2026-07-02_46d9349c332be5d53a86371e6137791a_amadey_coinminer_darkgate_elex_glassworm_helldown_hijackloader_luca-stealer_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_46d9349c332be5d53a86371e6137791a_amadey_coinminer_darkgate_elex_glassworm_helldown_hijackloader_luca-stealer_njrat_revil_smoke-loader
Size 14.2MB
Sample260702-qlt2tscs6k
SHA256 2eca86b9cc7e23519d8d92d6229e54ab36b0fa0dc1c945019c649a19052a9666
MD5 46d9349c332be5d53a86371e6137791a
SHA1 634e7b6c0a9a627059b6c3dc6ca5be35ea7357ea
SHA512 77d3a7864b1547e91d5cbc596bdcb697304ea5ec33ae5591c3d494e67dc55e38842febc80535f6cabc44e37431d5b4d4a9d9c613afe6cdbc42a5fd0214b98252
SSDEEP 393216:gKc/mztGOv3zxCu0g7SyV7Ogk6NTdorqNE:A/mzUOPNyg7SyROghQ
TLSH
T1D5E6CF33B602C039C05202B05A69EBBDD67D9D341B3581D3B7D82E6D8B316D26B36F96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-02_46d9349c332be5d53a86371e6137791a_amadey_coinminer_darkgate_elex_glassworm_helldown_hijackloader_luca-stealer_njrat_revil_smoke-loader

File Explorer

2026-07-02_46d9349c332be5d53a86371e6137791a_amadey_coinminer_darkgate_elex_glassworm_helldown_hijackloader_luca-stealer_njrat_revil_smoke-loader

.exe 14.2MB

2026-07-02_46d9349c332be5d53a86371e6137791a_amadey_coinminer_darkgate_elex_glassworm_helldown_hijackloader_luca-stealer_njrat_revil_smoke-loader

IMPHASH fb1439ad93b016c6c0d8af0a0f759e63
SHA256 2eca86b9cc7e23519d8d92d6229e54ab36b0fa0dc1c945019c649a19052a9666
MD5 46d9349c332be5d53a86371e6137791a
SHA1 634e7b6c0a9a627059b6c3dc6ca5be35ea7357ea
SHA512 77d3a7864b1547e91d5cbc596bdcb697304ea5ec33ae5591c3d494e67dc55e38842febc80535f6cabc44e37431d5b4d4a9d9c613afe6cdbc42a5fd0214b98252
SSDEEP 393216:gKc/mztGOv3zxCu0g7SyV7Ogk6NTdorqNE:A/mzUOPNyg7SyROghQ
TLSH
T1D5E6CF33B602C039C05202B05A69EBBDD67D9D341B3581D3B7D82E6D8B316D26B36F96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

53:4f:e6:5a:0b:e3:1b:44:d2:08:b2:34:0c:92:aa:48:bf:b6:96:5a:54:a2:20:1b:c7:4c:7d:d4:8d:01:5c:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=83017338100021,CN=AVANQUEST SOFTWARE S.A.S,O=AVANQUEST SOFTWARE S.A.S,L=Courbevoie,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Feb 27, 2025

SERIALNUMBER=83017338100021,CN=AVANQUEST SOFTWARE S.A.S,O=AVANQUEST SOFTWARE S.A.S,L=Courbevoie,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

SERIALNUMBER=83017338100021,CN=AVANQUEST SOFTWARE S.A.S,O=AVANQUEST SOFTWARE S.A.S,L=Courbevoie,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

SERIALNUMBER=83017338100021,CN=AVANQUEST SOFTWARE S.A.S,O=AVANQUEST SOFTWARE S.A.S,L=Courbevoie,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Serial Number

e2:91:36:4b:00:02:99:65:95:dc:73:e8:94:3b:4b:41

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 6, 2025 - Jan 6, 2026

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7415011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure_inpixio_installer1_de_build03\4\s\_bin\inpixio\Win32\inPixioPhotoStudio12Installer.pdb

