2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
Size 2.8MB
Sample260724-wcgm2avdlb
SHA256 9cf4b9ef03b1dad84d8a40f24636305dccbee9f577ed2c7edd3fa75dcc1a0f47
MD5 e8b1f037355bb8aa7afb6c61fdc76754
SHA1 2cefa75ce05f06c086de749a7a4ef9b74f54a44d
SHA512 631ba37cb119bc16a266c0e6aa3d1c7aafbed7d39aabb1f80f174e41f1f1d622d3e3908c59c3f17c3659209c4e09c00265be515570e2ee9fd8dae0d97dea1494
SSDEEP 49152:1cV7m09B8XUzd4MgGsPMYVExSi+P+Ez68ToDhdK0HkEU1X1Y41:1cV7NqDMyEXJtlu
TLSH
T1F1D5BE03FBC281E1E8F2217926BB577E8D3D6924972485D39B911C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

.exe 2.8MB

2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

IMPHASH afb64912f33cb6418e087415b120fd33
SHA256 9cf4b9ef03b1dad84d8a40f24636305dccbee9f577ed2c7edd3fa75dcc1a0f47
MD5 e8b1f037355bb8aa7afb6c61fdc76754
SHA1 2cefa75ce05f06c086de749a7a4ef9b74f54a44d
SHA512 631ba37cb119bc16a266c0e6aa3d1c7aafbed7d39aabb1f80f174e41f1f1d622d3e3908c59c3f17c3659209c4e09c00265be515570e2ee9fd8dae0d97dea1494
SSDEEP 49152:1cV7m09B8XUzd4MgGsPMYVExSi+P+Ez68ToDhdK0HkEU1X1Y41:1cV7NqDMyEXJtlu
TLSH
T1F1D5BE03FBC281E1E8F2217926BB577E8D3D6924972485D39B911C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5d:22:b6:6b:37:db:7f:0d:09:68:5d:7f:e2:b9:70:af:83:2b:c0:24:0d:d4:7d:5c:c2:6a:fd:03:64:56:2b:05:8b:a6:d7:79:71:d8:20:3c:79:8b:f0:c0:c7:70:b8:64

Digest Algorithm

sha384

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Apr 15, 2024

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

09:be:bd:8f:ba:e0:11:98:c5:52:55:0b:a6:80:f1:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 6, 2023 - May 15, 2025

Minor OS version

Major OS version

Entry point

1731151

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoTalk Updater\KakaoUpdate Build real stage\build\KakaoUpdate.pdb

kernel32

OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize DosDateTimeToFileTime GetFileTime WideCharToMultiByte FileTimeToSystemTime GetModuleFileNameW FreeLibrary GetTimeZoneInformation GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc TlsFree SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers MoveFileExW GetTickCount CreateSemaphoreW ResumeThread LocalFree GetCommandLineW GetLocalTime GetTempPathW OpenSemaphoreW WaitForSingleObject WaitForSingleObjectEx ReleaseMutex ReleaseSemaphore CloseHandle WriteConsoleW HeapSize SetEnvironmentVariableW CopyFileW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId CreateDirectoryW GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageW CreateProcessW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW DeleteFileW FreeEnvironmentStringsW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetStdHandle GetFileType GetEnvironmentVariableW VirtualFree GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SetFilePointer GetFileSizeEx GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW GetUserObjectInformationW GetProcessWindowStation CreateDialogParamW ShowWindow UpdateWindow GetDlgItem GetWindowLongW TranslateAcceleratorW SetWindowTextW DialogBoxParamW DestroyWindow DefWindowProcW PostQuitMessage MessageBoxW EndDialog PostMessageW FindWindowW GetWindowThreadProcessId BeginPaint SendMessageW LoadStringW TranslateMessage GetMessageW LoadAcceleratorsW EndPaint SetWindowLongW ExitWindowsEx

advapi32

CryptEnumProvidersW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExW SetNamedSecurityInfoW RegOpenKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

ws2_32

inet_addr ioctlsocket getsockopt ntohs select gethostbyname WSAStartup WSACleanup WSAGetLastError htonl htons inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError recv send connect setsockopt socket shutdown closesocket

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetCertificateContextProperty

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_e8b1f037355bb8aa7afb6c61fdc76754_amadey_coinminer_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

crypt32

generic