2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut
Size 4.0MB
Sample260731-c5aweasbja
SHA256 af4ae8e79193b85790606dff09053dd52c89729e15715a446a8d1d7eab5a7474
MD5 b3a216fcfc2118e7ada1e026c03bf598
SHA1 9c805d6a068e507dd59046641e34a25560ad8966
SHA512 e1c5b271f584d08b2385d0ed278225e347784790922ba81410d96dee18b9fd5c0371e07f009403aa1eadea961cd521f06e0eb57c8582a20c45edffc009b4afb9
SSDEEP 49152:ELNN7OxjcVGIcNAn7mfBEsdZyr1eY/3izlxJEWaltPJg0xhDpcVhGC:ELNN7+jg7mfBEw4xx3eIrU0x
TLSH
T13016BF11B645C071F59202B196B9EB7B4A3EBE311BA984C3D3D03D6E59302C37B39B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut

File Explorer

2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut

.exe 4.0MB

2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut

IMPHASH 8eddae28ea26c3a37d482bedcd2a4fd9
SHA256 af4ae8e79193b85790606dff09053dd52c89729e15715a446a8d1d7eab5a7474
MD5 b3a216fcfc2118e7ada1e026c03bf598
SHA1 9c805d6a068e507dd59046641e34a25560ad8966
SHA512 e1c5b271f584d08b2385d0ed278225e347784790922ba81410d96dee18b9fd5c0371e07f009403aa1eadea961cd521f06e0eb57c8582a20c45edffc009b4afb9
SSDEEP 49152:ELNN7OxjcVGIcNAn7mfBEsdZyr1eY/3izlxJEWaltPJg0xhDpcVhGC:ELNN7+jg7mfBEw4xx3eIrU0x
TLSH
T13016BF11B645C071F59202B196B9EB7B4A3EBE311BA984C3D3D03D6E59302C37B39B5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ed:8e:18:37:93:d6:7a:28:0c:47:06:67:6c:25:35:31:ec:cb:cc:a7:e0:ef:35:aa:0f:85:9a:50:b5:72:e3:ff

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 9, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4311099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\data\landun\workspace\p-3d7f88f5f52b43179dd219a5c6dd1b5c\src\bin\Release_Win32\SGPicFaceTool.pdb

shlwapi

StrRChrIW PathMatchSpecW StrRChrW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey CryptSignHashW OpenProcessToken GetTokenInformation RegCreateKeyExW RegSetValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl DeregisterEventSource RegisterEventSourceW ReportEventW LookupAccountSidW GetSecurityDescriptorSacl BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityDescriptorSacl CryptAcquireContextW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid CryptReleaseContext CryptImportKey RegOpenKeyW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptDestroyKey CryptSetHashParam CryptGetUserKey CryptSetKeyParam CryptEncrypt CryptGetProvParam CryptEnumProvidersW

kernel32

LoadLibraryExA AttachConsole GetConsoleDisplayMode FreeConsole VerSetConditionMask VerifyVersionInfoW ConnectNamedPipe GetOverlappedResult ReadFileEx CreateEventW DisconnectNamedPipe WaitForMultipleObjectsEx WriteFileEx CreateNamedPipeW Sleep WaitForMultipleObjects SetEvent OpenEventW OutputDebugStringA GetSystemTime SystemTimeToFileTime GetModuleHandleW GetTempPathW GetTickCount GetCommandLineW LocalFree ReleaseSRWLockExclusive GetUserDefaultLangID SetLastError OutputDebugStringW DeleteFileW GetLocalTime GetCurrentDirectoryW GetCurrentProcessId ReadFile GetFileSizeEx GetCurrentProcess SetEndOfFile GetFileInformationByHandle SetFilePointerEx FlushFileBuffers CreateDirectoryW RemoveDirectoryW GetFileAttributesW UnmapViewOfFile SetFileAttributesW GetFileAttributesExW MoveFileExW CopyFileW CreateFileMappingW MapViewOfFile GetSystemDirectoryW GetWindowsDirectoryW TryAcquireSRWLockExclusive AcquireSRWLockExclusive SizeofResource LockResource LoadResource FindResourceW MultiByteToWideChar WideCharToMultiByte ResumeThread IsDebuggerPresent GetCurrentThreadId RaiseException CreateThread FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter FindFirstFileExW SetEnvironmentVariableW GetEnvironmentVariableW GetVersionExW GetNativeSystemInfo TerminateProcess VirtualFree VirtualAlloc OpenFileMappingW VirtualQuery TlsGetValue TlsSetValue TlsAlloc TlsFree GetSystemInfo RtlCaptureStackBackTrace SetUnhandledExceptionFilter ResetEvent VirtualProtect lstrlenW SetFilePointer FormatMessageW lstrcatW CreateProcessW lstrcpyW GlobalFree OpenMutexW ExitThread GlobalAlloc GetFileSize GetFileTime HeapFree GetFullPathNameW LocalAlloc HeapAlloc GetProcessHeap InitializeCriticalSectionAndSpinCount LoadLibraryExW CreateMutexW ReleaseMutex HeapSize HeapReAlloc GetACP GlobalLock GlobalUnlock CreateFileA WaitForSingleObject InitializeSRWLock WaitForSingleObjectEx GetStringTypeW EncodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetDriveTypeW GetFileType PeekNamedPipe GetTimeZoneInformation FreeLibraryAndExitThread GetModuleHandleExW GetConsoleOutputCP GetConsoleMode SetStdHandle ExitProcess GetStdHandle ReadConsoleW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP SetConsoleCtrlHandler GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GlobalHandle DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA CloseHandle CreateFileW WriteFile GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryW FindClose FindNextFileW FindFirstFileW DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreateFileMappingA

user32

wsprintfW GetClientRect GetProcessWindowStation GetUserObjectInformationW AttachThreadInput GetDesktopWindow SystemParametersInfoW IsIconic SetRectEmpty MessageBoxW LoadImageW GetLastInputInfo MoveWindow SetCapture ReleaseCapture GetWindowLongW CloseWindow SubtractRect AdjustWindowRectEx MonitorFromPoint GetWindowRect MonitorFromRect FillRect GetSystemMetrics SetWindowTextW OffsetRect GetMonitorInfoW SetLayeredWindowAttributes IntersectRect SetFocus LoadCursorW SetCursor SetWindowLongW DrawTextW PostQuitMessage GetParent PtInRect InvalidateRect GetCursorPos EnableWindow BeginPaint EndPaint wvsprintfW GetWindowThreadProcessId ReleaseDC GetDC IsWindow PostMessageW SetForegroundWindow FindWindowW TranslateMessage DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW SetTimer GetForegroundWindow DispatchMessageW ShowWindow SendMessageW SetWindowPos GetMessageW IsWindowVisible EqualRect

shell32

ShellExecuteW SHFileOperationW CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

imm32

ImmDisableIME

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

msimg32

AlphaBlend TransparentBlt

ws2_32

closesocket WSASetLastError send recv WSACleanup WSAGetLastError

winmm

timeGetTime

gdi32

GetTextExtentPointW CreateFontIndirectW CreatePen Rectangle CreateSolidBrush BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC SetBkMode SetTextColor SetViewportOrgEx StretchDIBits LineTo GetStockObject MoveToEx StretchBlt CreateDIBSection GetObjectW SelectClipRgn GetFontData SetTextCharacterExtra DeleteObject

ole32

OleCreate OleSetContainedObject CoTaskMemFree

oleaut32

VariantClear SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen

bcrypt

BCryptGenRandom

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpQueryOption WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpWriteData WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSendRequest WinHttpSetOption

crypt32

CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertEnumCertificatesInStore CertCloseStore CertOpenStore

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_b3a216fcfc2118e7ada1e026c03bf598_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_virut

PE Signature issue

shlwapi

advapi32

kernel32

user32

shell32

imm32

version

psapi

msimg32

ws2_32

winmm

gdi32

ole32

oleaut32

bcrypt

winhttp

crypt32

generic