2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader
Size 2.9MB
Sample261018-v7dn7agy8x
SHA256 8c5f8ec504f119bd46ac5fcaf2ef12ffe32b7515ad093e6b3147fc7e081a1434
MD5 14431d7079ed7ed3fae2c1e8ca6f1a7b
SHA1 ffb2faa06789564b72cca52d04ff9220cde7d548
SHA512 94ee6dc7de14e469cb628354b6b48ee9ca4f0903983d804bc8f09cdd223847ab4d749cd90932d71dab395dcc1007a218d4c76bcb3f18c1ac84c0f5864689e642
SSDEEP 49152:rl3//c+1o79m+mlZxCJB26Axsp5WPjqUKPgNwJKkOie628ghTmWcgc0YJ0:x3Hj1oBOZxoB26Am5SqUKDOieN8CNcgX
TLSH
T1DFD5D002FB8294B2E4870175616B577F8D3ABE205324D9D3D7A238658D312D1AB3F3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 2.9MB

2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 2144651103120182f610bc42e5c8a2f2
SHA256 8c5f8ec504f119bd46ac5fcaf2ef12ffe32b7515ad093e6b3147fc7e081a1434
MD5 14431d7079ed7ed3fae2c1e8ca6f1a7b
SHA1 ffb2faa06789564b72cca52d04ff9220cde7d548
SHA512 94ee6dc7de14e469cb628354b6b48ee9ca4f0903983d804bc8f09cdd223847ab4d749cd90932d71dab395dcc1007a218d4c76bcb3f18c1ac84c0f5864689e642
SSDEEP 49152:rl3//c+1o79m+mlZxCJB26Axsp5WPjqUKPgNwJKkOie628ghTmWcgc0YJ0:x3Hj1oBOZxoB26Am5SqUKDOieN8CNcgX
TLSH
T1DFD5D002FB8294B2E4870175616B577F8D3ABE205324D9D3D7A238658D312D1AB3F3E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

114019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\kdumprep.pdb

kernel32

LocalFree GetFileSize FlushFileBuffers MultiByteToWideChar GetProcAddress InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW CreateFileMappingW MapViewOfFile UnmapViewOfFile SetEndOfFile GetFileAttributesExW GetTempPathW GetTempFileNameW SetLastError WaitForSingleObject CreateThread lstrcpyW lstrlenW GetModuleHandleW OpenProcess InitializeCriticalSectionAndSpinCount GetCurrentProcessId GetCurrentThreadId GetTickCount TerminateThread GetExitCodeThread OutputDebugStringA GetVersionExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx FreeLibrary MoveFileW lstrcmpiW LoadLibraryExW GetSystemDirectoryW CopyFileW GetCommandLineW CreateProcessW GetFileInformationByHandle GetLocalTime SystemTimeToFileTime OutputDebugStringW HeapAlloc LocalAlloc LoadResource FindResourceExW RaiseException HeapReAlloc WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetFileSizeEx GetConsoleOutputCP DeleteFileW SetEnvironmentVariableW FreeEnvironmentStringsW FileTimeToSystemTime GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread ExitThread GetDriveTypeW ExitProcess RtlUnwind LoadLibraryA ConvertThreadToFiber ConvertFiberToThread GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW SetFilePointer WriteFile ReadFile GetPrivateProfileStringA WideCharToMultiByte CloseHandle GetPrivateProfileStringW CreateFileW GetPrivateProfileIntW WritePrivateProfileStringW SystemTimeToTzSpecificLocalTime FindResourceW LockResource GetLastError HeapSize GetFileAttributesW FindClose InitializeCriticalSectionEx GetModuleFileNameW FindNextFileW HeapFree EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetSystemTime VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle Sleep GetProcessHeap DeleteCriticalSection HeapDestroy GetEnvironmentStringsW DecodePointer GetStringTypeW GetEnvironmentVariableA CompareFileTime MoveFileExW FormatMessageW QueryPerformanceFrequency FindFirstFileW SizeofResource SetStdHandle CreateDirectoryW SleepEx GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo IsDebuggerPresent

user32

ShowWindow SetForegroundWindow SendMessageW PostMessageW UnregisterClassW SetWindowTextW GetDlgCtrlID GetCursorPos RedrawWindow SetCursor LoadCursorW GetMessageW GetActiveWindow GetWindowDC ReleaseDC InvalidateRect UpdateWindow GetWindowTextLengthW BeginPaint EndPaint LoadBitmapW DrawIcon GetSystemMenu GetMenuItemCount GetMenuItemID PeekMessageW TranslateMessage DispatchMessageW SetDlgItemTextW GetUserObjectInformationW GetProcessWindowStation EnableWindow GetDlgItem EnableMenuItem DestroyWindow CreateDialogParamW DialogBoxParamW GetWindowTextW EndDialog SetWindowLongW GetWindowLongW LoadStringW wsprintfW GetWindowRect ScreenToClient DefWindowProcW GetDesktopWindow CharNextW KillTimer SetTimer MessageBoxW PostQuitMessage IsWindowVisible CallWindowProcW MoveWindow

gdi32

CreateBitmap SetBkColor TextOutW SetBkMode SetTextColor CreateFontW CreateSolidBrush SelectObject DeleteObject BitBlt CreateCompatibleDC DeleteDC

advapi32

RegQueryValueExW CryptReleaseContext CryptAcquireContextW ReportEventW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW CryptGenRandom RegOpenKeyExW RegCloseKey RegisterEventSourceW DeregisterEventSource

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW SHGetFileInfoW ShellExecuteA

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

StrToIntW PathFileExistsW PathAppendW PathFindExtensionW PathAddBackslashW PathRemoveFileSpecW PathFindFileNameW PathStripPathW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

ImageList_DrawEx ImageList_Destroy ImageList_LoadImageW

dbghelp

StackWalk64 MiniDumpReadDumpStream

ws2_32

getnameinfo shutdown gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select send WSAGetLastError __WSAFDIsSet bind WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket recv connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup

wininet

InternetConnectW HttpOpenRequestW InternetSetOptionW InternetOpenW InternetReadFile InternetCloseHandle HttpSendRequestW

psapi

EnumProcesses GetModuleFileNameExW GetProcessMemoryInfo

crypt32

CertCloseStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertEnumCertificatesInStore

wldap32

ord145 ord142 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord301 ord147 ord133 ord79 ord219

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_14431d7079ed7ed3fae2c1e8ca6f1a7b_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

dbghelp

ws2_32

wininet

psapi

crypt32

wldap32

generic