2026-11-06_e42662b916d4b7f61541ac1ee18d7358_amadey_cloudeye_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_e42662b916d4b7f61541ac1ee18d7358_amadey_cloudeye_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
Size 7.6MB
Sample261107-y9dnrae12x
SHA256 eb8d2c1b2287b5dfe30f593f678d37f9e88bfc3b46e5b09c1b5e2b6645564de5
MD5 e42662b916d4b7f61541ac1ee18d7358
SHA1 c715e967350bf2c5b44897f7a756794fb02f8e45
SHA512 969af2c80d01fa3f8dd0ad8e657696d534931cc7effd14a3628de9600a967aad0c75433c2e71482bca1dce5e6196aa0c86b07e0d0d20f40b124e3b448b7fc8d5
SSDEEP 196608:ViK9PHG+BcITAjb6V9ms95vZAL3UV3rIrMx3mUA3yv8uU:cAHvBcISb6qsDBALfNr1
TLSH
T1FA860216BFC194F3E4A301301176577E8E3AEA309738E5C397D129A99D306D16A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_e42662b916d4b7f61541ac1ee18d7358_amadey_cloudeye_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

File Explorer

2026-11-06_e42662b916d4b7f61541ac1ee18d7358_amadey_cloudeye_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

.exe 7.6MB

2026-11-06_e42662b916d4b7f61541ac1ee18d7358_amadey_cloudeye_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil

IMPHASH 46f15a90c9915cd6ef81a72e70be44f9
SHA256 eb8d2c1b2287b5dfe30f593f678d37f9e88bfc3b46e5b09c1b5e2b6645564de5
MD5 e42662b916d4b7f61541ac1ee18d7358
SHA1 c715e967350bf2c5b44897f7a756794fb02f8e45
SHA512 969af2c80d01fa3f8dd0ad8e657696d534931cc7effd14a3628de9600a967aad0c75433c2e71482bca1dce5e6196aa0c86b07e0d0d20f40b124e3b448b7fc8d5
SSDEEP 196608:ViK9PHG+BcITAjb6V9ms95vZAL3UV3rIrMx3mUA3yv8uU:cAHvBcISb6qsDBALfNr1
TLSH
T1FA860216BFC194F3E4A301301176577E8E3AEA309738E5C397D129A99D306D16A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1884066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jks\workspace\onesec_agent_dev\Package_Group\Windows\Make_agent_installer_and_ModuleData\package\build_tmp\temp\output\tbSetup.pdb

ws2_32

shutdown sendto ioctlsocket gethostname WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent select __WSAFDIsSet htonl WSAIoctl htons getpeername socket setsockopt listen connect closesocket bind accept WSASetLastError send recv getnameinfo freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup ntohs getsockopt getsockname recvfrom

wldap32

ord145 ord219 ord46 ord301 ord147 ord133 ord79 ord27 ord167 ord127 ord142 ord26 ord117 ord41 ord208 ord216 ord14

kernel32

HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentProcessId GetCurrentThreadId GetLocalTime FindResourceExW SystemTimeToFileTime GetCommandLineW GetLogicalDriveStringsW QueryDosDeviceW SetUnhandledExceptionFilter GetTempFileNameW GetTempPathW GetExitCodeProcess CreateProcessW MoveFileExW ExpandEnvironmentStringsW VerSetConditionMask IsWow64Process VerifyVersionInfoW GetSystemDirectoryW GetWindowsDirectoryW TlsAlloc GetFileAttributesW ReadFile CreatePipe CreateThread TerminateThread ProcessIdToSessionId WTSGetActiveConsoleSessionId SetLastError TlsFree FormatMessageW GetModuleHandleExW GetStdHandle GetFileType MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FreeLibrary LoadLibraryA HeapDestroy SleepEx QueryPerformanceFrequency WaitForSingleObjectEx CompareFileTime GetEnvironmentVariableA PeekNamedPipe WaitForMultipleObjects GetSystemTime FreeEnvironmentStringsW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW FormatMessageA SetFileTime GlobalSize MulDiv GlobalFree GlobalLock GlobalUnlock GlobalAlloc PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort FileTimeToSystemTime LocalFileTimeToFileTime GetCurrentDirectoryW TryEnterCriticalSection CreateEventW ResetEvent SetEvent RaiseException DecodePointer OutputDebugStringW WriteFile SetFilePointer SetEndOfFile GetFileSize FindNextFileW FindFirstFileW FindClose FileTimeToLocalFileTime DeleteFileW CreateFileW CreateDirectoryW LocalFree GetModuleFileNameW FreeResource GetTickCount SetFileAttributesW GetUserDefaultUILanguage GetLocaleInfoW FindResourceW SizeofResource LockResource LoadResource GetCurrentProcess GetModuleHandleA TlsSetValue TlsGetValue LoadLibraryW Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte GetProcAddress GetModuleHandleW OpenProcess TerminateProcess Sleep CreateMutexW WaitForSingleObject ReleaseMutex GetLastError CloseHandle VirtualQuery GetEnvironmentStringsW IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetOEMCP GetACP IsValidCodePage SetStdHandle GetTimeZoneInformation GetFileSizeEx FlushFileBuffers EnumSystemLocalesW InitializeSListHead RtlUnwind GetFullPathNameW SetFileInformationByHandle SetFilePointerEx AreFileApisANSI LoadLibraryExW GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive ExitThread SetEnvironmentVariableW FreeLibraryAndExitThread GetCommandLineA GetUserDefaultLCID EncodePointer LCMapStringEx CompareStringEx GetCPInfo lstrcmpA InitializeCriticalSectionEx IsValidLocale UnhandledExceptionFilter ExitProcess SetConsoleCtrlHandler GetDriveTypeW SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW WriteConsoleW

