2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

General

Target
2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat
Size 4.4MB
Sample261011-2ertnsab86
SHA256 dfe63e579d58099d15bc75047699a91f32722ba58aa8e8ec1831f920645e2342
MD5 051c3a93615f1f9a9d13f240422253e9
SHA1 88341e0ec66e3821e1f07e336ad527619f197be9
SHA512 592f68fdf7bc5dbe16e5f6e937b6347faff8c1ed0b12488dd56ef53010704398ad4e27117feaf1e4d7f4854e99335144692ca871b7d533a343465694462af9f0
SSDEEP 98304:0dn1MqjRFAngaVit2naDGbtV5b4TEeALoNmL90d:0dn17RFAndwwnpV586rqd
TLSH
T1E726AF6273078620F55706702D68BF6B927CEE351B7289CBEBC42B1A4E252D11739F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

File Explorer

2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

.exe 4.4MB

2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

IMPHASH 81525ac807273999fc99274c6fc44dc6
SHA256 dfe63e579d58099d15bc75047699a91f32722ba58aa8e8ec1831f920645e2342
MD5 051c3a93615f1f9a9d13f240422253e9
SHA1 88341e0ec66e3821e1f07e336ad527619f197be9
SHA512 592f68fdf7bc5dbe16e5f6e937b6347faff8c1ed0b12488dd56ef53010704398ad4e27117feaf1e4d7f4854e99335144692ca871b7d533a343465694462af9f0
SSDEEP 98304:0dn1MqjRFAngaVit2naDGbtV5b4TEeALoNmL90d:0dn17RFAndwwnpV586rqd
TLSH
T1E726AF6273078620F55706702D68BF6B927CEE351B7289CBEBC42B1A4E252D11739F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1919165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_11d5r\master_kso_v12\Build\Release\WPSOffice\office6\KUninstall.pdb

kernel32

VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount lstrlenW GetFileSize FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW DeleteFileW SetEndOfFile SetFilePointer SetFilePointerEx WriteFile GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileExW GetStdHandle ReadFile MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetModuleHandleW GetProcAddress MoveFileW GetModuleHandleA CompareFileTime GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask VerSetConditionMask VerifyVersionInfoW FreeLibrary LoadLibraryExW GetPrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW LocalFree ExpandEnvironmentStringsW GetFileAttributesExW Sleep TerminateProcess OpenProcess GetSystemWow64DirectoryW LoadLibraryW lstrcmpW FreeResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree WritePrivateProfileStringW ReleaseMutex OpenEventW OpenFileMappingW GetCurrentThread GetDateFormatW GetTimeFormatW ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread GetLocalTime GetEnvironmentVariableW SetEnvironmentVariableW FileTimeToLocalFileTime GetLongPathNameW QueryDosDeviceW ProcessIdToSessionId GetModuleFileNameW FileTimeToSystemTime WaitForMultipleObjects OutputDebugStringW GetNativeSystemInfo IsWow64Process GetPrivateProfileIntW GetCommandLineW MapViewOfFileEx lstrcmpiW TerminateThread GetLocaleInfoW GetUserDefaultUILanguage GetModuleHandleExW SetErrorMode GetFileSizeEx GetSystemTime SystemTimeToTzSpecificLocalTime SystemTimeToFileTime CreateFileA DeviceIoControl OpenThread SetThreadPriority GetThreadPriority SuspendThread GetThreadContext FlushInstructionCache VirtualProtect VirtualQuery VirtualProtectEx OutputDebugStringA GetEnvironmentStringsW LoadLibraryExA WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockShared AcquireSRWLockShared EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetLocaleInfoEx InterlockedPopEntrySList InterlockedPushEntrySList RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA GetFileType WriteConsoleW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetTimeZoneInformation ReadConsoleW SetStdHandle IsValidCodePage GetACP GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_051c3a93615f1f9a9d13f240422253e9_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

kernel32

generic