2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat
Size 7.0MB
Sample260802-ec7e1ssxet
SHA256 baea1730299626ea32e48f833c12e1286073b54ae190ba2082fca57cb1be05af
MD5 f233902fa9d5acb0d7b07c31e8f2aeb8
SHA1 4b4993146f88244bf1aab622b3188803aaa3af70
SHA512 2a3c78a3e5f80dca36914efaff60361a9136b14d54ccd4535cc0046bf9d0b2d640315ff43b5180e0c4c36005ee6a8345031c319bde438baed559bbf1dcd89e35
SSDEEP 196608:0Apupp6puA9LtzVmcqOyCuSfLkiaQJp0PqOBFohsGbDn:0ApU6pHTmcqOPuSDkkv0PpBKsG3n
TLSH
T1DC76AE63B5408072D65203B0693DBBBA5EFDFDB00662D197AF88254CEA729D1D73A343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat

.exe 7.0MB

2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat

IMPHASH 346c875f45893956d73046c88873cba0
SHA256 baea1730299626ea32e48f833c12e1286073b54ae190ba2082fca57cb1be05af
MD5 f233902fa9d5acb0d7b07c31e8f2aeb8
SHA1 4b4993146f88244bf1aab622b3188803aaa3af70
SHA512 2a3c78a3e5f80dca36914efaff60361a9136b14d54ccd4535cc0046bf9d0b2d640315ff43b5180e0c4c36005ee6a8345031c319bde438baed559bbf1dcd89e35
SSDEEP 196608:0Apupp6puA9LtzVmcqOyCuSfLkiaQJp0PqOBFohsGbDn:0ApU6pHTmcqOPuSDkkv0PpBKsG3n
TLSH
T1DC76AE63B5408072D65203B0693DBBBA5EFDFDB00662D197AF88254CEA729D1D73A343
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.
Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

PE Signature issue

Digest

8b:32:84:f1:61:f8:57:1b:2e:4f:82:3f:52:7e:a4:b1:b1:80:67:5f:d2:52:ca:cd:c5:4c:d3:29:fb:a4:4b:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 15, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1d:f3:14:e9:79:07:11:80:07:30:0a:3e:ad:c4:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2023 - Oct 6, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4662570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\BOP_agent_release_2.40.3\build\bin\win32-i386-vc143-release\Agent.pdb

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

iphlpapi

GetExtendedTcpTable

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen

advapi32

CryptGetProvParam RegGetValueW CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership DuplicateTokenEx FreeSid GetTokenInformation SetTokenInformation LookupPrivilegeValueW CreateProcessWithTokenW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfigW ControlService CreateServiceW DeleteService QueryServiceStatus StartServiceW OpenThreadToken AccessCheck DuplicateToken EqualSid GetAce InitializeAcl MapGenericMask SetEntriesInAclW GetExplicitEntriesFromAclW GetSecurityInfo SetSecurityInfo BuildTrusteeWithSidW ConvertStringSidToSidW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW GetFileSecurityW GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceObjectSecurity SetServiceObjectSecurity GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW RegQueryInfoKeyW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam

user32

GetShellWindow GetForegroundWindow PeekMessageW DispatchMessageW TranslateMessage ShowWindow DefWindowProcW GetWindow EnumThreadWindows EnumChildWindows GetDesktopWindow RegisterClassExW CreateWindowExW UpdateWindow LoadCursorW LoadIconW LoadStringW GetProcessWindowStation GetUserObjectInformationW IsWindowVisible SetWindowTextW GetWindowTextW GetWindowThreadProcessId MessageBoxW

wintrust

WinVerifyTrust

crypt32

CertEnumCertificatesInStore CertCreateCertificateContext CertAddCertificateContextToStore CertDeleteCertificateFromStore CertGetNameStringA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptStringToBinaryA CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW PFXImportCertStore CryptProtectData CertFindExtension CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptDecodeObjectEx CertOpenStore CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CryptUnprotectData

