2026-07-22_7bac59461f07cf42a7a16773d60ba53d_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_7bac59461f07cf42a7a16773d60ba53d_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 5.5MB
Sample260722-3pyweadf56
SHA256 0ce69b649367cde6de01f98cbdc38d0e3e032ba45cd267ca2e846c30efc2e355
MD5 7bac59461f07cf42a7a16773d60ba53d
SHA1 1957fb6d8e4bbd60f855b6498cf418e95a1205b8
SHA512 4fa4cf755805e6745cc5284ea801e93c52ccde4336f9d20644167737d3a732d4510520885e402c5bc766182fd60edc84501bbe6eaba4828e440ad720e1478654
SSDEEP 98304:wiND5xwLgedxF7LGS+UGbGC2urextRgNB:rND5BedxF7LB+U8GZ6v
TLSH
T129467C107642C537E5E100B1AA6D9BAB1018BF340BB594D3F3D43EEA65B05E33A36E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_7bac59461f07cf42a7a16773d60ba53d_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 5.5MB

2026-07-22_7bac59461f07cf42a7a16773d60ba53d_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 9e90d9904dd27602c4563be36bfb3831
SHA256 0ce69b649367cde6de01f98cbdc38d0e3e032ba45cd267ca2e846c30efc2e355
MD5 7bac59461f07cf42a7a16773d60ba53d
SHA1 1957fb6d8e4bbd60f855b6498cf418e95a1205b8
SHA512 4fa4cf755805e6745cc5284ea801e93c52ccde4336f9d20644167737d3a732d4510520885e402c5bc766182fd60edc84501bbe6eaba4828e440ad720e1478654
SSDEEP 98304:wiND5xwLgedxF7LGS+UGbGC2urextRgNB:rND5BedxF7LB+U8GZ6v
TLSH
T129467C107642C537E5E100B1AA6D9BAB1018BF340BB594D3F3D43EEA65B05E33A36E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

8a:7b:3b:7a:d5:d2:26:39:34:d0:98:f0:98:09:9b:45:26:f9:43:95:bf:d8:ab:c5:4e:aa:bb:38:df:ae:b7:85

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913101150729060470,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c0ce6b5a6e4b89ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

fb:42:72:fa:a5:85:9d:d5:3a:2b:72:b9:b9:a4:30:7b:70:07:e1:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jun 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

3417312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Work\2345input\bin\Win32\Release\pdb\FaceTool_2345Pinyin.pdb

