2026-07-02_b4bf6f1d836b9876c8b7a211824046d4_amadey_coinminer_darkgate_elex_glassworm_helldown_luca-stealer_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_b4bf6f1d836b9876c8b7a211824046d4_amadey_coinminer_darkgate_elex_glassworm_helldown_luca-stealer_njrat_revil_smoke-loader
Size 14.2MB
Sample260702-p53mmsgz9q
SHA256 f3361fa7c12136517d2c015f6c67a94b6f328e2c314517b7d303b0da2e313b47
MD5 b4bf6f1d836b9876c8b7a211824046d4
SHA1 12b042b218df0c974db88e4fa660cbc1c79bc2b9
SHA512 2735facb886a49a93735edefc0b06495edd29648d5c305ae9ea08119e18fb7d70930a0a4a0b1672e8e0a32d96eabf39b123e23e151a0972487816634b92dec50
SSDEEP 393216:sDCaUjI2+dhhXbVhaseXyFbg/puj/rqND:KUs2SHVhaseCFbgf
TLSH
T1FCE6CF33B602C039C05202B05A6AABB9D67DAD345F3181D7B7C82E6D8B325D16B36F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-02_b4bf6f1d836b9876c8b7a211824046d4_amadey_coinminer_darkgate_elex_glassworm_helldown_luca-stealer_njrat_revil_smoke-loader

.exe 14.2MB

2026-07-02_b4bf6f1d836b9876c8b7a211824046d4_amadey_coinminer_darkgate_elex_glassworm_helldown_luca-stealer_njrat_revil_smoke-loader

IMPHASH fb1439ad93b016c6c0d8af0a0f759e63
SHA256 f3361fa7c12136517d2c015f6c67a94b6f328e2c314517b7d303b0da2e313b47
MD5 b4bf6f1d836b9876c8b7a211824046d4
SHA1 12b042b218df0c974db88e4fa660cbc1c79bc2b9
SHA512 2735facb886a49a93735edefc0b06495edd29648d5c305ae9ea08119e18fb7d70930a0a4a0b1672e8e0a32d96eabf39b123e23e151a0972487816634b92dec50
SSDEEP 393216:sDCaUjI2+dhhXbVhaseXyFbg/puj/rqND:KUs2SHVhaseCFbgf
TLSH
T1FCE6CF33B602C039C05202B05A6AABB9D67DAD345F3181D7B7C82E6D8B325D16B36F57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

66:42:38:d5:31:99:7d:17:cd:12:2d:60:09:8c:70:7f:a6:29:98:21:5d:4d:f9:43:8e:e3:f4:6a:51:5e:4c:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=830 173 381,CN=Avanquest Software SAS,O=Avanquest Software SAS,L=Courbevoie,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13084e616e7465727265,1.3.6.1.4.1.311.60.2.1.2=#0c0ec38e6c652d64652d4672616e6365,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Jun 28, 2026

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Serial Number

07:60:2c:bf:6e:75:79:40:03:82:56:f0:ad:87:5e:d6

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2023 - Feb 13, 2033

Subject

Serial Number

01:37:63:7e:76:b2:39:8b:76:0b:cb:15:51:ef:51:55

Issuer

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 8, 2025 - Dec 7, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7419187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure_inpixio_installer1_de_build03\4\s\_bin\inpixio\Win32\inPixioPhotoStudio12Installer.pdb

