2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
Size 17.3MB
Sample260731-z9bptsstdt
SHA256 9d0c6eac0a7cdc24a7b368d7748b178d62ca2fa082cc1038fa9c3a5a3f251a73
MD5 564fb312871951c42a5a37f70992fd9c
SHA1 88568994feaf921a9d3030e82e7216aa8678e20b
SHA512 2c6fbd62bcca90785d6359726f0e080ea3a028bf26a9490dbd64cc9be958a381ac7392ab3bab94e64f17dee954d48f1a4d26ed90982f2874cccd7fa0d4b261a0
SSDEEP 196608:lekHmkTohblEjDQP+MZjlcV9n70X3ODFNxzVFViExRG:lBZTIlWD/MZh89n70X3OJNtFrG
TLSH
T176078D6176868032E4D201F1156DB77AC62DEE250B61C0CB43D4EE2D6DA8BC35F36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

File Explorer

2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

.exe 17.3MB

2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

IMPHASH 622209ece86c3ef2157fb81ca071ef28
SHA256 9d0c6eac0a7cdc24a7b368d7748b178d62ca2fa082cc1038fa9c3a5a3f251a73
MD5 564fb312871951c42a5a37f70992fd9c
SHA1 88568994feaf921a9d3030e82e7216aa8678e20b
SHA512 2c6fbd62bcca90785d6359726f0e080ea3a028bf26a9490dbd64cc9be958a381ac7392ab3bab94e64f17dee954d48f1a4d26ed90982f2874cccd7fa0d4b261a0
SSDEEP 196608:lekHmkTohblEjDQP+MZjlcV9n70X3ODFNxzVFViExRG:lBZTIlWD/MZh89n70X3OJNtFrG
TLSH
T176078D6176868032E4D201F1156DB77AC62DEE250B61C0CB43D4EE2D6DA8BC35F36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

31:79:4d:a8:23:76:a0:94:eb:cf:cc:7a:94:2f:ad:d4:38:7d:92:53:36:d4:22:0a:a0:39:cb:c0:15:1d:68:02

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Chains

Jan 5, 2024

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Serial Number

04:cb:5b:11:6c:ee:82:84:0c:02:09:14:b1:a4:d0:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2021 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

10918064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb

kernel32

GetCurrentThreadId GetModuleFileNameW LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetLastError lstrcmpiW DeleteCriticalSection RaiseException DecodePointer LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress GetModuleHandleW MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW InitializeCriticalSectionEx WaitForMultipleObjects WaitForSingleObject PostQueuedCompletionStatus FormatMessageW SetEvent TerminateThread CloseHandle QueueUserAPC LocalFree WideCharToMultiByte FormatMessageA CreateEventA CreateDirectoryW CreateThread GetCurrentThread SetLastError GetCurrentProcess MoveFileExW GetTempPathW ExpandEnvironmentStringsW CreateEventW GetUserGeoID GetGeoInfoW GetLocaleInfoW GlobalMemoryStatusEx GetComputerNameW DeleteFileW GetSystemTimeAsFileTime GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA SetUnhandledExceptionFilter GetCurrentProcessId FindFirstFileW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose LoadLibraryW CreateFileW CreateProcessW GetSystemDirectoryW WriteFile HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap GetTempFileNameW InitializeCriticalSectionAndSpinCount SetWaitableTimer GetQueuedCompletionStatus SleepEx CreateIoCompletionPort CreateWaitableTimerW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetProcessId ProcessIdToSessionId OpenEventW GetNativeSystemInfo GetSystemPowerStatus ReleaseSemaphore WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA ResetEvent IsWow64Process OpenProcess K32GetModuleBaseNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW UnregisterWaitEx WaitNamedPipeW ReadFile ResumeThread TerminateProcess QueryFullProcessImageNameW K32GetModuleFileNameExW K32EnumProcesses RegisterWaitForSingleObject GetExitCodeProcess GetSystemInfo SetThreadPriority VerSetConditionMask VerifyVersionInfoW GlobalFree GlobalAlloc QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy GetFileAttributesW GetPrivateProfileStringW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect VirtualFree GetStdHandle GetFileType GetModuleHandleExW GetEnvironmentVariableW GetACP GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateFileA DeviceIoControl OpenThread GetTickCount GetComputerNameExA GetComputerNameExW GetVersionExW OpenMutexW CreateFileMappingA OpenFileMappingA UnmapViewOfFile ReleaseMutex SwitchToThread MapViewOfFileEx CreateMutexW CancelIoEx GetOverlappedResult SetFileAttributesW K32EnumProcessModules GetSystemFirmwareTable GetEnvironmentVariableA GetFileSizeEx GetVolumeInformationW WTSGetActiveConsoleSessionId GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW GetCurrentDirectoryW GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetDateFormatW SystemTimeToFileTime GetLocalTime GetTickCount64 GetThreadTimes Wow64DisableWow64FsRedirection VirtualQuery IsDebuggerPresent OutputDebugStringW GetExitCodeThread GetStringTypeW TryAcquireSRWLockExclusive GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileTime AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockShared InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo FlushFileBuffers GetFileTime RemoveDirectoryW SetEndOfFile SetFilePointerEx GetWindowsDirectoryW CopyFileExW WaitForMultipleObjectsEx OpenEventA CreateWaitableTimerA UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind InterlockedPushEntrySList SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread ExitProcess PeekNamedPipe SetEnvironmentVariableW GetConsoleOutputCP GetCommandLineA GetCommandLineW CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW SetStdHandle IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetFileSize SetFilePointer LocalFileTimeToFileTime LocalAlloc InitializeCriticalSection Wow64RevertWow64FsRedirection

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_global_trace curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror curl_ws_meta curl_ws_recv curl_ws_send

Name

.text

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

604KB

Virtual Size

846KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_564fb312871951c42a5a37f70992fd9c_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

PE Signature issue

kernel32

generic