General
- Target 2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil_smoke-loader
- Size 3.0MB
- Sample261102-stde6axs8m
- SHA256 18b9a099a2af21983af0886792fe4d6426d15e161d4120e76ea237979ad95505
- MD5 8ba199bdc297506cd45d08e7399e1e18
- SHA1 8d869bb10fe5701d47d3a1e65e487678b6df9402
- SHA512 bf2c19ac7321906442bd9f50e888d03a4473c037591b6ff4f68728554744e21b9b8f8088dd1970eb0d6344c6b1340aefbfb23a1c5411834007ed6653bcb1fb0f
- SSDEEP 49152:Z5CmzjNtmYO3c46XOBhvCnAaXzUT8bcBBfXZFTIO8xtP3ZJMCTEUCGHGqChOlciO:Z5CmrNehN8bcBBRFT6rJMvUCb8rSex
- TLSH T18AE5D012FB8280B2E49301745577A73F897DBA35572885C7ABC02D2D9C306D2A63E76F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil_smoke-loader
- Size 3.0MB
- SHA256 18b9a099a2af21983af0886792fe4d6426d15e161d4120e76ea237979ad95505
- MD5 8ba199bdc297506cd45d08e7399e1e18
- SHA1 8d869bb10fe5701d47d3a1e65e487678b6df9402
- SHA512 bf2c19ac7321906442bd9f50e888d03a4473c037591b6ff4f68728554744e21b9b8f8088dd1970eb0d6344c6b1340aefbfb23a1c5411834007ed6653bcb1fb0f
- SSDEEP 49152:Z5CmzjNtmYO3c46XOBhvCnAaXzUT8bcBBfXZFTIO8xtP3ZJMCTEUCGHGqChOlciO:Z5CmrNehN8bcBBRFT6rJMvUCb8rSex
- TLSH T18AE5D012FB8280B2E49301745577A73F897DBA35572885C7ABC02D2D9C306D2A63E76F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1