2026-08-03_431e79857f6f2b14a806bb809fd8b94c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_431e79857f6f2b14a806bb809fd8b94c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 3.7MB
Sample260804-pfpdqazdlc
SHA256 291b6cd25a9bd451f6745d5f53a8f87bfdeb821d1821c1e208617ea4170f8dce
MD5 431e79857f6f2b14a806bb809fd8b94c
SHA1 26026712a66a11325474377ebac5317ff2564073
SHA512 5db552d801c457e904adf785340cdc5e4fa2c2de2260036e932f50e6e2c31ffc131272b6d3bbc27bd8dfbe68c89337c3a907b8b4de8b766eed43848d0b9ce2b1
SSDEEP 49152:05stYjl1cH0TwIojp01wHfALU/yIAlYJc564aD269Eh2DWMYq2AX:9tAwp21wHfMU/ClY25XAae
TLSH
T13C067D637F5AC135FE9210B609BEAB7E046EE7600B2455C3939827EECA306D22F35517
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_431e79857f6f2b14a806bb809fd8b94c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 3.7MB

2026-08-03_431e79857f6f2b14a806bb809fd8b94c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 7e67e59fb3b833a525de9ba3e9fb7150
SHA256 291b6cd25a9bd451f6745d5f53a8f87bfdeb821d1821c1e208617ea4170f8dce
MD5 431e79857f6f2b14a806bb809fd8b94c
SHA1 26026712a66a11325474377ebac5317ff2564073
SHA512 5db552d801c457e904adf785340cdc5e4fa2c2de2260036e932f50e6e2c31ffc131272b6d3bbc27bd8dfbe68c89337c3a907b8b4de8b766eed43848d0b9ce2b1
SSDEEP 49152:05stYjl1cH0TwIojp01wHfALU/yIAlYJc564aD269Eh2DWMYq2AX:9tAwp21wHfMU/ClY25XAae
TLSH
T13C067D637F5AC135FE9210B609BEAB7E046EE7600B2455C3939827EECA306D22F35517
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

27:79:14:2c:dd:48:cd:80:4a:be:19:5d:d4:a9:3c:dd:ee:a2:14:a0:b9:d0:a6:fb:47:5a:82:f3:b5:bf:13:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MAELQTNGXQ,CN=Sichuan Jinnanyue Technology Co.\, Ltd.,O=Sichuan Jinnanyue Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#132d4368656e67647520486967682d7465636820496e647573747269616c20446576656c6f706d656e74205a6f6e65,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:52:82:a8:eb:54:84:6c:4e:73:f1:64:d9:64:e7:89

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 14, 2026 - May 13, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

76271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\Cef\WebView\Release\CefView69.pdb

oleacc

LresultFromObject AccessibleObjectFromWindow

imm32

ImmSetCandidateWindow ImmGetContext ImmGetCompositionStringW ImmAssociateContextEx ImmReleaseContext ImmNotifyIME

kernel32

SetEvent CreateEventW WaitForMultipleObjects RegisterWaitForSingleObject UnregisterWait GetFileSizeEx GetCurrentProcessId GetLocalTime ReleaseMutex CreateMutexW FreeLibrary WideCharToMultiByte lstrcpyW InitializeCriticalSectionAndSpinCount GlobalAlloc GlobalSize GlobalUnlock GlobalLock IsBadStringPtrW GetCommandLineW GetCurrentProcess TerminateProcess WinExec MulDiv GetEnvironmentVariableW SetEnvironmentVariableW SetUnhandledExceptionFilter VirtualProtect IsBadReadPtr GetFileSize ReadFile SetFilePointer Sleep LeaveCriticalSection InitializeCriticalSectionEx EnterCriticalSection InitializeCriticalSection GetCurrentThreadId OutputDebugStringW OutputDebugStringA PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode GetConsoleCP FlushConsoleInputBuffer GlobalMemoryStatus LoadLibraryA GetModuleHandleA WaitForSingleObjectEx ResetEvent GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer K32GetModuleFileNameExW K32EnumProcessModules MultiByteToWideChar LocalFree WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP MoveFileExW IsValidCodePage FindFirstFileExW FindClose GetCurrentDirectoryW SetCurrentDirectoryW SetConsoleCtrlHandler SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType CreateProcessW GetCurrentThread GetStdHandle ExitProcess GetFileAttributesExW GetFullPathNameW GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind TryEnterCriticalSection FormatMessageA FindNextFileW FindFirstFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime SetFileTime SetEndOfFile FlushFileBuffers WriteFile MoveFileW CopyFileW LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FindResourceExW GetTickCount OpenProcess GetExitCodeProcess WaitForSingleObject CloseHandle GetTempPathW SetFileAttributesW GetTempFileNameW lstrcmpA DeviceIoControl LoadLibraryExW FreeResource GetVersionExW GetSystemWindowsDirectoryW InterlockedExchangeAdd QueryPerformanceCounter GetStartupInfoW UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread FormatMessageW GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetFileTime DeleteFileW CreateFileW GetACP DeleteCriticalSection

