2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat
Size 3.1MB
Sample260722-xwf2aabb46
SHA256 9d7f16466744aeef804e12cd816cc0b7e5d2ed130779d173befe10fcf5654f41
MD5 cd74acfe000d403fdd22bf290a8c1aec
SHA1 5143e2eafb96bed1bc52097e8c7db48735225789
SHA512 9eaccc302bccc8e335af7ca1351f7d86de86ab1a39f8c93c04c69e31facf4647edd82fcab8431d723d434bd861e63e03ac061ee7c980827eb3669c47398cb016
SSDEEP 49152:xYJY1LxZGc8VLFWDD+lRYWwdb6lpC/1URz4ScPgDffhPgxTxzwNT+u5fXE41zx1:mY118VOgVyqc1In5ffhP35XJ
TLSH
T147E59E93F2C583B2D9C250303867773BCE36B43A8A759ACBA7801D57D831991E636F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

.exe 3.1MB

2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

IMPHASH 7bcebb3aeb014f6c25a1718c8dc71ebb
SHA256 9d7f16466744aeef804e12cd816cc0b7e5d2ed130779d173befe10fcf5654f41
MD5 cd74acfe000d403fdd22bf290a8c1aec
SHA1 5143e2eafb96bed1bc52097e8c7db48735225789
SHA512 9eaccc302bccc8e335af7ca1351f7d86de86ab1a39f8c93c04c69e31facf4647edd82fcab8431d723d434bd861e63e03ac061ee7c980827eb3669c47398cb016
SSDEEP 49152:xYJY1LxZGc8VLFWDD+lRYWwdb6lpC/1URz4ScPgDffhPgxTxzwNT+u5fXE41zx1:mY118VOgVyqc1In5ffhP35XJ
TLSH
T147E59E93F2C583B2D9C250303867773BCE36B43A8A759ACBA7801D57D831991E636F46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6d:c5:09:a2:da:a1:e2:48:e0:71:0e:21:51:34:23:c1:ff:71:40:5a:02:6f:c9:c2:f4:3e:81:ae:7f:84:fa:97

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Comarch S.A.,O=Comarch S.A.,L=Kraków,C=PL

Chains

Oct 16, 2024

CN=Comarch S.A.,O=Comarch S.A.,L=Kraków,C=PL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Comarch S.A.,O=Comarch S.A.,L=Kraków,C=PL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Comarch S.A.,O=Comarch S.A.,L=Kraków,C=PL

Serial Number

02:cf:45:b2:12:c1:06:b0:43:e0:04:0c:78:5a:16:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2022 - Oct 5, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2329950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\builder\workingDirectories\Comarch ERP Menadzer Kluczy\Release\ComarchML.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CryptVerifyMessageSignature CertNameToStrW

shlwapi

PathFileExistsW

ws2_32

closesocket WSAGetLastError WSACleanup WSAStartup socket send htonl bind listen getaddrinfo freeaddrinfo setsockopt recvfrom sendto accept htons recv

kernel32

CloseHandle GetCurrentProcess GetCurrentThread GetVersion CreateMutexW ReleaseMutex CreateThread Sleep SetEvent WaitForSingleObject GetCommandLineW DecodePointer CreateEventW GetCurrentThreadId LocalFree GetCurrentDirectoryW GetDiskFreeSpaceW GetComputerNameW GetFileAttributesW CreateFileW WriteFile FlushFileBuffers SetCurrentDirectoryW CreateSemaphoreW ReleaseSemaphore GetSystemDirectoryW LoadLibraryW GetFileSize ReadFile LocalAlloc FormatMessageW TerminateThread GetSystemInfo TlsSetValue UnmapViewOfFile FindFirstFileA GetProcessTimes SearchPathA SetErrorMode HeapReAlloc CreateFiber SystemTimeToFileTime CreateProcessW MapViewOfFile GetLocalTime DeleteFileA GetModuleFileNameA GetTickCount GetEnvironmentVariableA TlsGetValue CreateFileA GetModuleFileNameW SetFilePointer CreateFileMappingA LoadLibraryA ConvertThreadToFiber OpenSemaphoreA SetEndOfFile FindNextFileA SwitchToFiber HeapFree QueryDosDeviceA GetFileInformationByHandle SetFileAttributesW CreateEventA GetProcessHeap InterlockedDecrement SetEnvironmentVariableA QueryPerformanceCounter SwitchToThread WideCharToMultiByte ResumeThread HeapAlloc TlsAlloc GetDiskFreeSpaceA GetSystemDirectoryA FormatMessageA GetVersionExA GetWindowsDirectoryA FindClose InitializeCriticalSection DefineDosDeviceA InterlockedCompareExchange GetModuleHandleA OpenMutexA OpenProcess OutputDebugStringA DeviceIoControl GetSystemTime CreateSemaphoreA InterlockedIncrement DeleteFiber GetVolumeInformationA GetCurrentProcessId lstrcmpiA SetLastError RtlUnwind VirtualQuery InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter HeapSize LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError EnterCriticalSection RaiseException LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary DeleteCriticalSection GetDateFormatW GetTimeFormatW InitializeCriticalSectionAndSpinCount FileTimeToSystemTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx GetExitCodeProcess GetFileAttributesExW SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW TlsFree CreateMutexA InitializeCriticalSectionEx SetEnvironmentVariableW GetFullPathNameW QueryPerformanceFrequency WriteConsoleW PeekNamedPipe GetDriveTypeW GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread RemoveDirectoryW ReadConsoleW SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW GetConsoleMode GetConsoleCP MoveFileExW DeleteFileW SetFilePointerEx CreateDirectoryW GetFileType UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer GetStringTypeW OutputDebugStringW IsDebuggerPresent SetConsoleCtrlHandler

user32

GetMessageW MessageBoxW DispatchMessageW PostThreadMessageW LoadStringW CharNextW TranslateMessage CharUpperW wsprintfW

advapi32

CryptDecrypt CryptEncrypt CryptDeriveKey CryptDestroyKey CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW RegCreateKeyW RegisterServiceCtrlHandlerW CreateServiceW DeleteService ControlService CloseServiceHandle OpenServiceW OpenSCManagerW StartServiceCtrlDispatcherW RegQueryValueExW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus OpenThreadToken OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner IsValidSid GetLengthSid CopySid SetSecurityDescriptorGroup InitializeSecurityDescriptor RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID StringFromGUID2 CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize CoResumeClassObjects CoReleaseServerProcess CoAddRefServerProcess CoRevokeClassObject CoRegisterClassObject CoCreateGuid OleRun CLSIDFromString CLSIDFromProgID

oleaut32

VariantInit GetErrorInfo SetErrorInfo CreateErrorInfo VariantChangeType VariantClear RegisterTypeLi LoadTypeLi LoadRegTypeLi SysStringByteLen SysStringLen SysAllocStringByteLen SysAllocString SysFreeString VarUI4FromStr UnRegisterTypeLi

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

version

crypt32

shlwapi

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

generic