2026-06-30_67dd4d094ea96664828e64de2a4d072f_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_67dd4d094ea96664828e64de2a4d072f_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_revil
Size 48.9MB
Sample260701-e7s6waet8q
SHA256 dc6fcdffbbda0a68cdf13979acbb1e8f833f87db74bdb5efbd2c5a5ee174499e
MD5 67dd4d094ea96664828e64de2a4d072f
SHA1 32b58ca0648ef50cc205636b71babd0422750a0d
SHA512 72f7975adc3779ba9c7f10424b579b54c7d6d6f03d393bdbf9bc6b7d22d5bfa3b8ed1e051b4a4fb7ce401279b1daa618a08478fa1f488a433eb78508ccba241d
SSDEEP 786432:I1eGrMVP6Y/wzVG9mEDCPEWo/uerjwgYInITryeb4xrBOfmmVm:AeGrMVZwhG9m3k2gYInQrTcrtGm
TLSH
T1DDB733227A818171C5A6007181BD6B3E49BDAE211F2C89D3B7DC3A794F311D3AA3DB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-30_67dd4d094ea96664828e64de2a4d072f_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_revil

.exe 48.9MB

2026-06-30_67dd4d094ea96664828e64de2a4d072f_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_revil

IMPHASH 27be26f135d963a82ea0ae3c053fd2e0
SHA256 dc6fcdffbbda0a68cdf13979acbb1e8f833f87db74bdb5efbd2c5a5ee174499e
MD5 67dd4d094ea96664828e64de2a4d072f
SHA1 32b58ca0648ef50cc205636b71babd0422750a0d
SHA512 72f7975adc3779ba9c7f10424b579b54c7d6d6f03d393bdbf9bc6b7d22d5bfa3b8ed1e051b4a4fb7ce401279b1daa618a08478fa1f488a433eb78508ccba241d
SSDEEP 786432:I1eGrMVP6Y/wzVG9mEDCPEWo/uerjwgYInITryeb4xrBOfmmVm:AeGrMVZwhG9m3k2gYInQrTcrtGm
TLSH
T1DDB733227A818171C5A6007181BD6B3E49BDAE211F2C89D3B7DC3A794F311D3AA3DB57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

8a:7e:c8:c2:54:1e:4e:51:74:fa:ab:b7:d5:5a:c1:c0:1d:5a:3c:2b:a8:8c:83:fb:40:ef:13:7e:d0:70:7a:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MABTJENYXY,CN=成都赤侠信息科技有限公司,O=成都赤侠信息科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

May 15, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:16:29:35:15:97:69:fc:c4:b5:02:55:64:86:c8:07

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 20, 2025 - Aug 18, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Minor OS version

Major OS version

Entry point

666761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\dllfix-install\install_uninstall_code\Release\Install.pdb

kernel32

WaitForMultipleObjects ExitThread LoadLibraryExW lstrcmpiW WritePrivateProfileStringW GetDriveTypeW InterlockedPopEntrySList RtlCaptureStackBackTrace GetFileInformationByHandle CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW SearchPathW CreateDirectoryW GetCurrentDirectoryW SetFileTime InitializeSListHead EncodePointer IsDebuggerPresent GetShortPathNameW InterlockedCompareExchange InterlockedExchange GetDiskFreeSpaceExW GetSystemDirectoryW VerifyVersionInfoW GetCurrentThreadId InitializeCriticalSectionAndSpinCount VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer CreateThread WaitForSingleObject GetCommandLineW lstrcpynW LocalFree GetLocalTime LoadLibraryW FreeLibrary TerminateProcess GetCurrentProcess WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleW GetVersionExW GetTickCount UnlockFile ReadFile LockFile GetFileSize CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot ReleaseMutex SetEndOfFile GetModuleFileNameW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler GetConsoleMode GetConsoleCP GetTimeZoneInformation SetFilePointerEx OpenProcess GetCurrentProcessId CreateFileA CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLongPathNameW MoveFileExW MoveFileW lstrlenW FindResourceW Sleep LockResource LoadResource FindResourceExW CreateEventW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW WriteConsoleW GetFileType GetStdHandle ExitProcess GetModuleHandleExW ResumeThread RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore SetProcessAffinityMask GetEnvironmentVariableW InterlockedIncrement GetTempFileNameW GetPrivateProfileStringW lstrlenA VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue lstrcmpiA lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW FindFirstFileW FindClose DeleteFileW FreeResource GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GlobalFree GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo QueryPerformanceFrequency QueryPerformanceCounter GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SizeofResource SetEvent FormatMessageW GetNativeSystemInfo GetExitCodeThread GetCurrentThread SwitchToThread WaitForSingleObjectEx DuplicateHandle GetStringTypeW TryEnterCriticalSection LoadLibraryExA VirtualFree CloseHandle GetTempFileNameA GetTempPathA WriteFile DeleteFileA ReadConsoleW VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache SetFilePointer MapViewOfFile UnmapViewOfFile CreateFileMappingW GetFileAttributesExW GetExitCodeProcess GetLogicalDriveStringsW QueryDosDeviceW InterlockedDecrement CopyFileW GetFileSizeEx OutputDebugStringA OutputDebugStringW ResetEvent GetSystemInfo LocalAlloc InterlockedPushEntrySList

