2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil
Size 33.4MB
Sample260930-vvd47adh33
SHA256 a991e12a7defa83da7d5958cdccfad1ea2f35974353754b768bb59e6311bb147
MD5 b3c4a46cc4e536122fba21615bdf274c
SHA1 f087047b1c9253419cc9ade39a6c813a35f41c31
SHA512 916865f83441da29eb9557b12ae9a35ea015e05c467b678e960cf9845251f5475c0d06b8920da3ee2bced80a4af71610a2284ac36d2f98380219ac3f57547ad8
SSDEEP 393216:pj6DwJFVg6BvOKfLqZXSpeqaZqOFOoRgfydRsc4bt0FKyjTVhZJZSa9ZCR1CPwDs:1DfGoUJbdP4bt0FJXnLRZ
TLSH
T1F977CFB1760AC17BD54602F5582EEBAB422C5B310F3064C3E2D92E6D6CB55D32B35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil

File Explorer

2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil

.exe 33.4MB

2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil

IMPHASH a3832f75e45a655bd2e0f50eefeea2c3
SHA256 a991e12a7defa83da7d5958cdccfad1ea2f35974353754b768bb59e6311bb147
MD5 b3c4a46cc4e536122fba21615bdf274c
SHA1 f087047b1c9253419cc9ade39a6c813a35f41c31
SHA512 916865f83441da29eb9557b12ae9a35ea015e05c467b678e960cf9845251f5475c0d06b8920da3ee2bced80a4af71610a2284ac36d2f98380219ac3f57547ad8
SSDEEP 393216:pj6DwJFVg6BvOKfLqZXSpeqaZqOFOoRgfydRsc4bt0FKyjTVhZJZSa9ZCR1CPwDs:1DfGoUJbdP4bt0FJXnLRZ
TLSH
T1F977CFB1760AC17BD54602F5582EEBAB422C5B310F3064C3E2D92E6D6CB55D32B35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\HP\Desktop\all10\Helper BetterAV - Starlight\Release\Starlight-RO.pdb

kernel32

TerminateProcess RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread OpenProcess SetFileAttributesW GetExitCodeThread Sleep GetLastError GetFileAttributesA CreateFileA LockResource DeleteFileW CloseHandle LoadResource FindResourceW GetProcAddress VirtualAllocEx GetFileSize CreateProcessW WriteFile CopyFileW CreateRemoteThread QueryFullProcessImageNameW VirtualFreeEx GetExitCodeProcess FindNextFileW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteProcessMemory FindFirstFileW SizeofResource GetModuleFileNameA ReadFile GetModuleHandleW CreateDirectoryW

user32

DefWindowProcW GetMessageW BeginPaint MessageBoxW FillRect CreateWindowExW ShowWindow DispatchMessageW SetTimer RegisterClassW TranslateMessage LoadIconW LoadCursorW EndPaint DestroyWindow InvalidateRect UpdateWindow PostQuitMessage KillTimer DrawTextW GetClientRect

gdi32

DeleteObject CreateSolidBrush SetTextColor TextOutW CreateFontW SelectObject SetBkMode

msvcp140

?_Xbad_alloc@std@@YAXXZ ??Bid@locale@std@@QAEIXZ ?always_noconv@codecvt_base@std@@QBE_NXZ _Query_perf_frequency ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z

shlwapi

PathRemoveFileSpecA

vcruntime140

_except_handler4_common memset __current_exception_context __current_exception _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _invalid_parameter_noinfo_noreturn _initialize_onexit_table terminate _crt_atexit _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_narrow_environment exit _controlfp_s _beginthreadex

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-string-l1-1-0

towlower wcscpy_s

api-ms-win-crt-stdio-l1-1-0

fflush _set_fmode fclose fgetpos __stdio_common_vswprintf __p__commode _fseeki64 fsetpos fgetwc ungetc fgetc fputwc fwrite ungetwc setvbuf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_b3c4a46cc4e536122fba21615bdf274c_akira_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_revil

kernel32

user32

gdi32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic