2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc
Size 7.7MB
Sample260728-gqlftack5s
SHA256 e7ec78ac36e5badb9ff04dbd4cfddee3da22b1876c0ea5533db1a50324f41aba
MD5 043c5750d1edf4bff5df4993bfcb8a3d
SHA1 619a289d0f21b1b2e12cf8456f63ec4a2f3f6e39
SHA512 75e1e23f0d9401c6769669810b961311a2e560999e9fbac16f28bfd92d48c8a55cbfea3a88ec45cac560688f8243bc090e778cea393da3d6fb558d374f166af5
SSDEEP 196608:5w0Ykbfk2JChWGxvUL44vGxxMxaCSBeuS4Ro1MKMOAIuUuSnmOz+8RkyqWCZzJEK:5whkbfk2J/GxG44uxixaCSBeuS4Ro1Mj
TLSH
T109866D22E140D731FDA30131AA6D7EB4421EAF641B25E1E3B78CBD4E15723D67A34A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc

File Explorer

2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc

.exe 7.7MB

2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc

IMPHASH 94e0e773b7a6bbf578b48acf58a80da8
SHA256 e7ec78ac36e5badb9ff04dbd4cfddee3da22b1876c0ea5533db1a50324f41aba
MD5 043c5750d1edf4bff5df4993bfcb8a3d
SHA1 619a289d0f21b1b2e12cf8456f63ec4a2f3f6e39
SHA512 75e1e23f0d9401c6769669810b961311a2e560999e9fbac16f28bfd92d48c8a55cbfea3a88ec45cac560688f8243bc090e778cea393da3d6fb558d374f166af5
SSDEEP 196608:5w0Ykbfk2JChWGxvUL44vGxxMxaCSBeuS4Ro1MKMOAIuUuSnmOz+8RkyqWCZzJEK:5whkbfk2J/GxG44uxixaCSBeuS4Ro1Mj
TLSH
T109866D22E140D731FDA30131AA6D7EB4421EAF641B25E1E3B78CBD4E15723D67A34A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

f0:90:2f:41:75:bf:88:dd:29:76:a5:c0:30:2f:c6:76:97:e6:8c:a6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110108766259016Q,CN=DVDFab Software Inc.,O=DVDFab Software Inc.,STREET=海淀区北四环西路9号2108,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 12, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 6, 2023 - Sep 6, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2565843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Work\InstallProject\setup\Release\R_Online.pdb

ws2_32

ioctlsocket shutdown htonl getservbyname WSAGetLastError gethostbyname sendto recvfrom inet_ntoa inet_addr WSACleanup gethostname accept listen WSAStartup freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAWaitForMultipleEvents WSASocketW WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

wldap32

ord211 ord143 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord46 ord30 ord301 ord200

kernel32

GetTimeZoneInformation FreeEnvironmentStringsW GetSystemDefaultLangID DeleteFileW Sleep GetExitCodeProcess CloseHandle TerminateProcess GetTickCount GetPrivateProfileIntW WaitForSingleObject LoadLibraryA GetProcAddress FreeLibrary FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW WideCharToMultiByte OpenFileMappingW MapViewOfFile GetLastError CreateFileMappingW UnmapViewOfFile MulDiv SetUnhandledExceptionFilter OutputDebugStringW GetPrivateProfileStringW MoveFileExW OutputDebugStringA DeleteFileA GetCommandLineW CreateDirectoryW LoadLibraryW VirtualAlloc VirtualFree GetModuleHandleA GetVersionExA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateEventA CreateSemaphoreA AreFileApisANSI MultiByteToWideChar LoadLibraryExW GetModuleFileNameA GetModuleFileNameW LocalFree FormatMessageA FormatMessageW GetCurrentProcessId GetCurrentThreadId SetLastError SetFileTime GetModuleHandleW GetSystemDirectoryA GetTempPathA GetTempPathW GetWindowsDirectoryA SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryA RemoveDirectoryA RemoveDirectoryW CreateFileW SetFileAttributesA MoveFileA MoveFileW FindClose GetLogicalDriveStringsA GetLogicalDriveStringsW GetFileAttributesA FindFirstFileA FindNextFileA GetFileSize WriteFile ReadFile DeviceIoControl SetEndOfFile SetFilePointer CreateFileA GetFileInformationByHandle GetDriveTypeA GetDriveTypeW SetWaitableTimer GetDiskFreeSpaceW ReadConsoleW GetFileAttributesExW CompareFileTime FileTimeToSystemTime GlobalMemoryStatus GetSystemInfo GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime LocalFileTimeToFileTime FileTimeToLocalFileTime WaitForMultipleObjects GetStdHandle QueryPerformanceCounter SetProcessAffinityMask OpenEventA OpenFileMappingA GetProcessTimes SetConsoleCtrlHandler SetFileApisToOEM GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode OpenProcess lstrcmpiW CreateToolhelp32Snapshot Process32FirstW Process32NextW LockResource LoadResource SizeofResource FindResourceW GetDiskFreeSpaceExA GetVersionExW GetLocaleInfoA ReleaseMutex CreateMutexW GetLocalTime GetNativeSystemInfo SystemTimeToFileTime InitializeCriticalSectionEx SleepEx GetTickCount64 WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA FlushConsoleInputBuffer GetSystemTime GetEnvironmentStringsW TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleHandleExW ExitProcess ReadConsoleInputA SetFilePointerEx HeapReAlloc RaiseException RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent SystemTimeToTzSpecificLocalTime ExitThread CreateThread GetStringTypeW DecodePointer EncodePointer AllocConsole SetConsoleTitleA FreeConsole lstrlenA IsDBCSLeadByte GlobalUnlock GlobalLock CreateProcessA MoveFileExA CopyFileA QueryDosDeviceA GetShortPathNameA HeapFree HeapAlloc GetProcessHeap IsValidLocale GetUserDefaultLCID GetVolumeInformationA SetStdHandle IsValidCodePage GetCurrentThread HeapSize VirtualQuery GetThreadTimes InitializeSListHead WriteConsoleW SetEnvironmentVariableA GetFullPathNameW WaitForMultipleObjectsEx GetCurrentProcess ResumeThread CreateWaitableTimerA GetCPInfo UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetStartupInfoW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetConsoleCP FlushFileBuffers FindFirstFileExW GetOEMCP GetDiskFreeSpaceA GetLocaleInfoW EnumSystemLocalesW GetACP

