2026-07-08_614b40951cd267a202e88e840fb6354e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_614b40951cd267a202e88e840fb6354e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader
Size 2.4MB
Sample260708-3tkvcabw3z
SHA256 d03da9db79b3cd84eed578081e923286ca3fd5c9a36f529f32e964cb909a3de0
MD5 614b40951cd267a202e88e840fb6354e
SHA1 b9ba2a5bd47f04b16d209d540de2b3ac64a48358
SHA512 4b6aceed50b36bab02f1dcf8d3ff91e6cfe07622c52ac447bf57aaa30080ad187ffa802460480053e69db45f3d5b4e9f464c00b983d0689a9a9031991ff0f5cd
SSDEEP 49152:SuyQJPcl+GsEYrpcrUMDIB9t9i2cOhPNokvpsG3AjOmRwpfQv:DbJPc8fzQU7HnokGGi
TLSH
T1A4C59D1EFB828C71E5DE0A3511AA573F4D3AAE205328CDD787B138669E301D2763E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-08_614b40951cd267a202e88e840fb6354e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

.exe 2.4MB

2026-07-08_614b40951cd267a202e88e840fb6354e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

IMPHASH 5cca288bbc1f5f9c3ef79ca12219bbb3
SHA256 d03da9db79b3cd84eed578081e923286ca3fd5c9a36f529f32e964cb909a3de0
MD5 614b40951cd267a202e88e840fb6354e
SHA1 b9ba2a5bd47f04b16d209d540de2b3ac64a48358
SHA512 4b6aceed50b36bab02f1dcf8d3ff91e6cfe07622c52ac447bf57aaa30080ad187ffa802460480053e69db45f3d5b4e9f464c00b983d0689a9a9031991ff0f5cd
SSDEEP 49152:SuyQJPcl+GsEYrpcrUMDIB9t9i2cOhPNokvpsG3AjOmRwpfQv:DbJPc8fzQU7HnokGGi
TLSH
T1A4C59D1EFB828C71E5DE0A3511AA573F4D3AAE205328CDD787B138669E301D2763E395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

b3:6f:8a:fd:a3:56:28:0a:7c:27:c7:33:02:c2:7d:3f:09:40:3c:e3:d5:05:a7:d2:55:09:ab:0f:e0:ad:73:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Orient Webcasting Co.\, Ltd.,O=Shanghai Orient Webcasting Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:d7:af:1e:13:3e:af:9a:7e:18:d9:bb:96:c0:12:88

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - Mar 28, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

68771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead lstrlenW FreeLibrary GetProcAddress GlobalAlloc GlobalFree LocalAlloc LocalFree HeapAlloc HeapFree GetProcessHeap OpenProcess GetExitCodeProcess GetLastError WaitForSingleObject lstrcpyW LoadLibraryW CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW FindClose GetEnvironmentVariableW GetDriveTypeW GetSystemDirectoryW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW WTSGetActiveConsoleSessionId FileTimeToSystemTime ReleaseMutex CreateMutexW GetVolumeInformationW DecodePointer HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection ReadFile MultiByteToWideChar WideCharToMultiByte WriteFile GetFileAttributesExW DeviceIoControl OutputDebugStringA SetPriorityClass SetErrorMode RtlUnwind UnhandledExceptionFilter EncodePointer SetLastError EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime GetCurrentThread GetCurrentProcess GetConsoleMode ReadConsoleW SetFilePointerEx CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler OutputDebugStringW SetStdHandle GetTimeZoneInformation GetConsoleCP FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW WriteConsoleW SetEndOfFile SetEvent FreeLibraryAndExitThread ExitThread SystemTimeToFileTime GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber VerifyVersionInfoA GetSystemDirectoryA GetVersionExW GetThreadTimes GetModuleFileNameW GetTickCount Sleep CreateThread GetFileSize MoveFileExW CreateFileW GetTempPathW OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects SleepEx InitializeCriticalSection FormatMessageA GetStringTypeW SetUnhandledExceptionFilter CloseHandle GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GlobalAddAtomW

user32

UpdateWindow GetWindowLongW SetWindowLongW LoadCursorW LoadIconW PostMessageW SetTimer KillTimer GetMessageW TranslateMessage ShowWindow CreateWindowExW RegisterClassExW LoadStringW wsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW PostQuitMessage DefWindowProcW UnregisterHotKey RegisterHotKey GetAsyncKeyState DispatchMessageW

shlwapi

PathAddBackslashW PathFileExistsW

wtsapi32

WTSQueryUserToken

advapi32

CryptGenRandom RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken GetTokenInformation LookupAccountNameW GetSecurityDescriptorDacl GetSecurityDescriptorControl AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl GetLengthSid EqualSid ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey CryptReleaseContext CryptAcquireContextW ImpersonateLoggedOnUser RevertToSelf DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW

urlmon

URLDownloadToFileW

wldap32

ord211 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord46 ord143 ord60

ws2_32

getsockname getpeername connect closesocket bind WSASetLastError getsockopt htons WSAGetLastError ntohs __WSAFDIsSet send recv WSACleanup WSAStartup setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname select

generic

count=2, id=261, version=23013,

count=22, id=241, version=40116,

count=197, id=243, version=40116,

count=31, id=242, version=40116,

count=5, id=199, version=41118,

count=25, id=259, version=24123,

count=14, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=117, id=261, version=24123,

count=39, id=260, version=24123,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=376, id=1, productName=Unmarked objects,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=62, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,