dbghelp

MiniDumpWriteDump

shlwapi

PathFindFileNameW ord12 StrToIntA PathAppendW StrDupW

msimg32

AlphaBlend

comctl32

_TrackMouseEvent InitCommonControlsEx

imm32

ImmDisableIME ImmNotifyIME ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetTempFileNameW RemoveDirectoryW SetLastError InterlockedExchangeAdd InterlockedExchange WriteFile FindFirstFileW FindNextFileW FindClose UnmapViewOfFile DuplicateHandle SystemTimeToFileTime WideCharToMultiByte GetFileType GetSystemTime CreateFileMappingW MapViewOfFile CreateDirectoryW SetFileTime MultiByteToWideChar GetCurrentDirectoryW DosDateTimeToFileTime AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA UnlockFileEx GetTempPathW CreateMutexW GetEnvironmentVariableA GetVersionExW HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter FlushFileBuffers ExitProcess GetFileTime GetDriveTypeW GetACP ResumeThread GetLongPathNameW ReleaseMutex QueryDosDeviceW lstrcatW lstrcpyW lstrcmpiW LoadLibraryExW GetEnvironmentVariableW GetVolumeInformationW GetLogicalDriveStringsW GetWindowsDirectoryW MoveFileW GetFileSizeEx LCMapStringW WritePrivateProfileStringW GetTickCount WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA lstrlenW DeviceIoControl SetStdHandle SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation GetStdHandle PeekNamedPipe FindFirstFileExW FreeLibraryAndExitThread ExitThread RtlUnwind OpenThread SetThreadContext GetThreadContext CreateToolhelp32Snapshot SuspendThread Thread32First Thread32Next LoadLibraryExA VirtualFree VirtualAlloc InterlockedPushEntrySList InterlockedPopEntrySList FlushInstructionCache GetModuleHandleExW VirtualProtect CreateThread DisableThreadLibraryCalls GetModuleHandleA FreeResource MapViewOfFileEx CreateWaitableTimerW SetWaitableTimer lstrcmpW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetCPInfo GetLocaleInfoW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency GetStringTypeW LocalFree LocalAlloc GetLocalTime GetCurrentProcess OpenEventW GetStartupInfoW GlobalMemoryStatusEx ResetEvent SetEvent CreateEventW VirtualQuery OpenMutexW OpenFileMappingW OpenProcess SetEndOfFile SetFilePointer GetFileAttributesW MulDiv GetExitCodeProcess FreeLibrary CreateProcessW GetProcAddress LoadLibraryW GetPrivateProfileStringW GetFileSize FindResourceW LoadResource CloseHandle LockResource CreateFileW SizeofResource ReadFile CopyFileW MoveFileExW DeleteFileW SetFileAttributesW GetCurrentProcessId GetModuleHandleW SetErrorMode GetCurrentThreadId InterlockedIncrement InterlockedDecrement GlobalUnlock GlobalLock GetModuleFileNameW GetOEMCP ExpandEnvironmentStringsW WaitForMultipleObjects GetLastError InitializeCriticalSectionAndSpinCount SystemTimeToTzSpecificLocalTime RaiseException DecodePointer DeleteCriticalSection WaitForSingleObject Sleep GlobalAlloc GlobalFree IsValidCodePage FileTimeToSystemTime

user32

GetSysColor GetIconInfo LoadBitmapW MsgWaitForMultipleObjects FillRect UpdateLayeredWindow SetCaretPos SetRectEmpty GetCaretBlinkTime ToAscii DialogBoxParamW CharNextW GetMessageW DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage GetClassLongW AdjustWindowRectEx ShowWindowAsync SetWindowRgn InvalidateRgn IsChild GetPropW ValidateRect RegisterWindowMessageW MoveWindow SetFocus SetParent BeginPaint EndPaint TrackMouseEvent SetCapture ReleaseCapture GetWindowDC RedrawWindow EnumThreadWindows RegisterClassExW CreateWindowExW GetDCEx InvalidateRect GetAncestor GetClassInfoExW EqualRect IsZoomed SetCursor CreateAcceleratorTableW DestroyAcceleratorTable GetFocus SetPropW RemovePropW EnumChildWindows UnionRect SetRect GetWindowTextLengthW MonitorFromPoint GetWindow MonitorFromWindow SetWindowTextW GetMonitorInfoW MapWindowPoints GetClassNameW GetDlgItem EnableWindow GetWindowTextW LoadStringW FindWindowExW MessageBoxW GetSystemMetrics WindowFromPoint IsWindow SystemParametersInfoW GetParent DrawIconEx GetDC ReleaseDC RegisterClipboardFormatW GetKeyState GetKeyboardState EmptyClipboard SetClipboardData SendInput DrawTextW LoadImageW GetDesktopWindow DestroyWindow AttachThreadInput LoadIconW EndDialog GetClientRect CopyRect GetAsyncKeyState LoadCursorW GetWindowThreadProcessId GetWindowRect IsWindowVisible keybd_event ScreenToClient GetActiveWindow ClientToScreen GetForegroundWindow KillTimer PtInRect SetForegroundWindow IsIconic GetCursorPos GetWindowLongW DefWindowProcW CallWindowProcW SetWindowPos SetClipboardViewer ShowWindow OpenClipboard SetTimer ChangeClipboardChain CloseClipboard GetClipboardData SetWindowLongW IsClipboardFormatAvailable SendMessageW UnregisterClassW FindWindowW PostMessageW OffsetRect IntersectRect IsRectEmpty

gdi32

CreatePolygonRgn CreateRectRgnIndirect GetRgnBox CreateSolidBrush EnumFontsW GetClipBox GetDIBits CreateDCW CreateRoundRectRgn PtInRegion GetTextMetricsW SetViewportOrgEx EnumFontFamiliesW GetStockObject GetDeviceCaps CreateFontIndirectW CreateCompatibleBitmap ExtTextOutW BitBlt SelectObject CreateDIBSection SetGraphicsMode GetBitmapBits SetTextColor SetBkMode GetObjectW SetBkColor DeleteObject SetWorldTransform CreateCompatibleDC DeleteDC

