General

  • Target
    2026-07-28_64567de7f0a0705734ae4dd42f2f8f78_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_njrat_remcos_revil
  • Size 10.4MB
  • Sample260729-bfyeqs1dla
  • SHA256 350e190880c944602f93e0f6386d555a71f4515bd140b6e437063dcdc1684dd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10

Malware Config

Signatures

  • Revoked Certificate in Chain 1 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 2026-07-28_64567de7f0a0705734ae4dd42f2f8f78_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_njrat_remcos_revil
    .exe 10.4MB

2026-07-28_64567de7f0a0705734ae4dd42f2f8f78_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_njrat_remcos_revil

  • IMPHASH cc383cb2452f24480718a603db24e376
  • SHA256 350e190880c944602f93e0f6386d555a71f4515bd140b6e437063dcdc1684dd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Revoked Certificate in Chain

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
0a:f9:cf:4c:78:08:d2:39:c1:ab:96:9b:77:a5:aa:5b:47:80:05:95:5b:fd:36:2d:ca:83:02:81:b5:cd:85:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN

PE Signature issue

Digest
00:82:c9:1d:f5:62:d2:3b:f2:fd:e9:c7:e7:d5:ac:74:35:3d:9a:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
Minor OS version
1
Major OS version
5
Entry point
432505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\jenkins_workspace\workspace\WinAssist_2.0.2.241014\default\Software\WinAssistant\Bin\Release\PopBlock.pdb