kernel32

FormatMessageA CreateEventA SetEvent TlsAlloc GetLastError EnterCriticalSection LeaveCriticalSection PostQueuedCompletionStatus TlsFree WaitForSingleObjectEx GetCurrentThreadId Sleep InitializeCriticalSection DeleteCriticalSection GetUserDefaultLCID GetStringTypeExW FreeLibrary LoadLibraryA LCMapStringW GetCommandLineW RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount CreateThread WaitForSingleObject CreateEventW GetCurrentProcess GetCurrentProcessId CreateFileW TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter GetStringTypeExA LCMapStringA GetWindowsDirectoryW GetFileAttributesExW CreateFileA WriteFile GetFileSizeEx CreateFileMappingA GetModuleHandleA SetLastError GetSystemInfo SwitchToThread DuplicateHandle UnmapViewOfFile MapViewOfFileEx SetEndOfFile SetFilePointer QueryPerformanceCounter QueryPerformanceFrequency GetTickCount GetSystemTimeAsFileTime ProcessIdToSessionId OpenProcess GetDiskFreeSpaceExW CreateProcessW GetExitCodeProcess SetFileAttributesW GetFullPathNameW ReadFile GetFileSize FindFirstFileW RemoveDirectoryW FindNextFileW FindClose LocalAlloc MultiByteToWideChar LoadResource LockResource SizeofResource FindResourceW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW CreateSemaphoreA ReleaseSemaphore WaitForMultipleObjectsEx TlsGetValue TlsSetValue CreateMutexW ReleaseMutex LoadLibraryExW GetModuleFileNameW lstrcmpiW GetLocaleInfoW CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process Process32FirstW Process32NextW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UpdateResourceA CreateMutexA LoadLibraryExA GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateSemaphoreW ResumeThread GetNativeSystemInfo GetComputerNameW CompareStringW GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID MulDiv GetTempPathA GetTempFileNameA GlobalSize GlobalUnlock GlobalLock AllocConsole GetModuleFileNameA DebugBreak SetErrorMode GetFileType GetConsoleMode SetHandleInformation CancelIo SetFileCompletionNotificationModes RegisterWaitForSingleObject UnregisterWait FlushFileBuffers ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeHandleStateW CancelIoEx CancelSynchronousIo GetCurrentThread QueueUserWorkItem CreateNamedPipeA LocalFree MapViewOfFile FlushViewOfFile ExitProcess GetFileAttributesW GetCPInfo GlobalAlloc GlobalFree LocalSize lstrlenW GetEnvironmentVariableW ResetEvent SetThreadPriority GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentDirectoryW GetTempPathW GetVersionExW SetConsoleCtrlHandler SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW WriteConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject CreateDirectoryW GetDiskFreeSpaceW GetFileInformationByHandle GetFinalPathNameByHandleW SetFilePointerEx SetFileTime DeviceIoControl ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW InitializeCriticalSectionEx GetLogicalDriveStringsW GetVolumeInformationW GetStdHandle GetStartupInfoW LoadLibraryW VirtualAlloc VirtualFree lstrcmpW GetThreadPriority VirtualProtect ConvertThreadToFiberEx ConvertFiberToThread GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber ReadConsoleA GetFileTime GetCommandLineA GetOEMCP GetACP HeapQueryInformation DeleteFileW EnumSystemLocalesW IsValidLocale SystemTimeToTzSpecificLocalTime GetDriveTypeW GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceBeginInitialize InitOnceComplete AreFileApisANSI SetFileInformationByHandle FindFirstFileExW GetExitCodeThread GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead lstrcpynW CreateWaitableTimerW GetOverlappedResult GetEnvironmentVariableA CompareFileTime GetSystemDirectoryW CreateWaitableTimerA OpenEventA SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FoldStringW EnumSystemLocalesA GetLocaleInfoA IsDBCSLeadByteEx IsValidCodePage VirtualQuery FormatMessageW WideCharToMultiByte CreateFileMappingW CloseHandle

winspool.drv

ord203

userenv

LoadUserProfileW UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock

gdiplus

GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipGetLineSpacing GdipGetCellAscent GdipGetEmHeight GdipDrawPath GdipDrawPie GdipDrawEllipse GdipDrawRectangle GdipDeleteFontFamily GdiplusShutdown GdiplusStartup GdipEndContainer GdipBeginContainer2 GdipRestoreGraphics GdipSaveGraphics GdipDrawArc GdipDrawLine GdipTransformPoints GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipResetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetClipBoundsI GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipDrawImageI GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath GdipClonePath GdipCreatePath GdipFree GdipAlloc GdipSetClipRectI GdipSetClipRect GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromGraphics GdipDrawImageRectRect GdipFillPath GdipFillPie GdipFillEllipse GdipDrawDriverString GdipSetPenMiterLimit GdipGetFontSize GdipFillRectanglesI GdipFillRectangleI GdipFillRectangle GdipBitmapUnlockBits GdipGraphicsClear

uxtheme

OpenThemeData CloseThemeData SetWindowTheme IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeBackground

usp10

ScriptFreeCache ScriptItemize ScriptApplyDigitSubstitution ScriptBreak ScriptPlace ScriptShape

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

356KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=53, id=259, version=33140,

count=2, id=253, version=23601,

count=11, id=253, version=28518,

count=22, id=260, version=30034,

count=28, id=259, version=30034,

count=899, id=260, version=30158,

count=23, productName=Unmarked objects (old),

count=144, id=261, version=30158,

count=119, id=261, version=30034,

count=48, id=260, version=33140,

count=19, id=257, version=33140,

count=227, id=261, version=33140,

count=2, id=262, version=33140,

count=942, id=1, productName=Unmarked objects,

count=218, id=260, productName=VS2019 v16.8.5 build 29337, version=29337,

count=245, id=261, productName=VS2019 v16.8.5 build 29337, version=29337,

count=151, id=264, version=30158,

count=1, id=255, version=30158,

count=1, id=151,

count=1, id=258, version=30158,