2026-07-20_0c0c36472dd9631abade1eb5c957e7ac_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_0c0c36472dd9631abade1eb5c957e7ac_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil
Size 7.0MB
Sample260720-d4vd4agy2t
SHA256 ca961d736ab8e8a9824d38125f5ffde973764290888a865927b3fb58062896bc
MD5 0c0c36472dd9631abade1eb5c957e7ac
SHA1 ecbbcc4973b7f2fac26bb9989258b1863f3637ea
SHA512 b972f881592340033e0b55c12cb5ea87afb698a1ebde50776f2b1224222fa753e49c35b390d42f8981e0d2b570bb74fdcd4fbf835d16ce3ece94cc89ad1168d0
SSDEEP 196608:AQ7+lLNnJSMY7rMVpqMWtLSFLOyomFHKnPqM:AQInJSM+MqLSFLM
TLSH
T1C3767A153A8B88A2DE4B11316957A739953AEEA43F67CCF73140F67D59702C0393A22F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-20_0c0c36472dd9631abade1eb5c957e7ac_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

.exe 7.0MB

2026-07-20_0c0c36472dd9631abade1eb5c957e7ac_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

IMPHASH 33df9e3fa2e00c72d22b29d4d4becc16
SHA256 ca961d736ab8e8a9824d38125f5ffde973764290888a865927b3fb58062896bc
MD5 0c0c36472dd9631abade1eb5c957e7ac
SHA1 ecbbcc4973b7f2fac26bb9989258b1863f3637ea
SHA512 b972f881592340033e0b55c12cb5ea87afb698a1ebde50776f2b1224222fa753e49c35b390d42f8981e0d2b570bb74fdcd4fbf835d16ce3ece94cc89ad1168d0
SSDEEP 196608:AQ7+lLNnJSMY7rMVpqMWtLSFLOyomFHKnPqM:AQInJSM+MqLSFLM
TLSH
T1C3767A153A8B88A2DE4B11316957A739953AEEA43F67CCF73140F67D59702C0393A22F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

5e:ac:cb:b2:98:d0:51:b6:36:de:89:41:a5:5b:a1:36:a3:d4:ac:85:f0:95:39:22:8f:03:cd:a9:eb:45:0d:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=144-81-18454,CN=Kakao Games Corp.,O=Kakao Games Corp.,L=Seongnam-si,ST=Gyeonggi Province,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 23, 2022

SERIALNUMBER=144-81-18454,CN=Kakao Games Corp.,O=Kakao Games Corp.,L=Seongnam-si,ST=Gyeonggi Province,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

SERIALNUMBER=144-81-18454,CN=Kakao Games Corp.,O=Kakao Games Corp.,L=Seongnam-si,ST=Gyeonggi Province,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

SERIALNUMBER=144-81-18454,CN=Kakao Games Corp.,O=Kakao Games Corp.,L=Seongnam-si,ST=Gyeonggi Province,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

1a:47:b0:0d:2f:b7:d6:e3:03:a4:3f:0d:8d:1c:fc:a6

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 30, 2022 - May 29, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Unit 2021,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5f:1c:bc:8c:5c:3e:5f:6f:24:fd:3a:4f:e4:88:d6:28

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 10, 2021 - Sep 8, 2031

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

2501672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\kakao\work\Source\poe-installer\BridgeSetup\Release\BridgeSetup.pdb

ws2_32

getnameinfo gethostname ioctlsocket sendto recvfrom listen accept freeaddrinfo getaddrinfo WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket shutdown WSAGetLastError

wldap32

ord145 ord219 ord46 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord118 ord41 ord208 ord216 ord14