comdlg32

GetOpenFileNameW

advapi32

GetAclInformation GetAce GetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW SystemFunction036 EqualSid RegQueryInfoKeyW LookupAccountNameW GetFileSecurityW GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW

shell32

SHGetFolderPathW DragFinish DragQueryFileW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoGetClassObject OleUninitialize StringFromGUID2 CLSIDFromProgID OleInitialize CLSIDFromString CoTaskMemFree CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal CoCreateInstance

oleaut32

DispCallFunc SysStringLen SysAllocStringLen SysFreeString VariantClear SysAllocString LoadRegTypeLi OleCreateFontIndirect VariantInit VarUI4FromStr LoadTypeLi

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

gdiplus

GdipSetLineTransform GdipGetBrushType GdipCombineRegionRegion GdipAddPathRectangleI GdipAddPathArcI GdipAddPathEllipseI GdipCombineRegionPath GdipAddPathBezierI GdipAddPathLineI GdipCreateRegionPath GdipGetInterpolationMode GdipGetLineTransform GdipSetImageAttributesColorMatrix GdipSetCompositingQuality GdipGetFamily GdipGetTextRenderingHint GdipAddPathString GdipGetStringFormatLineAlign GdipGetEmHeight GdipSaveGraphics GdipCreateLineBrushI GdipSetLineWrapMode GdipGetLineSpacing GdipCreateMatrix2 GdipDisposeImageAttributes GdipDeletePath GdipGetStringFormatAlign GdipCreateMatrix GdipSetSmoothingMode GdipEndContainer GdipCreatePath GdipSetStringFormatLineAlign GdipSetLinePresetBlend GdipGetCellDescent GdipCloneBitmapArea GdipGetFontStyle GdipSetStringFormatTrimming GdipTransformRegion GdipFillPath GdipGetPathWorldBounds GdipMultiplyWorldTransform GdipGraphicsClear GdipSetPenDashStyle GdipDrawLine GdipDrawRectangle GdipScaleWorldTransform GdipSetClipRectI GdipClosePathFigure GdipGetSmoothingMode GdipDrawArcI GdipCreateImageAttributes GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetImageAttributesWrapMode GdipGetClipBoundsI GdipFillEllipse GdipBeginContainer2 GdipCreateTexture GdipGetTextureTransform GdipGetMatrixElements GdipCloneStringFormat GdipSetTextRenderingHint GdipGetCellAscent GdipStringFormatGetGenericTypographic GdipRotateWorldTransform GdipRestoreGraphics GdipDeleteRegion ord1 GdipDeleteStringFormat GdipGetFontSize GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawImageRectRectI GdipDeleteMatrix GdipGetFamilyName GdipCloneRegion GdipSetStringFormatFlags GdipCloneBitmapAreaI GdiplusStartup GdiplusShutdown GdipCreateHBITMAPFromBitmap GdipReleaseDC GdipGetDC GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFont GdipCreateFromHDC GdipMeasureString GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipDrawImageRectRect GdipBitmapUnlockBits GdipDeleteBrush GdipGetPropertyItem GdipSetInterpolationMode GdipCreateSolidFill GdipGetImagePixelFormat GdipSetPixelOffsetMode GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageGraphicsContext GdipFillRectangleI GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetPropertyItemSize GdipCloneImage GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipSetTextureTransform GdipCloneBrush GdipSetCompositingMode

iphlpapi

GetAdaptersAddresses

winmm

timeGetTime

psapi

GetMappedFileNameW

generic

count=50, id=241, version=40116,

count=184, id=243, version=40116,

count=44, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=33, id=259, version=26706,

count=81, id=261, version=26706,

count=38, id=260, version=26706,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=261, version=27032,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=694, id=1, productName=Unmarked objects,

count=1, id=259, version=27053,

count=35, productName=Unmarked objects (old),

count=29, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=670, id=265, version=27053,

count=1, id=256, version=27053,

count=1, id=255, version=27053,

count=1, id=151,

count=1, id=258, version=27053,