2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 2.4MB
Sample261001-mdltpswejf
SHA256 86531fd91cd912f232e400c6192393544c0ad439d18096a38905ff142fb0b715
MD5 8f4cd9f3da2919bb52e247e6a0ac30b5
SHA1 8fe85245fb17269db9d356c03dc282f504293375
SHA512 6e9ab717de4819c61259b4c46d55ed6fe1cded14d84a9109af82bad73a9c83d8fee4dace271d9963981ed4fb647881d1b1b0a6cd8c7bd96521164843dc142233
SSDEEP 24576:h+KpPXsPZIzkQ+W3BfXUQFpKJkpDDk1Jco/v2Y8i4FBwZ/fCWJTHJKUGlqktPsot:xfBSwB8uk15Pp81DtPsohyYRREj4
TLSH
T108C5CF21B7818071F9A702F5657E973F483AFD3117248AD3E7D02E7A58316C1AB3A399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 2.4MB

2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH ac43746a243ae14d28aa3b6084d4e3f1
SHA256 86531fd91cd912f232e400c6192393544c0ad439d18096a38905ff142fb0b715
MD5 8f4cd9f3da2919bb52e247e6a0ac30b5
SHA1 8fe85245fb17269db9d356c03dc282f504293375
SHA512 6e9ab717de4819c61259b4c46d55ed6fe1cded14d84a9109af82bad73a9c83d8fee4dace271d9963981ed4fb647881d1b1b0a6cd8c7bd96521164843dc142233
SSDEEP 24576:h+KpPXsPZIzkQ+W3BfXUQFpKJkpDDk1Jco/v2Y8i4FBwZ/fCWJTHJKUGlqktPsot:xfBSwB8uk15Pp81DtPsohyYRREj4
TLSH
T108C5CF21B7818071F9A702F5657E973F483AFD3117248AD3E7D02E7A58316C1AB3A399
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

677815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-272e15317c624a00a2eaa8c7a205f538\src\bin\Release_Win32\voiceinput.pdb

kernel32

GetLocalTime GetCurrentDirectoryW FormatMessageA GetTickCount ReadFile SetConsoleCtrlHandler GetFileSizeEx TlsSetValue GetStdHandle TerminateProcess FindClose GetCurrentThreadId UnmapViewOfFile SetEvent TlsAlloc QueryPerformanceFrequency TlsGetValue TlsFree QueryPerformanceCounter GetExitCodeProcess LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW GetCurrentProcess TryAcquireSRWLockExclusive AcquireSRWLockExclusive MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent RaiseException CreateThread CreateDirectoryW RemoveDirectoryW GetTempPathW GetFileAttributesW SetFileAttributesW GetFileAttributesExW SetCurrentDirectoryW MoveFileExW CopyFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime CloseHandle GetWindowsDirectoryW ExpandEnvironmentStringsW CreateEventW SetEndOfFile GetFileInformationByHandle SetFilePointerEx FlushFileBuffers GetVersionExW GetNativeSystemInfo FindFirstFileExW FindNextFileW SetEnvironmentVariableW GetEnvironmentVariableW GetUserDefaultLangID RtlCaptureStackBackTrace SetUnhandledExceptionFilter SizeofResource LockResource LoadResource FindResourceW WakeAllConditionVariable SleepConditionVariableSRW HeapFree GetProcessHeap HeapAlloc GetModuleHandleExW LoadLibraryExA LoadLibraryA InitOnceComplete InitOnceBeginInitialize EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo GetStringTypeW UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount GetConsoleOutputCP GetConsoleMode ExitThread ResumeThread FreeLibraryAndExitThread ReadConsoleW GetFileType GetDriveTypeW PeekNamedPipe SetStdHandle ExitProcess GetFullPathNameW HeapReAlloc HeapSize CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetFileTime CreateProcessW GetFileSize FormatMessageW FindFirstFileW DeleteFileW OutputDebugStringW CreateFileW GetModuleFileNameW WriteFile LocalFree GetCommandLineW CreateMutexW ReleaseSRWLockExclusive ReleaseMutex LocalAlloc DeleteFiber ConvertFiberToThread SetConsoleMode ReadConsoleA OpenMutexW Sleep WaitForSingleObject SetLastError GetCurrentProcessId DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx GetSystemDirectoryW SetErrorMode

user32

FindWindowW SendMessageTimeoutW MessageBoxW SetRectEmpty wsprintfW GetProcessWindowStation GetUserObjectInformationW

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

oleaut32

SysFreeString SysAllocString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

bcrypt

BCryptGenRandom

ws2_32

closesocket recv WSAGetLastError WSACleanup WSASetLastError send

winmm

timeGetTime

shlwapi

PathMatchSpecW

advapi32

SetSecurityDescriptorSacl RegQueryValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl RegCloseKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupAccountSidW GetSecurityDescriptorSacl BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid RegOpenKeyExW RegSetValueExW RegCreateKeyExW GetTokenInformation OpenProcessToken

shell32

SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW CommandLineToArgvW

imm32

ImmDisableIME

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_8f4cd9f3da2919bb52e247e6a0ac30b5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

kernel32

user32

ole32

oleaut32

version

bcrypt

ws2_32

winmm

shlwapi

advapi32

shell32

imm32

crypt32

generic