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

advapi32

RegDeleteKeyW RegCloseKey RegDeleteValueW RegQueryValueExW RegCreateKeyExW RegEnumKeyW RegQueryValueW RegEnumValueW RegEnumKeyExW RegSetValueExW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegOpenKeyExW

user32

UnionRect SetCursorPos NotifyWinEvent WindowFromPoint MessageBeep GetSystemMenu SetCapture GetAsyncKeyState TrackMouseEvent MonitorFromPoint SetParent EmptyClipboard SetClipboardData CloseClipboard OpenClipboard RealChildWindowFromPoint DeleteMenu CopyImage SendDlgItemMessageA ReuseDDElParam UnpackDDElParam DestroyIcon IntersectRect InsertMenuItemW DestroyMenu EnableScrollBar TranslateAcceleratorW LoadAcceleratorsW ReleaseCapture BringWindowToTop IsZoomed MapVirtualKeyW GetKeyNameTextW CharUpperW IsDialogMessageW SetWindowTextW wsprintfW EnableWindow LoadBitmapW SendMessageW GetParent GetSysColor GetClientRect PtInRect GetDC ReleaseDC FillRect DrawTextW InvalidateRect LoadImageW SetRect CopyRect LockWindowUpdate GetDoubleClickTime GetIconInfo CopyIcon GetMenuItemInfoW GetMenuDefaultItem SetMenuDefaultItem CreatePopupMenu GetWindowRgn DestroyCursor InvertRect HideCaret CheckDlgButton MoveWindow ShowWindow MonitorFromWindow WinHelpW GetMenuCheckMarkDimensions GetScrollInfo SetScrollInfo GetWindow GetTopWindow GetClassLongW AdjustWindowRectEx MessageBoxW GetUserObjectInformationW GetProcessWindowStation UnregisterClassW PostMessageW SetClassLongW DrawIcon GetSystemMetrics IsIconic LoadIconW SetWindowPos GetClassNameW GetDlgItem SetWindowLongW GetWindowLongW UpdateWindow CreateMenu GetComboBoxInfo TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar MapVirtualKeyExW IsCharLowerW GetNextDlgGroupItem WaitMessage PostThreadMessageW IsClipboardFormatAvailable CharUpperBuffW RegisterClipboardFormatW SubtractRect MapDialogRect UpdateLayeredWindow CopyAcceleratorTableW CreateAcceleratorTableW GetKeyboardState GetKeyboardLayout ToUnicodeEx GetUpdateRect DestroyAcceleratorTable GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW EqualRect IsWindowVisible GetWindowRect IsWindow LoadCursorW SetTimer KillTimer SetCursor SetPropW ShowScrollBar GetScrollRange SetScrollRange RedrawWindow IsRectEmpty InflateRect FrameRect GrayStringW DrawTextExW TabbedTextOutW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu PostQuitMessage RegisterWindowMessageW DrawEdge DrawFrameControl GetFocus DrawStateW SetWindowRgn MapWindowPoints GetSysColorBrush DrawFocusRect OffsetRect DrawIconEx DestroyWindow CreateDialogIndirectParamW EndDialog GetNextDlgTabItem GetActiveWindow IsWindowEnabled SetActiveWindow GetDesktopWindow DefWindowProcW GetClassInfoW SetLayeredWindowAttributes SetRectEmpty SystemParametersInfoW GetMonitorInfoW EnumDisplayMonitors GetWindowThreadProcessId GetLastActivePopup GetWindowDC BeginPaint EndPaint ClientToScreen ScreenToClient GetCursorPos SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetScrollPos SetMenuItemInfoW GetMessageW TranslateMessage DispatchMessageW PeekMessageW GetKeyState ValidateRect ShowOwnedPopups LoadMenuW GetMessagePos GetMessageTime CallWindowProcW RegisterClassW GetClassInfoExW CreateWindowExW IsMenu IsChild GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetDlgCtrlID SetFocus GetCapture GetMenu SetMenu TrackPopupMenu GetForegroundWindow SetForegroundWindow ScrollWindow SetScrollPos ModifyMenuW

