General
- Target 2026-09-30_39115a23338b544680f2d19924fe0254_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil
- Size 2.3MB
- Sample261001-thygmaxs5k
- SHA256 b770c6924c88fe55c39fe8c7309a8d76422c8f3299562c4364f11bbacec7a138
- MD5 39115a23338b544680f2d19924fe0254
- SHA1 99ee73724a6d3a185da1154dc44ed67124af03be
- SHA512 fceb26d8e89cdd15542f83021a2409e4e10ac59fc437ec457a085ee324c6d93bf76e3c6ef7926bc8ee0305230905796c0986c5bb8c233e690d2eb0104be08504
- SSDEEP 49152:3TOGIiTgAIhklKH1Ds5KmFT17c7eJmi/O4hemAmcwGNWd5Vz:3TOGtglhkKH1Ds5KX7M/hvGw4Wd5
- TLSH T1C0B5BE1276438032D553827C506A9776DD7ABC284F3279CF5BB03E27F8326C25E3969A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_39115a23338b544680f2d19924fe0254_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_39115a23338b544680f2d19924fe0254_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-30_39115a23338b544680f2d19924fe0254_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil
- Size 2.3MB
- SHA256 b770c6924c88fe55c39fe8c7309a8d76422c8f3299562c4364f11bbacec7a138
- MD5 39115a23338b544680f2d19924fe0254
- SHA1 99ee73724a6d3a185da1154dc44ed67124af03be
- SHA512 fceb26d8e89cdd15542f83021a2409e4e10ac59fc437ec457a085ee324c6d93bf76e3c6ef7926bc8ee0305230905796c0986c5bb8c233e690d2eb0104be08504
- SSDEEP 49152:3TOGIiTgAIhklKH1Ds5KmFT17c7eJmi/O4hemAmcwGNWd5Vz:3TOGtglhkKH1Ds5KX7M/hvGw4Wd5
- TLSH T1C0B5BE1276438032D553827C506A9776DD7ABC284F3279CF5BB03E27F8326C25E3969A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks whether UAC is enabled
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory