2026-07-29_a5f53cb039742661d67e85ba52446a0e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_a5f53cb039742661d67e85ba52446a0e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader
Size 2.3MB
Sample260729-ymacta1emd
SHA256 bb366516c42e2566f7394caabc11d94fa4a1462ac41e6cf17caa262188c80934
MD5 a5f53cb039742661d67e85ba52446a0e
SHA1 fc948afb344df72bf27bcdb050063c0b1c6f72f5
SHA512 04eb2d143fc5b39a69bb8b7f50a9130ac21993f0ff6f15ea543be50cc33418a3f15de89c07338549c467b6ee7aeba72a5affd27e86fbdbc6478f45038f46825d
SSDEEP 49152:zTaWlwENVeBxBpMbAF0d4Y0ODBvPhf8Sp0pM1u7Un7FDS:zOWlhHeBew/0hf8xu4
TLSH
T19DB5BE52FB82C472E5C209B511BA5F3E4C39BD102728C1E7979139A78E306E1663F7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-29_a5f53cb039742661d67e85ba52446a0e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

.exe 2.3MB

2026-07-29_a5f53cb039742661d67e85ba52446a0e_amadey_coinminer_elex_glassworm_hawkeye_luca-stealer_medusalocker_njrat_remcos_revil_smoke-loader

IMPHASH 34f85f172e57776e83967179efc0e3f7
SHA256 bb366516c42e2566f7394caabc11d94fa4a1462ac41e6cf17caa262188c80934
MD5 a5f53cb039742661d67e85ba52446a0e
SHA1 fc948afb344df72bf27bcdb050063c0b1c6f72f5
SHA512 04eb2d143fc5b39a69bb8b7f50a9130ac21993f0ff6f15ea543be50cc33418a3f15de89c07338549c467b6ee7aeba72a5affd27e86fbdbc6478f45038f46825d
SSDEEP 49152:zTaWlwENVeBxBpMbAF0d4Y0ODBvPhf8Sp0pM1u7Un7FDS:zOWlhHeBew/0hf8xu4
TLSH
T19DB5BE52FB82C472E5C209B511BA5F3E4C39BD102728C1E7979139A78E306E1663F7A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f2:56:04:da:d2:21:f7:74:1e:36:23:ee:fd:61:4e:c6:57:c9:32:a4:96:28:3a:4c:fc:3a:32:fc:f9:96:0a:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110105MA007G6FX4,CN=北京布丁跳跳科技有限公司,O=北京布丁跳跳科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e69c9de998b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 22, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

01:97:21:d8:53:75:f1:94:d9:9e:d5:ef:3d:61:c2:eb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 25, 2025 - Jul 22, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

65138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead lstrlenW FreeLibrary GetProcAddress GlobalAlloc GlobalFree LocalAlloc LocalFree HeapAlloc HeapFree GetProcessHeap OpenProcess GetExitCodeProcess GetLastError WaitForSingleObject lstrcpyW LoadLibraryW CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW FindClose GetEnvironmentVariableW GetDriveTypeW GetSystemDirectoryW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW WTSGetActiveConsoleSessionId FileTimeToSystemTime ReleaseMutex CreateMutexW GetVolumeInformationW DecodePointer HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection ReadFile MultiByteToWideChar WideCharToMultiByte WriteFile GetFileAttributesExW GetVersionExW DeviceIoControl OutputDebugStringA SetPriorityClass SetErrorMode RtlUnwind GetCurrentProcess EncodePointer SetLastError EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime GetCurrentThread IsProcessorFeaturePresent GetConsoleMode ReadConsoleW SetFilePointerEx CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler OutputDebugStringW SetStdHandle GetTimeZoneInformation GetConsoleCP FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW WriteConsoleW SetEndOfFile SetEvent FreeLibraryAndExitThread ExitThread SystemTimeToFileTime GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber VerifyVersionInfoA GetSystemDirectoryA SetUnhandledExceptionFilter UnhandledExceptionFilter GetThreadTimes GetModuleFileNameW GetTickCount Sleep CreateThread GetFileSize MoveFileExW CreateFileW GetTempPathW OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects SleepEx InitializeCriticalSection FormatMessageA GetStringTypeW TerminateProcess CloseHandle GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GlobalAddAtomW

user32

UpdateWindow GetWindowLongW SetWindowLongW LoadCursorW LoadIconW PostMessageW SetTimer KillTimer GetMessageW TranslateMessage ShowWindow CreateWindowExW RegisterClassExW LoadStringW wsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW PostQuitMessage DefWindowProcW UnregisterHotKey RegisterHotKey GetAsyncKeyState DispatchMessageW

shlwapi

PathAddBackslashW PathFileExistsW

wtsapi32

WTSQueryUserToken

advapi32

CryptGenRandom RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken GetTokenInformation LookupAccountNameW GetSecurityDescriptorDacl GetSecurityDescriptorControl AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl GetLengthSid EqualSid ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey CryptReleaseContext CryptAcquireContextW ImpersonateLoggedOnUser RevertToSelf DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW

urlmon

URLDownloadToFileW

wldap32

ord211 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord46 ord143 ord60

ws2_32

getsockname getpeername connect closesocket bind WSASetLastError getsockopt htons WSAGetLastError ntohs __WSAFDIsSet send recv WSACleanup WSAStartup setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname select

generic

count=2, id=261, version=23013,

count=22, id=241, version=40116,

count=197, id=243, version=40116,

count=31, id=242, version=40116,

count=5, id=199, version=41118,

count=25, id=259, version=24123,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=117, id=261, version=24123,

count=39, id=260, version=24123,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=376, id=1, productName=Unmarked objects,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=61, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,