kernel32

InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx InitializeSListHead GetStartupInfoW UnhandledExceptionFilter InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread GetCommandLineA FindFirstFileExW SystemTimeToTzSpecificLocalTime SetStdHandle PeekNamedPipe ExitProcess GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage RtlUnwind IsProcessorFeaturePresent GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemInfo MultiByteToWideChar WideCharToMultiByte GetConsoleWindow SetErrorMode GetCurrentProcess SetConsoleCtrlHandler DecodePointer CloseHandle GetLastError InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject GetCurrentProcessId TerminateProcess GetExitCodeProcess GetProcessId OpenProcess GetWindowsDirectoryW GetVersionExW CreateJobObjectW OpenJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject GetModuleFileNameW GetModuleHandleW GetProcAddress LocalAlloc LocalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetVolumePathNameW ReadFile SetFileAttributesW SetFilePointer WriteFile CopyFileW MoveFileExW FileTimeToSystemTime CreateFileMappingW OpenFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GlobalMemoryStatusEx GetModuleHandleA GlobalMemoryStatus GetCurrentThread RaiseException FormatMessageA GetVolumeInformationW GlobalFree lstrlenW IsWow64Process GetTempPathW FreeLibrary LoadLibraryExW CreateHardLinkW SetUnhandledExceptionFilter GetCurrentThreadId RtlCaptureContext IsDebuggerPresent OpenThread SuspendThread ResumeThread GetThreadContext VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Thread32First Thread32Next SetEvent CreateEventW CreateThread LoadLibraryW FindClose FindFirstFileW GetFileAttributesW SetLastError CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency Module32FirstW Module32NextW WriteConsoleW GetModuleHandleExW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetLocaleInfoA VirtualFree SwitchToFiber DeleteFiber CreateFiberEx FindNextFileW GetSystemTime SystemTimeToFileTime GetSystemDirectoryA LoadLibraryA Sleep GetStdHandle GetFileType GetEnvironmentVariableW GetACP GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW DeviceIoControl DeleteFileA GetFileInformationByHandle FindFirstFileNameW FindNextFileNameW CreateHardLinkA CreateMutexW OpenMutexW GetFullPathNameW QueryFullProcessImageNameA DeleteFileW SetEndOfFile SetFilePointerEx GetFileSizeEx CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetOverlappedResult CancelIoEx FormatMessageW GetTickCount VerSetConditionMask GetSystemDirectoryW VerifyVersionInfoW WaitForSingleObjectEx GetEnvironmentVariableA SleepEx FlushFileBuffers GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc CreateFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree HeapCreate AreFileApisANSI TryEnterCriticalSection GetLongPathNameW SetHandleInformation GetProcessTimes SetThreadPriority GetThreadTimes GetVersion GetCurrentDirectoryW GetThreadPriority GetProcessAffinityMask SetThreadAffinityMask RemoveDirectoryW MoveFileW GetLogicalProcessorInformationEx GetNativeSystemInfo TryAcquireSRWLockExclusive GetTimeZoneInformation GetCommandLineW ResetEvent InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetVolumeNameForVolumeMountPointW DuplicateHandle ReleaseSemaphore CreateSemaphoreExW SetEnvironmentVariableW GetComputerNameW CreateActCtxW ActivateActCtx DeactivateActCtx ReleaseMutex GetExitCodeThread EncodePointer LCMapStringEx

shell32

CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath SHChangeNotify

ws2_32

bind closesocket getsockopt htonl htons listen setsockopt socket inet_pton ioctlsocket gethostbyname recv send WSASetLastError getpeername getsockname recvfrom sendto inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname connect shutdown __WSAFDIsSet WSACloseEvent WSACreateEvent WSAIoctl getaddrinfo freeaddrinfo getnameinfo inet_ntop accept WSCEnumProtocols WSACleanup ntohs ntohl WSAGetLastError select WSAStartup

ole32

CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantInit SysFreeString VariantChangeType SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_f233902fa9d5acb0d7b07c31e8f2aeb8_akira_amadey_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat

PE Signature issue

bcrypt

dxgi

iphlpapi

rpcrt4

version

winhttp

advapi32

user32

wintrust

crypt32

kernel32

shell32

ws2_32

ole32

oleaut32

generic