2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

General

Target
2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 5.8MB
Sample261101-ghvphsszhx
SHA256 8bd72165f7a5bea897c55222c1485200ead512aabd3c1dede34c84226dce397e
MD5 17644d1799248a331f11db3577bfd005
SHA1 f6d331b1e22265deda2c2cd124143a6bbe7ad264
SHA512 b118afe7dde018962c84056a8adeccc70bc411e1ade8bbe21a0e3c5009bdc0d1c274f220e53836b216a9e3ef927fbb311dea497da790f4d3f559b2b11a3d3734
SSDEEP 98304:1j4vd4isvuzAliput91gAnJQgtnydH7Ot6ssGY/WpnPCM0:2v/KutAkgtns6t6m8WpPd0
TLSH
T1E856C001F78A85F1E59201B0197AAB7A587DBE285B3084C7E3D11D2A88316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

File Explorer

2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

.exe 5.8MB

2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

IMPHASH 35458e9040793a1331b4a56f3c133e64
SHA256 8bd72165f7a5bea897c55222c1485200ead512aabd3c1dede34c84226dce397e
MD5 17644d1799248a331f11db3577bfd005
SHA1 f6d331b1e22265deda2c2cd124143a6bbe7ad264
SHA512 b118afe7dde018962c84056a8adeccc70bc411e1ade8bbe21a0e3c5009bdc0d1c274f220e53836b216a9e3ef927fbb311dea497da790f4d3f559b2b11a3d3734
SSDEEP 98304:1j4vd4isvuzAliput91gAnJQgtnydH7Ot6ssGY/WpnPCM0:2v/KutAkgtns6t6m8WpPd0
TLSH
T1E856C001F78A85F1E59201B0197AAB7A587DBE285B3084C7E3D11D2A88316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3146983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_onl_i18_202610\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount VerSetConditionMask GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetShortPathNameW GetTempFileNameW SetFileTime WriteFile GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetSystemTimeAsFileTime GetNativeSystemInfo ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemWow64DirectoryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc SetEvent CreateEventW ExitProcess FreeResource MulDiv DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateProcessW GetFullPathNameW GetPrivateProfileStringW GetLongPathNameW ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW GlobalAlloc GlobalUnlock GlobalLock DuplicateHandle DosDateTimeToFileTime GetEnvironmentStringsW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

kernel32

generic