user32

GetShellWindow DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW LoadStringW ShowWindow GetWindowThreadProcessId FindWindowExW UpdateLayeredWindow SetWindowPos GetFocus GetAsyncKeyState SetCapture SendMessageW UnregisterClassA PostMessageW ReleaseDC GetDC DrawTextW IsWindowEnabled KillTimer SetTimer UnregisterClassW BeginPaint IsDialogMessageW GetActiveWindow EndDialog DialogBoxParamW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow MapWindowPoints RedrawWindow SetForegroundWindow GetSystemMetrics EnableWindow SetFocus IsIconic IsWindowVisible wsprintfW SendMessageTimeoutW FindWindowW CopyRect UnionRect OffsetRect EqualRect PtInRect SetCursor DrawFocusRect EndPaint MoveWindow PostQuitMessage CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW FillRect ScreenToClient GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect ReleaseCapture

gdi32

OffsetViewportOrgEx RectVisible EnumFontFamiliesW CreateFontW CreateCompatibleDC BitBlt CreateCompatibleBitmap DeleteDC DeleteObject GetStockObject RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetTextColor CreateDIBSection GetObjectW SetViewportOrgEx CreateRectRgnIndirect

advapi32

RegQueryValueExA FreeSid AllocateAndInitializeSid SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW GetUserNameW CreateWellKnownSid EqualSid DeleteAce RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegCloseKey LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken RegOpenKeyExA RegEnumKeyExA GetTokenInformation CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW LookupAccountSidW GetTrusteeNameW BuildExplicitAccessWithNameW GetExplicitEntriesFromAclW LookupAccountNameW CheckTokenMembership

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteExW SHChangeNotify ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderPathW ord165 CommandLineToArgvW SHBrowseForFolderW SHFileOperationW

ole32

CLSIDFromProgID CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CreateStreamOnHGlobal OleRun OleUninitialize OleInitialize CoTaskMemFree CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoInitialize CoUninitialize CoCreateInstance

oleaut32

VarBstrCmp VariantClear SysFreeString SysAllocString SysStringByteLen VarUI4FromStr SysStringLen VariantInit VariantChangeType GetErrorInfo SetErrorInfo CreateErrorInfo SysAllocStringByteLen VariantCopy

shlwapi

SHGetValueW SHGetValueA StrToIntExW StrCmpIW StrTrimA StrCmpNIW StrStrIA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameW wnsprintfW PathIsPrefixW PathIsDirectoryW PathRemoveFileSpecW SHSetValueW SHDeleteValueW AssocQueryStringW SHSetValueA PathIsRootW PathIsRelativeW StrStrIW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipFillPath GdipSetSmoothingMode GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCreateFromHDC GdipDeleteGraphics GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcesses

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

setupapi

SetupIterateCabinetW

crypt32

CertGetNameStringW CryptStringToBinaryA CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

generic

count=1, id=261, version=27031,

count=22, id=259, version=26213,

count=191, id=261, version=26213,

count=2, id=262, version=26213,

count=1, id=260, version=27054,

count=6, id=261, version=27054,

count=4, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=264, version=27045,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27048,

count=3, id=199, version=41118,

count=24, id=259, version=26706,

count=38, id=260, version=26706,

count=22, id=261, version=27051,

count=131, id=261, version=26706,

count=29, id=260, version=26213,

count=37, id=257, version=26213,

count=481, id=1, productName=Unmarked objects,

count=75, id=261, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,