user32

SetWindowPos GetFocus GetKeyState SetCapture ReleaseCapture GetSystemMetrics GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect SetPropW GetPropW SetWindowTextW GetClientRect GetWindowRect GetCursorPos ScreenToClient IntersectRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW wsprintfW LoadCursorW PostQuitMessage SetTimer TranslateMessage WaitMessage LoadImageW MonitorFromWindow GetMonitorInfoW OffsetRect CharNextW SetCursor UnionRect IsZoomed SetWindowRgn MonitorFromPoint OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetAsyncKeyState ClientToScreen GetSysColor GetDesktopWindow FindWindowW PeekMessageW PostMessageW DestroyWindow CallMsgFilterW MapWindowPoints GetParent MsgWaitForMultipleObjects MessageBoxA DefWindowProcW UnregisterClassW RegisterClassExW DispatchMessageW CreateWindowExW GetQueueStatus MsgWaitForMultipleObjectsEx SendMessageW CallWindowProcW RegisterClassW GetClassInfoExW UpdateLayeredWindow ShowWindow MessageBoxW GetUserObjectInformationW GetProcessWindowStation KillTimer GetWindow EnableWindow SetFocus IsWindow GetMessageW GetWindowThreadProcessId EnumWindows SetForegroundWindow IsIconic IsWindowVisible MoveWindow

advapi32

RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash RegOpenCurrentUser CryptDestroyHash CryptSignHashW CryptEnumProvidersW DuplicateTokenEx SetThreadToken QueryServiceStatus OpenServiceW OpenSCManagerW RegOpenKeyExW RegQueryValueExW RegSetValueExW AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW CloseServiceHandle RevertToSelf

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteA

ole32

CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit SysAllocStringByteLen VariantChangeType SysFreeString SysAllocString SysStringByteLen

shlwapi

PathRemoveFileSpecW PathFileExistsW PathIsRelativeW

winmm

timeGetTime timeKillEvent timeSetEvent

comctl32

_TrackMouseEvent ord17

gdiplus

GdipDrawArc GdipSetWorldTransform GdipImageRotateFlip GdipLoadImageFromFile GdipCreatePen2 GdipSetLineBlend GdipCreateLineBrushFromRect GdipIsOutlineVisiblePathPointI GdipIsVisiblePathPointI GdipGetPathWorldBoundsI GdipTransformPath GdipAddPathPolygonI GdipAddPathPieI GdipAddPathEllipseI GdipAddPathRectangleI GdipAddPathCurveI GdipAddPathBezierI GdipAddPathLine2I GdipStartPathFigure GdipSetPathFillMode GdipGetPathFillMode GdipResetPath GdipClonePath GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipCreateBitmapFromHBITMAP GdipCreateTexture GdipSetPenDashStyle GdipGetPenDashStyle GdipSetPenColor GdipGetPenLineJoin GdipSetPenLineJoin GdipGetPenDashCap197819 GdipDrawImageRect GdipGetPenStartCap GdipSetPenDashCap197819 GdipSetPenEndCap GdipSetPenStartCap GdipGetPenWidth GdipSetPenWidth GdipClonePen GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipGetFontSize GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRect GdipFillPath GdipFillEllipseI GdipFillRectangle GdipDrawPath GdipDrawEllipseI GdipDrawBezierI GdipDrawLineI GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipReleaseDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipGetPenEndCap GdipDeleteMatrix GdipCreateMatrix GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetPropertyItemSize GdipGetImagePaletteSize GdipGetImagePalette GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipDrawRectangleI

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

msimg32

AlphaBlend

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertOpenStore CryptMsgUpdate CryptMsgGetParam CryptMsgOpenToDecode CryptDecodeObject CryptMsgClose CertOpenSystemStoreW CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CertCreateCertificateContext CertCloseStore

psapi

GetProcessImageFileNameW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

bcrypt

BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptDestroyKey BCryptVerifySignature BCryptGenRandom BCryptOpenAlgorithmProvider

gdi32

CreateRectRgnIndirect SetWindowOrgEx GetObjectA SetStretchBltMode StretchBlt SaveDC RestoreDC GetWindowOrgEx DeleteDC CreateCompatibleDC CreateDIBSection GetDeviceCaps CreateRoundRectRgn ExtSelectClipRgn SelectObject GetStockObject DeleteObject CreateFontIndirectW BitBlt GetObjectW

generic

count=23, id=259, version=28900,

count=217, id=261, version=28900,

count=7, id=253, version=28518,

count=19, id=260, version=30034,

count=25, id=259, version=30034,

count=2, id=257, version=30795,

count=1, id=260, version=30151,

count=9, id=261, version=30151,

count=100, id=261, version=30034,

count=2, id=253, version=23601,

count=1, id=263, version=28900,

count=24, id=260, version=28900,

count=1, id=262, version=28900,

count=616, id=1, productName=Unmarked objects,

count=39, id=257, version=28900,

count=101, id=260, version=30154,

count=571, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,

count=93, id=261, version=30154,

count=1, id=255, version=30154,

count=1, id=151,

count=1, id=258, version=30154,