFBB983DAD395731C5D7E3C01E3A98302D27B3BB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

File Explorer

2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

.exe 4.8MB

2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

IMPHASH 3ee925637643440db9a75713ecd41f74
SHA256 a685d883d95f4be1cc5132b7ab8181d41266aa0cb8d94ea7d9fe7e178bb80c52
MD5 2401046de1626d6dab0d178ced1cf314
SHA1 a5e398734fa7ce80ffc4940757917873f0180fb0
SHA512 eaf9296dbe4dd0b3c8011602676d3725fba01c009d6584064d567b814b40b4a214edc08a54c5cd68ec959e30cb3800dca1d3fc98223dedfd95becaf9bdfe33d5
SSDEEP 98304:4P4DtRTAi0NmcP4FuP0sqAVU76DPlUGEQ92:HDtCiwV5DyGEO2
TLSH
T12A36C001B786C1B1E59101B0557AAFBB983DAD395731C5D7E3C01E3A98302D27B3BB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3122903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount VerSetConditionMask GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetShortPathNameW GetTempFileNameW SetFileTime WriteFile GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetSystemTimeAsFileTime GetVersionExW ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetNativeSystemInfo GetSystemWow64DirectoryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc ExitProcess FreeResource MulDiv DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateProcessW GetPrivateProfileStringW GetLongPathNameW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW GlobalAlloc GlobalUnlock GlobalLock DuplicateHandle DosDateTimeToFileTime GetEnvironmentStringsW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_2401046de1626d6dab0d178ced1cf314_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

kernel32

generic