kernel32

GetProcAddress LoadLibraryW VerifyVersionInfoW QueryPerformanceCounter GetTickCount WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode FormatMessageW WriteFile GetSystemTimeAsFileTime SleepEx DeleteFiber CreateFiber GetCurrentProcessId GlobalMemoryStatus ConvertFiberToThread ConvertThreadToFiber GetSystemTime GlobalSize LocalFree OutputDebugStringA GetCurrentThread GetCurrentThreadId GetVersionExW GetModuleHandleA LoadLibraryExW GlobalDeleteAtom lstrcmpA LoadLibraryA SetThreadPriority GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GlobalAddAtomW EncodePointer GlobalFindAtomW CompareStringW CreateFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle GetCurrentProcess GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc FileTimeToSystemTime GetCurrentDirectoryW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetModuleHandleW VirtualProtect FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime SetErrorMode GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID FindResourceExW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW WideCharToMultiByte CopyFileW GetModuleFileNameW Sleep GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree GetNativeSystemInfo GetDiskFreeSpaceExW GetWindowsDirectoryW lstrcmpiW SystemTimeToFileTime MultiByteToWideChar ResetEvent SetEvent GlobalAlloc ResumeThread GlobalFree MulDiv GlobalUnlock GlobalLock CreateEventW CreateProcessW GetLastError CreateMutexW CreateDirectoryW FindResourceW LoadResource LockResource SizeofResource FindClose FindNextFileW DeleteFileW FindFirstFileW lstrlenW lstrcmpW lstrcpyW GetFileAttributesW WaitForSingleObject TerminateProcess CloseHandle FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency GetTempPathW VerSetConditionMask OutputDebugStringW TryEnterCriticalSection GetStringTypeW SwitchToThread GetExitCodeThread LCMapStringW GetCPInfo RtlUnwind InterlockedPushEntrySList InterlockedFlushSList CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle SetFilePointerEx SetConsoleCtrlHandler ExitProcess GetCommandLineA GetCommandLineW HeapQueryInformation GetSystemInfo VirtualAlloc VirtualQuery SetStdHandle GetConsoleOutputCP GetTimeZoneInformation IsValidLocale EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualFree ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx SwitchToFiber

gdi32

MoveToEx SetViewportExtEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx SetRectRgn DPtoLP RealizePalette CreateDIBSection SetDIBColorTable CreateRoundRectRgn Rectangle GetRgnBox OffsetRgn RoundRect CreatePalette GetPaletteEntries SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW LPtoDP ExtFloodFill SetPaletteEntries FillRgn SelectPalette ExtSelectClipRgn SelectClipRgn SetViewportOrgEx FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx SetPixelV GetTextFaceW LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetObjectType GetClipBox ExcludeClipRect GetTextCharsetInfo EnumFontFamiliesW CreatePatternBrush CreatePen GetTextMetricsW Polyline Polygon CreatePolygonRgn PatBlt GetTextColor GetBkColor Ellipse CreateRectRgnIndirect CreateRectRgn CreateHatchBrush CreateEllipticRgn CombineRgn CreateDCW CopyMetaFileW CreateDIBitmap GetPixel SetPixel StretchBlt CreateFontIndirectW GetStockObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetDeviceCaps GetObjectW RestoreDC SetTextColor SetBkMode SaveDC SetBkColor CreateCompatibleBitmap CreateBitmap GetTextExtentPoint32W DeleteDC BitBlt SelectObject CreateCompatibleDC CreateSolidBrush DeleteObject GetWindowOrgEx

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

shell32

SHAppBarMessage DragFinish ShellExecuteW SHGetFolderPathW SHGetDesktopFolder SHGetFileInfoW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation DragQueryFileW

comctl32

_TrackMouseEvent InitCommonControlsEx ImageList_GetIcon

uxtheme

IsThemeBackgroundPartiallyTransparent GetThemePartSize GetThemeSysColor IsAppThemed DrawThemeParentBackground GetCurrentThemeName DrawThemeText GetWindowTheme GetThemeColor DrawThemeBackground CloseThemeData OpenThemeData

ole32

CoInitialize CoCreateInstance CoUninitialize CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree CoInitializeEx IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoDisconnectObject CoCreateGuid ReleaseStgMedium OleDuplicateData

oleaut32

VariantCopy VarBstrFromDate SysFreeString SysAllocString SysStringLen SysAllocStringLen VariantInit VariantClear VariantChangeType OleLoadPicture LoadTypeLi SystemTimeToVariantTime VariantTimeToSystemTime

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundW

shlwapi

PathFindFileNameW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathFindExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_0c0c36472dd9631abade1eb5c957e7ac_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

ws2_32

wldap32

crypt32

advapi32

user32

kernel32

gdi32

msimg32

winspool.drv

shell32

comctl32

uxtheme

ole32

oleaut32

gdiplus

version

oleacc

imm32

winmm

shlwapi

generic