user32

GetProcessWindowStation GetDesktopWindow InvalidateRect ClientToScreen ReleaseCapture SetCapture GetWindowThreadProcessId PostMessageW ExitWindowsEx CharPrevExA CharUpperW CharUpperA GetWindowRgn DestroyWindow SetWindowLongW GetWindowLongW RegisterClassExW GetUserObjectInformationW DefWindowProcW FindWindowW GetWindowTextW MessageBoxW EndDialog OffsetRect MessageBoxA SendMessageA LoadIconW SetWindowTextA CreateWindowExW MoveWindow EnableWindow wsprintfW DrawTextA ReleaseDC DrawTextW FillRect GetClientRect GetDC DialogBoxParamW LoadStringW SetWindowPos GetSystemMetrics GetWindowRect CreateDialogParamW ShowWindow SetWindowTextW SendMessageW GetDlgItem SetTimer LoadBitmapW OpenDesktopA EnumDesktopWindows CloseDesktop PostMessageA IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable GetForegroundWindow SystemParametersInfoA CharNextA LoadStringA LoadCursorW KillTimer

gdi32

GetTextExtentPointW PtInRegion CreateRectRgn CreateDIBSection CreateFontIndirectW GetDeviceCaps DeleteDC BitBlt SetTextColor SetBkMode CreateSolidBrush SelectObject CreateCompatibleDC SetBitmapBits CreateCompatibleBitmap GetBitmapBits GetObjectW DeleteObject

advapi32

RegisterEventSourceA DeregisterEventSource RegQueryInfoKeyA RegOpenKeyA RegEnumValueA RegEnumKeyA RegCreateKeyExA CryptReleaseContext CryptGenRandom CryptAcquireContextA RegSetValueA RegQueryValueA RegEnumKeyExA RegDeleteValueA RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegCloseKey CheckTokenMembership DuplicateTokenEx LookupPrivilegeValueW FreeSid AllocateAndInitializeSid GetFileSecurityW LookupPrivilegeValueA SetFileSecurityW AdjustTokenPrivileges OpenProcessToken ReportEventA

shell32

SHGetFolderPathW SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHBrowseForFolderW ShellExecuteExW ShellExecuteW ShellExecuteA SHGetPathFromIDListA ShellExecuteExA SHGetPathFromIDListW

ole32

CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance CoCreateGuid CoSetProxyBlanket CoTaskMemFree CoInitialize

oleaut32

SysFreeString VariantCopy VariantClear SysAllocStringLen SysStringLen SysAllocString

powrprof

SetSuspendState

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

shlwapi

PathRemoveFileSpecW PathAppendA StrRChrW StrCatW StrCmpW StrChrW StrCpyNW StrCpyW PathFileExistsW PathAppendW PathFileExistsA PathIsDirectoryW

netapi32

NetApiBufferFree NetWkstaGetInfo

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

731KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

powrprof

version

shlwapi

netapi32

psapi

iphlpapi

dbghelp

generic