2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader
Size 14.0MB
Sample260629-e5sgkac15w
SHA256 4a465658121a15449fadbeed82d37c461e601ae45c08a3d6c992285d31ebf804
MD5 a040670ccbe6b4c9841d8706c433997c
SHA1 f8feca6cc45f6b934201c28a8c0d86409fce8836
SHA512 79bcac67be6c987d06af6a0034e4eede1afe6a07b2345318eae3dcec6efec930f6b7017def5c8009683d6d46e164dddd78ef1d03033b65b2b8ae851a4a390122
SSDEEP 393216:DubmdBDPg48m6pJ+o6SVP1CPwDvt3uFrCeP2NOUAQWuS:H6N6GWuS
TLSH
T1E3E6AE03B7859135E49B2A79046B97755D3E7E202B21CDDB57B038AC4E316C2AE3E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader

.exe 14.0MB

2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 578cc8e30a11aa15cbed91e618811b6e
SHA256 4a465658121a15449fadbeed82d37c461e601ae45c08a3d6c992285d31ebf804
MD5 a040670ccbe6b4c9841d8706c433997c
SHA1 f8feca6cc45f6b934201c28a8c0d86409fce8836
SHA512 79bcac67be6c987d06af6a0034e4eede1afe6a07b2345318eae3dcec6efec930f6b7017def5c8009683d6d46e164dddd78ef1d03033b65b2b8ae851a4a390122
SSDEEP 393216:DubmdBDPg48m6pJ+o6SVP1CPwDvt3uFrCeP2NOUAQWuS:H6N6GWuS
TLSH
T1E3E6AE03B7859135E49B2A79046B97755D3E7E202B21CDDB57B038AC4E316C2AE3E34E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4a:bf:2b:f3:e9:66:09:40:63:44:c4:d5:76:53:43:74:76:e5:4e:2b:6d:e9:0c:7b:ff:70:37:07:8c:d3:4a:37

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Incredibuild Software Ltd.,O=Incredibuild Software Ltd.,ST=Tel Aviv,C=IL

Chains

Aug 16, 2022

CN=Incredibuild Software Ltd.,O=Incredibuild Software Ltd.,ST=Tel Aviv,C=IL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Incredibuild Software Ltd.,O=Incredibuild Software Ltd.,ST=Tel Aviv,C=IL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Incredibuild Software Ltd.,O=Incredibuild Software Ltd.,ST=Tel Aviv,C=IL

Serial Number

70:98:77:4e:d2:9b:05:65:ab:11:4e:f2:f2:87:1c:f7

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 18, 2022 - Jul 17, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6482752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

usp10

ScriptGetProperties ScriptItemize ScriptShape ScriptLayout ScriptApplyDigitSubstitution

winmm

timeEndPeriod timeBeginPeriod sndPlaySoundW timeGetTime

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

FindTextW ChooseFontW GetSaveFileNameW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

SHBrowseForFolderW DragFinish SHGetMalloc DragQueryPoint SHGetDesktopFolder DragQueryFileW DragAcceptFiles Shell_NotifyIconW SHAppBarMessage ShellExecuteW SHGetPathFromIDListW

user32

MoveWindow CopyImage SetMenuItemInfoW GetMenuItemInfoW SetCaretPos DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID DestroyCaret CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild SendDlgItemMessageW IsIconic CallNextHookEx ShowWindow SetForegroundWindow GetWindowTextW GetAsyncKeyState IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC GetClassLongW SetScrollRange DrawTextW PeekMessageA MessageBeep SetClassLongW RemovePropW GetSubMenu DestroyIcon IsWindowVisible PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW DragDetect NotifyWinEvent LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW EnumClipboardFormats GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState ValidateRect IsCharAlphaW GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement CreateIconIndirect CreateWindowExW ChildWindowFromPoint GetMessageW GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect AnimateWindow SetTimer WindowFromPoint BeginPaint DrawStateW RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW ClientToScreen SetClipboardData GetClipboardData SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent CreateCaret MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW GetDoubleClickTime EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect SetKeyboardState GetKeyboardState ScreenToClient DrawFrameControl IsCharAlphaNumericW BringWindowToTop SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CountClipboardFormats CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowLongW GetWindowRect InsertMenuW IsWindowEnabled IsDialogMessageA CharNextA GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW VerQueryValueA GetFileVersionInfoW

uiautomationcore

UiaReturnRawElementProvider

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantCopyInd VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW GetUserNameW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

msvcrt

isupper isalpha isalnum toupper memchr memcmp memcpy memset isprint isspace iscntrl isxdigit ispunct isgraph islower tolower

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

kernel32

SetFileAttributesW GetFileType QueryDosDeviceW GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource IsValidCodePage TerminateThread QueryPerformanceFrequency IsDebuggerPresent FindNextFileW FlushInstructionCache GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GlobalSize GetSystemTime GetLongPathNameW WriteProcessMemory RtlUnwind GetCPInfo EnumSystemLocalesW UnregisterWait GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile GetUserDefaultLCID GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW MapViewOfFile CreateMutexW LoadLibraryA GetVolumeInformationW ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion RaiseException MoveFileW GlobalAddAtomW GetSystemTimeAsFileTime FormatMessageW SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread GetFileAttributesExW IsBadReadPtr GetPriorityClass LoadLibraryExW LockResource FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex LoadResource SuspendThread GetTickCount WritePrivateProfileStringW WaitForMultipleObjects GetTempFileNameW GetFileSize GlobalDeleteAtom GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess GlobalLock SetThreadPriority VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetProcessTimes GetProcessAffinityMask LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP SetProcessAffinityMask UnmapViewOfFile GetConsoleCP lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar CreateMutexA LoadLibraryW SetEvent GetLocaleInfoW CreateFileW EnumResourceNamesW DeleteFileW SetThreadAffinityMask GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW RegisterWaitForSingleObject GetProfileStringW LocalAlloc RemoveDirectoryW CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

shfolder

SHGetFolderPathW

ole32

RevokeDragDrop CoCreateInstance CoUninitialize ReleaseStgMedium OleSetClipboard RegisterDragDrop IsEqualGUID CreateStreamOnHGlobal OleFlushClipboard OleInitialize CoInitializeEx OleUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc DoDragDrop

gdi32

Pie EnumEnhMetaFile SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc ResizePalette SetAbortProc SetTextColor StretchBlt RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW PolyBezierTo CreateICW GetStockObject CreateSolidBrush Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect SetMapMode GetMapMode CreateFontIndirectW PolyBezier EndDoc GetObjectW GetFontData GetWinMetaFileBits SetROP2 GetOutlineTextMetricsW GetEnhMetaFileDescriptionW ArcTo CreateEnhMetaFileW Arc SelectPalette SetGraphicsMode ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits GetCharABCWidthsA Rectangle SaveDC DeleteDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap CombineRgn SetWinMetaFileBits SetDCBrushColor CreateDIBitmap GetStretchBltMode CreateDIBSection SetStretchBltMode GetDIBits LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel GetPolyFillMode EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

163KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

111B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

376B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512KB

Virtual Size

511KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

usp10

winmm

oleacc

winspool.drv

comdlg32

comctl32

shell32

user32

version

uiautomationcore

oleaut32

wtsapi32

advapi32

msvcrt

winhttp

kernel32

shfolder

ole32

gdi32

generic