2026-11-01_893ae532f5cd2a2c07c4502bdcabb8d9_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_893ae532f5cd2a2c07c4502bdcabb8d9_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil
Size 4.1MB
Sample261102-s35k1abs2s
SHA256 b23ae3e6e01c7573e02237542f70469df5d7b47a7ed2b7b6e15578665300ef03
MD5 893ae532f5cd2a2c07c4502bdcabb8d9
SHA1 d29f40d50ca51aac969446f78c0fc1694329de50
SHA512 5b030393654897ccb612707cc44f119d87a53a641e150268c08f68d22c867dcf28bb9a535c2b29036a65bb7cabef7d95a13d27d9de5f80c4c78451bef12794c1
SSDEEP 98304:lvk4uR3oLBzDniuL+ng+B5BrIpq5PiHD527BWG:i463wHiuL+7rccYVQBWG
TLSH
T1DF16BF117A01C432E59101B149B97FBA897C6D399F3958C79BE01DAA89312D32F3BF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_893ae532f5cd2a2c07c4502bdcabb8d9_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

File Explorer

2026-11-01_893ae532f5cd2a2c07c4502bdcabb8d9_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

.exe 4.1MB

2026-11-01_893ae532f5cd2a2c07c4502bdcabb8d9_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil

IMPHASH 1523d39594d317df8aad2a170b177ca2
SHA256 b23ae3e6e01c7573e02237542f70469df5d7b47a7ed2b7b6e15578665300ef03
MD5 893ae532f5cd2a2c07c4502bdcabb8d9
SHA1 d29f40d50ca51aac969446f78c0fc1694329de50
SHA512 5b030393654897ccb612707cc44f119d87a53a641e150268c08f68d22c867dcf28bb9a535c2b29036a65bb7cabef7d95a13d27d9de5f80c4c78451bef12794c1
SSDEEP 98304:lvk4uR3oLBzDniuL+ng+B5BrIpq5PiHD527BWG:i463wHiuL+7rccYVQBWG
TLSH
T1DF16BF117A01C432E59101B149B97FBA897C6D399F3958C79BE01DAA89312D32F3BF27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2157696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\GoCart\7.2.0\source\gocartclient\public\gcdirectorywatcher\binaries\windows\release\AGMService.pdb

msi

ord205

iphlpapi

GetAdaptersAddresses

setupapi

CM_Get_DevNode_Status SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW

psapi

GetProcessImageFileNameW

winhttp

WinHttpQueryAuthSchemes WinHttpCrackUrl WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle

shlwapi

PathRenameExtensionW PathAppendW PathFindFileNameW PathRemoveBackslashW PathStripPathW PathIsDirectoryW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW PathRemoveFileSpecW PathFindExtensionW PathFileExistsW

shell32

SHGetFolderPathW SHCreateDirectoryExW SHGetFolderLocation SHGetPathFromIDListW

rpcrt4

UuidCreate UuidToStringW UuidToStringA RpcStringFreeA RpcStringFreeW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

netapi32

NetApiBufferFree NetWkstaGetInfo

ws2_32

inet_ntoa

kernel32

CreateThread GetTickCount QueueUserWorkItem InitializeCriticalSectionAndSpinCount LoadResource LockResource SizeofResource FindResourceW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueTimer DeleteTimerQueue CompareFileTime ReleaseSemaphore CreateSemaphoreW GetProcessTimes OpenProcess lstrlenW K32EnumProcesses K32GetProcessImageFileNameW GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW ReleaseMutex GetCurrentProcess ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject LocalAlloc LocalFree CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW DecodePointer RaiseException SetLastError HeapDestroy HeapReAlloc HeapSize DeleteCriticalSection GetSystemTime GetComputerNameExW GetVersionExW SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringA GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency GetTempPathW GetModuleHandleExW FreeLibrary GetProcAddress LoadLibraryW InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WriteFile SetFilePointer GetCurrentThreadId TryEnterCriticalSection ReadFile GetFileSizeEx GetLocalTime FindFirstChangeNotificationW GetDateFormatW CreateMutexW OpenMutexW CreateDirectoryW FlushFileBuffers GetFileSize LockFileEx SetEndOfFile UnlockFileEx lstrcmpW SetFileAttributesW GetFileAttributesExW MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetCurrentProcessId CreateFileMappingA UnlockFile HeapCompact GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA Sleep GetTempPathA HeapValidate UnmapViewOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI GetACP GetStdHandle GetFileType GetModuleHandleA FlushConsoleInputBuffer MoveFileW CreateProcessW lstrcmpA SetHandleInformation CreatePipe PeekNamedPipe FileTimeToSystemTime GlobalFree GetCurrentThread GetThreadTimes SetFilePointerEx TerminateThread ConnectNamedPipe CreateNamedPipeW GetTimeZoneInformation SwitchToThread GetModuleHandleW ResetEvent TlsGetValue TlsAlloc GetStringTypeW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter CreateEventW WaitForSingleObject SetEvent GetProcessHeap HeapFree HeapAlloc TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime SetFileTime MoveFileExW ExitThread FreeLibraryAndExitThread ExitProcess SetConsoleCtrlHandler GetConsoleCP GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentDirectoryW SetStdHandle SetConsoleMode ReadConsoleInputW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation ChangeTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualAlloc VirtualProtect VirtualFree DuplicateHandle InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx LocalFileTimeToFileTime UnhandledExceptionFilter GetLastError lstrcatW DosDateTimeToFileTime WaitForMultipleObjects FormatMessageW GetFileTime CloseHandle GetTimeFormatW GlobalMemoryStatus

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxA

advapi32

InitializeSecurityDescriptor ControlService EnumDependentServicesW OpenServiceW QueryServiceStatusEx RevertToSelf CreateProcessAsUserW OpenProcessToken GetNamedSecurityInfoW OpenThreadToken CreateWellKnownSid CopySid CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExW RegCloseKey ReportEventA RegisterEventSourceA SetNamedSecurityInfoW SetSecurityInfo SetEntriesInAclW SetSecurityDescriptorDacl CloseServiceHandle FreeSid AllocateAndInitializeSid ConvertStringSidToSidW LookupPrivilegeValueW SetTokenInformation GetTokenInformation GetLengthSid EqualSid DuplicateTokenEx CreateRestrictedToken SetThreadToken QueryServiceStatus OpenSCManagerW DeleteService CreateServiceW ChangeServiceConfig2W StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ReportEventW RegisterEventSourceW DeregisterEventSource

ole32

CoUninitialize CoInitializeSecurity CoTaskMemFree CoCreateInstance CoInitializeEx CoSetProxyBlanket

oleaut32

SysAllocStringByteLen SysStringLen SysFreeString SysAllocString VariantClear

crypt32

CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptDecodeObject CryptQueryObject CryptMsgClose

wintrust

WinVerifyTrust

generic

count=25, id=259, version=26715,

count=219, id=261, version=26715,

count=20, id=260, version=28117,

count=26, id=259, version=28117,

count=25, id=260, version=26715,

count=41, id=261, version=24245,

count=7, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=16, id=265, version=28316,

count=1, id=262, version=26715,

count=5, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=32, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=154, id=261, version=28117,

count=34, id=257, version=26715,

count=393, id=1, productName=Unmarked objects,

count=324, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=167, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,