2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader
Size 10.1MB
Sample260801-txlrdade44
SHA256 b1ce90329bc72ef8828a6287b653ce7372f55134069114e2993c7990be03df7a
MD5 892ff181ef268f42555fcd61c57b34eb
SHA1 5ad3b7086c7556cbfb5a31c3e627ce7336616e7d
SHA512 5f622373a883460816ad9768c4ee2e4410558e87e2d70e9e478197472927693342f35e6354d3897487c3aa14156dbe1d1c63084ca5ba5eda2ebd1c96ca5eeb5e
SSDEEP 196608:zV0HdiFsUCrGias6+sND6ZbVDLHfflWrqufezv:ZEs+sND6ZbV/HlW2uGz
TLSH
T190B6D001B742C0B1EAD101B116BDABBA493D9E144B7189C7A7C43E7DDD312D22B3BB69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader

File Explorer

2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader

.exe 10.1MB

2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader

IMPHASH 96ad112daaa8350b6e84b3e0e519e5bc
SHA256 b1ce90329bc72ef8828a6287b653ce7372f55134069114e2993c7990be03df7a
MD5 892ff181ef268f42555fcd61c57b34eb
SHA1 5ad3b7086c7556cbfb5a31c3e627ce7336616e7d
SHA512 5f622373a883460816ad9768c4ee2e4410558e87e2d70e9e478197472927693342f35e6354d3897487c3aa14156dbe1d1c63084ca5ba5eda2ebd1c96ca5eeb5e
SSDEEP 196608:zV0HdiFsUCrGias6+sND6ZbVDLHfflWrqufezv:ZEs+sND6ZbV/HlW2uGz
TLSH
T190B6D001B742C0B1EAD101B116BDABBA493D9E144B7189C7A7C43E7DDD312D22B3BB69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4b:e1:f9:dd:a8:b1:b3:69:a7:88:94:42:88:4f:1d:cd:2d:39:60:f2:c5:88:42:99:cc:b3:62:82:8c:91:d0:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=102059,CN=Air Smart Advertising Solutions FZ-LLC,O=Air Smart Advertising Solutions FZ-LLC,STREET=DMC-BLD05-VD-G00-473\, Ground Floor\, DMC5\, Dubai Media City,L=Dubai,ST=Dubai,C=AE,1.3.6.1.4.1.311.60.2.1.2=#13054475626169,1.3.6.1.4.1.311.60.2.1.3=#13024145,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 24, 2026

Subject

Serial Number

41:01:23:d9:81:2c:1a:1d:8a:28:c3:9b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2024 - Aug 29, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

69161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\5a15121f7d684e23\setupexe\Stardust\setupexe.pdb

msi

ord175 ord169 ord70 ord141 ord190 ord88

comctl32

ord17

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateProcessesW

secur32

LsaEnumerateLogonSessions LsaGetLogonSessionData

kernel32

HeapFree GetCurrentProcess GetTempPathW WaitForSingleObject DuplicateHandle OpenProcess GetVersion GetLastError OutputDebugStringW LoadLibraryA CloseHandle HeapAlloc GetProcAddress LocalFree GetProcessHeap FreeLibrary CreateFileW UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetVersionExW CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW Process32FirstW LoadLibraryW GetCurrentProcessId OpenMutexW CompareStringW GetCommandLineW GetUserDefaultUILanguage FormatMessageW DeleteFileW VerSetConditionMask VerifyVersionInfoW lstrlenW WideCharToMultiByte LCMapStringW LockResource LoadResource SizeofResource WriteFile LoadLibraryExW FindResourceExA SetFilePointerEx FindClose ExpandEnvironmentStringsW MoveFileExW HeapReAlloc HeapSize GetTempFileNameW CreateDirectoryW GetFileAttributesW GetModuleFileNameA ProcessIdToSessionId EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetModuleHandleExW ExitProcess GetStdHandle RaiseException RtlUnwind GetStartupInfoW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExA SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW

user32

LoadStringW MessageBoxW MessageBoxExW EndDialog SetWindowTextW SetDlgItemTextW IsDlgButtonChecked SetDlgItemTextA DialogBoxParamW EnableWindow GetDlgItem

advapi32

LsaNtStatusToWinError LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey EqualSid CopySid ConvertStringSidToSidW OpenProcessToken RegOpenKeyExW ConvertSidToStringSidW GetLengthSid DuplicateTokenEx RegQueryValueExW LookupAccountNameW GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

StringFromGUID2

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_892ff181ef268f42555fcd61c57b34eb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_matanbuchus_njrat_remcos_rugmi_smoke-loader

PE Signature issue

msi

comctl32

psapi

wtsapi32

secur32

kernel32

user32

advapi32

shell32

ole32

generic