2026-05-10_2612b3f79e5d004b1bd948d82fedcb8e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_2612b3f79e5d004b1bd948d82fedcb8e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil
Size 9.1MB
Sample260510-rdneradv8m
SHA256 58223d6c24d4f8c80b4997b79a93babb1271fbfd770c9f864c6f5cf5d5e1a01f
MD5 2612b3f79e5d004b1bd948d82fedcb8e
SHA1 9fc2c6ddde3f8c6536587dc4850588544c53ab14
SHA512 7a03814a8b53ff06e81a6449980a73e31b44a1abedf966e8087bff900d1648f3f27c527b49cd3c0a25388258c0f02257402edf20d501702cc4d0dad974b9e5ac
SSDEEP 98304:SQNomNAKYuNYB2iUO9rCZ8fgwDT3AJJCEjdWxgBXogpg8tDWJC047U7:SQNomNHYIiUOHfgBTox8xtqJC047Y
TLSH
T145A63B7932058FE3D8FA22BD8AFAED1C528C05580F2D54F7E5D949B6840DEEA2631C35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-10_2612b3f79e5d004b1bd948d82fedcb8e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

.exe 9.1MB

2026-05-10_2612b3f79e5d004b1bd948d82fedcb8e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

IMPHASH 7f32510c9db5cbc57f43c2a60dc0cfab
SHA256 58223d6c24d4f8c80b4997b79a93babb1271fbfd770c9f864c6f5cf5d5e1a01f
MD5 2612b3f79e5d004b1bd948d82fedcb8e
SHA1 9fc2c6ddde3f8c6536587dc4850588544c53ab14
SHA512 7a03814a8b53ff06e81a6449980a73e31b44a1abedf966e8087bff900d1648f3f27c527b49cd3c0a25388258c0f02257402edf20d501702cc4d0dad974b9e5ac
SSDEEP 98304:SQNomNAKYuNYB2iUO9rCZ8fgwDT3AJJCEjdWxgBXogpg8tDWJC047U7:SQNomNHYIiUOHfgBTox8xtqJC047Y
TLSH
T145A63B7932058FE3D8FA22BD8AFAED1C528C05580F2D54F7E5D949B6840DEEA2631C35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a6:96:77:1f:9d:3d:94:08:27:15:43:ad:da:3b:5e:75:e8:a8:d6:e7:06:2a:e9:29:9d:2a:f5:a6:e3:d9:04:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 24, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:8a:2f:31:3a:b2:c2:9c:d4:2b:06:2a:0e:46:7b:0c

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5558336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\gocart-client-build\win-intel\build\gocartclient\public\gcinvokerutility\binaries\windows\release\AGCInvokerUtility.pdb

iphlpapi

GetAdaptersAddresses

psapi

GetProcessImageFileNameW

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetFolderLocation SHGetPathFromIDListW CommandLineToArgvW

shlwapi

PathRenameExtensionW PathFindFileNameW PathFindExtensionW PathIsDirectoryW PathStripPathW PathRemoveFileSpecW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW PathFileExistsW PathRemoveBackslashW PathAppendW

winhttp

WinHttpConnect WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpCrackUrl WinHttpSendRequest WinHttpGetProxyForUrl WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetOption WinHttpReadData WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpSetCredentials WinHttpOpenRequest WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpen

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

inet_ntoa

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW RpcStringFreeA UuidToStringA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

netapi32

NetWkstaGetInfo NetApiBufferFree

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdW

kernel32

HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetCurrentThreadId CreateProcessW ProcessIdToSessionId GetSystemTime GetComputerNameExW GetVersionExW GetModuleFileNameW FormatMessageW SystemTimeToFileTime MultiByteToWideChar GetLocaleInfoA GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency GetTempPathW GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetFilePointer FreeLibrary GetProcAddress LoadLibraryW TryEnterCriticalSection GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW CreateSemaphoreW VerSetConditionMask lstrlenW VerifyVersionInfoW ReleaseSemaphore GetTickCount MoveFileW K32GetProcessImageFileNameW lstrcmpA lstrcmpW SetHandleInformation CreatePipe GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW DuplicateHandle SetEvent CreateEventW GetCurrentProcess TerminateProcess ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject SetFileAttributesW FileTimeToSystemTime HeapDestroy DeviceIoControl DeleteFileW GetNativeSystemInfo GetModuleHandleW GetCurrentThread GetThreadTimes FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI GetTimeZoneInformation SwitchToThread CreateThread WaitForMultipleObjects GlobalFree GetACP GetStdHandle GetFileType GetModuleHandleA ResetEvent GlobalMemoryStatus FlushConsoleInputBuffer TlsGetValue TlsAlloc TerminateThread IsProcessorFeaturePresent GetStringTypeW SetLastError RaiseException DecodePointer RemoveDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetFileAttributesW FindNextFileW FindFirstFileW FindClose OutputDebugStringA WideCharToMultiByte GetCurrentProcessId Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess GetProcessTimes CompareFileTime GetCommandLineW LocalFree LocalAlloc Sleep CreateNamedPipeW PeekNamedPipe ConnectNamedPipe GetLastError CloseHandle WriteFile ReadFile CreateFileW TlsSetValue TlsFree EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime SetFileTime MoveFileExW ExitThread ExitProcess SetConsoleCtrlHandler GetConsoleCP SetFilePointerEx GetConsoleMode ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentDirectoryW SetStdHandle SetConsoleMode ReadConsoleInputW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW LocalFileTimeToFileTime lstrcatW DosDateTimeToFileTime GetFileTime HeapAlloc

user32

GetProcessWindowStation MessageBoxA GetUserObjectInformationW

advapi32

AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid GetUserNameW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW ControlService EnumDependentServicesW CreateProcessAsUserW OpenProcessToken ReportEventA RegisterEventSourceA DeregisterEventSource OpenThreadToken CopySid CryptGenRandom CryptReleaseContext CryptAcquireContextA GetNamedSecurityInfoW CreateWellKnownSid SetNamedSecurityInfoW ConvertSidToStringSidA RegDeleteKeyW DeleteService LookupPrivilegeValueW GetTokenInformation EqualSid DuplicateTokenEx CreateRestrictedToken SetThreadToken RegEnumKeyExW RegDeleteValueW GetSecurityDescriptorSacl

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitialize CoCreateGuid CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocStringByteLen SysStringLen SysFreeString SysAllocString

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CryptDecodeObject

wintrust

WinVerifyTrust

secur32

GetUserNameExW

bcrypt

BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGetProperty

generic

count=25, id=259, version=26715,

count=218, id=261, version=26715,

count=25, id=260, version=26715,

count=19, id=260, version=28117,

count=26, id=259, version=28117,

count=324, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=5, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=262, version=26715,

count=5, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=31, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=164, id=261, version=28117,

count=38, id=257, version=26715,

count=454, id=1, productName=Unmarked objects,

count=137, id=265, version=28316,

count=229, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,