kernel32

FormatMessageA CreateEventA SetEvent TlsAlloc GetLastError EnterCriticalSection LeaveCriticalSection PostQueuedCompletionStatus TlsFree WaitForSingleObjectEx GetCurrentThreadId Sleep InitializeCriticalSection DeleteCriticalSection GetUserDefaultLCID GetStringTypeExW FreeLibrary LoadLibraryA LCMapStringW GetCommandLineW RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount CreateThread WaitForSingleObject CreateEventW GetCurrentProcess GetCurrentProcessId CreateFileW TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter GetStringTypeExA LCMapStringA GetWindowsDirectoryW GetFileAttributesExW CreateFileA WriteFile GetFileSizeEx CreateFileMappingA GetModuleHandleA SetLastError GetSystemInfo SwitchToThread DuplicateHandle UnmapViewOfFile MapViewOfFileEx SetEndOfFile SetFilePointer QueryPerformanceCounter QueryPerformanceFrequency GetTickCount GetSystemTimeAsFileTime ProcessIdToSessionId OpenProcess GetDiskFreeSpaceExW CreateProcessW GetExitCodeProcess SetFileAttributesW GetFullPathNameW ReadFile GetFileSize FindFirstFileW RemoveDirectoryW FindNextFileW FindClose LocalAlloc MultiByteToWideChar LoadResource LockResource SizeofResource FindResourceW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW CreateSemaphoreA ReleaseSemaphore WaitForMultipleObjectsEx TlsGetValue TlsSetValue CreateMutexW ReleaseMutex LoadLibraryExW GetModuleFileNameW lstrcmpiW GetLocaleInfoW CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process Process32FirstW Process32NextW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UpdateResourceA CreateMutexA LoadLibraryExA GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateSemaphoreW ResumeThread GetNativeSystemInfo GetComputerNameW CompareStringW GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID MulDiv GetTempPathA GetTempFileNameA GlobalSize GlobalUnlock GlobalLock AllocConsole GetModuleFileNameA DebugBreak SetErrorMode GetFileType GetConsoleMode SetHandleInformation CancelIo SetFileCompletionNotificationModes RegisterWaitForSingleObject UnregisterWait FlushFileBuffers ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeHandleStateW CancelIoEx CancelSynchronousIo GetCurrentThread QueueUserWorkItem CreateNamedPipeA LocalFree MapViewOfFile FlushViewOfFile ExitProcess GetFileAttributesW GetCPInfo GlobalAlloc GlobalFree LocalSize lstrlenW GetEnvironmentVariableW ResetEvent SetThreadPriority GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentDirectoryW GetTempPathW GetVersionExW SetConsoleCtrlHandler SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW WriteConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject CreateDirectoryW GetDiskFreeSpaceW GetFileInformationByHandle GetFinalPathNameByHandleW SetFilePointerEx SetFileTime DeviceIoControl ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW InitializeCriticalSectionEx GetLogicalDriveStringsW GetVolumeInformationW GetStdHandle GetStartupInfoW LoadLibraryW VirtualAlloc VirtualFree lstrcmpW GetThreadPriority VirtualProtect ConvertThreadToFiberEx ConvertFiberToThread GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber ReadConsoleA GetFileTime GetCommandLineA GetOEMCP GetACP HeapQueryInformation DeleteFileW EnumSystemLocalesW IsValidLocale SystemTimeToTzSpecificLocalTime GetDriveTypeW GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceBeginInitialize InitOnceComplete AreFileApisANSI SetFileInformationByHandle FindFirstFileExW GetExitCodeThread GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead lstrcpynW CreateWaitableTimerW GetOverlappedResult GetEnvironmentVariableA CompareFileTime GetSystemDirectoryW CreateWaitableTimerA OpenEventA SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FoldStringW EnumSystemLocalesA GetLocaleInfoA IsDBCSLeadByteEx IsValidCodePage VirtualQuery FormatMessageW WideCharToMultiByte CreateFileMappingW CloseHandle

winspool.drv

ord203

userenv

LoadUserProfileW UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock

gdiplus

GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipGetLineSpacing GdipGetCellAscent GdipGetEmHeight GdipDrawPath GdipDrawPie GdipDrawEllipse GdipDrawRectangle GdipDeleteFontFamily GdiplusShutdown GdiplusStartup GdipEndContainer GdipBeginContainer2 GdipRestoreGraphics GdipSaveGraphics GdipDrawArc GdipDrawLine GdipTransformPoints GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipResetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetClipBoundsI GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipDrawImageI GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath GdipClonePath GdipCreatePath GdipFree GdipAlloc GdipSetClipRectI GdipSetClipRect GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromGraphics GdipDrawImageRectRect GdipFillPath GdipFillPie GdipFillEllipse GdipDrawDriverString GdipSetPenMiterLimit GdipGetFontSize GdipFillRectanglesI GdipFillRectangleI GdipFillRectangle GdipBitmapUnlockBits GdipGraphicsClear

uxtheme

OpenThemeData CloseThemeData SetWindowTheme IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeBackground

usp10

ScriptFreeCache ScriptItemize ScriptApplyDigitSubstitution ScriptBreak ScriptPlace ScriptShape

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

356KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=53, id=259, version=33140,

count=2, id=253, version=23601,

count=11, id=253, version=28518,

count=22, id=260, version=30034,

count=28, id=259, version=30034,

count=899, id=260, version=30158,

count=23, productName=Unmarked objects (old),

count=144, id=261, version=30158,

count=119, id=261, version=30034,

count=48, id=260, version=33140,

count=19, id=257, version=33140,

count=227, id=261, version=33140,

count=2, id=262, version=33140,

count=942, id=1, productName=Unmarked objects,

count=218, id=260, productName=VS2019 v16.8.5 build 29337, version=29337,

count=245, id=261, productName=VS2019 v16.8.5 build 29337, version=29337,

count=151, id=264, version=30158,

count=1, id=255, version=30158,

count=1, id=151,

count=1, id=258, version=30158,