2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

General

Target
2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
Size 5.9MB
Sample261102-mt8cmsgz5y
SHA256 a1bcd0780d5dd85fe6d526388ef9b064b0e150a267f3292fcc872ff0ffc4e7a3
MD5 b7e33ca51e78a38e7a1027fa52f5bef6
SHA1 fca1e365f01ec35eb147238679b23a04240e2fc3
SHA512 f2d4b01d1a2b9a5b5c8a0a0e9b5f5dd53d108469e360b6ac6c624e5d2b7fb51dd96dda65dba6d6d8ba61a635e84552358ecf8a6876fbe72a07f6ceadc7374335
SSDEEP 98304:hTokqTTe4T5LbbyBNDxJgHOJQtdnxNaznXhjND/1m2+k:akqGkJbWBcnxNcXhJz1/+k
TLSH
T1BE56B001FB8AC5B1E59201B0197AAB7A487DAE285B3084C7E7D01D6E84316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

File Explorer

2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

.exe 5.9MB

2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

IMPHASH dd31bf306a1f3f864e7e9e5f70ac72a2
SHA256 a1bcd0780d5dd85fe6d526388ef9b064b0e150a267f3292fcc872ff0ffc4e7a3
MD5 b7e33ca51e78a38e7a1027fa52f5bef6
SHA1 fca1e365f01ec35eb147238679b23a04240e2fc3
SHA512 f2d4b01d1a2b9a5b5c8a0a0e9b5f5dd53d108469e360b6ac6c624e5d2b7fb51dd96dda65dba6d6d8ba61a635e84552358ecf8a6876fbe72a07f6ceadc7374335
SSDEEP 98304:hTokqTTe4T5LbbyBNDxJgHOJQtdnxNaznXhjND/1m2+k:akqGkJbWBcnxNcXhJz1/+k
TLSH
T1BE56B001FB8AC5B1E59201B0197AAB7A487DAE285B3084C7E7D01D6E84316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3192039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW SetDllDirectoryW GetFileAttributesW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount VerSetConditionMask GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetShortPathNameW GetTempFileNameW SetFileTime WriteFile GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetSystemTimeAsFileTime GetNativeSystemInfo ReadProcessMemory GetModuleHandleA GetModuleHandleExW lstrlenW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemWow64DirectoryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc SetEvent CreateEventW ExitProcess FreeResource MulDiv FindClose FindFirstFileW FindNextFileW RemoveDirectoryW CopyFileW FileTimeToLocalFileTime GetVolumeInformationW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateProcessW GetPrivateProfileStringW GetLongPathNameW ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW GlobalAlloc GlobalUnlock GlobalLock DuplicateHandle DosDateTimeToFileTime GetEnvironmentStringsW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b7e33ca51e78a38e7a1027fa52f5bef6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil

kernel32

generic