user32

IsWindow UnregisterClassW SendMessageW SendMessageTimeoutW PostMessageW DefWindowProcW CallWindowProcW MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetClassInfoExW RegisterClassExW DestroyWindow SetWindowTextW GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId LoadCursorW CreateWindowExW GetKeyState LoadStringW UnhookWindowsHookEx ChangeWindowMessageFilter DeregisterShellHookWindow RegisterShellHookWindow IsRectEmpty CopyRect MessageBoxW AdjustWindowRectEx GetForegroundWindow UpdateWindow RemoveMenu GetSubMenu SetMenu GetMenu KillTimer SetTimer LoadIconW CallNextHookEx SetWindowsHookExW SetClassLongW FrameRect WindowFromPoint GetCursorPos SetCursor GetWindowRect EndPaint BeginPaint ReleaseDC GetDC GetSystemMetrics ReleaseCapture SetCapture GetCapture SetFocus UpdateLayeredWindow GetDoubleClickTime ReplyMessage GetMessageTime GetMessagePos TrackMouseEvent SetCaretPos DestroyCaret CreateCaret GetKeyboardLayoutNameW ScreenToClient RegisterClipboardFormatW NotifyWinEvent GetParent PtInRect SetRect ClientToScreen GetClientRect InvalidateRect wsprintfW GetFocus IsDialogMessageW TranslateAcceleratorW LoadAcceleratorsW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW SetParent IsWindowVisible SetWindowPos ShowWindow RegisterWindowMessageW

gdi32

GetBitmapBits CreateDCA CreateCompatibleBitmap BitBlt DeleteObject GetDeviceCaps CreateSolidBrush SwapBuffers CreateDIBSection SetPixelFormat DeleteDC CreateCompatibleDC ChoosePixelFormat SelectObject GetTextExtentPoint32W GetStockObject GetObjectA

advapi32

ReportEventA RegSetValueExW RegisterEventSourceA RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey OpenProcessToken GetTokenInformation RegCreateKeyExW RegEnumKeyExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef DeregisterEventSource

shell32

ShellExecuteExW SHCreateDirectoryExA SHCreateDirectoryExW ord165 SHGetSpecialFolderPathW SHGetFolderPathA SHGetFolderPathW DragQueryFileW DragFinish

ole32

CoUninitialize CoInitialize StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoTaskMemFree DoDragDrop ReleaseStgMedium RegisterDragDrop RevokeDragDrop

oleaut32

SysAllocString SysFreeString SysAllocStringLen SysStringLen

shlwapi

StrStrIA StrTrimA StrTrimW StrCmpNIW PathFindExtensionW PathFindExtensionA PathCompactPathW PathCombineW SHGetValueW PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathCanonicalizeW PathAppendW StrStrIW PathIsDirectoryW PathFindFileNameA StrCmpIW

opengl32

glDrawArrays glEnable glEnd glGenTextures glHint glInterleavedArrays glLineWidth glLoadIdentity glMatrixMode glOrtho glPixelStorei glPopAttrib glPopMatrix glPushAttrib glDeleteTextures glRotatef glTexEnvf glTexImage2D glTexParameteri glTexSubImage2D glVertex2f glVertex2i glViewport wglCreateContext wglDeleteContext wglMakeCurrent glColor4f glColor3f glClearColor glClear glDisable glBegin glBindTexture glBlendFunc glPushMatrix

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

libcef

cef_string_utf8_clear cef_string_utf16_clear cef_string_utf8_to_utf16 cef_string_userfree_utf16_free cef_string_list_alloc cef_string_list_free cef_visit_web_plugin_info cef_refresh_web_plugins cef_unregister_internal_web_plugin cef_register_web_plugin_crash cef_string_utf16_to_utf8 cef_register_widevine_cdm cef_currently_on cef_post_task cef_post_delayed_task cef_register_extension cef_register_scheme_handler_factory cef_clear_scheme_handler_factories cef_execute_process cef_initialize cef_shutdown cef_do_message_loop_work cef_run_message_loop cef_quit_message_loop cef_set_osmodal_loop cef_is_web_plugin_unstable cef_crash_reporting_enabled cef_set_crash_key_value cef_create_directory cef_get_temp_directory cef_create_new_temp_directory cef_create_temp_directory_in_directory cef_get_min_log_level cef_delete_file cef_zip_directory cef_load_crlsets_file cef_add_cross_origin_whitelist_entry cef_remove_cross_origin_whitelist_entry cef_clear_cross_origin_whitelist cef_parse_url cef_create_url cef_format_url_for_security_display cef_get_mime_type cef_get_extensions_for_mime_type cef_base64encode cef_base64decode cef_uriencode cef_uridecode cef_parse_json cef_parse_jsonand_return_error cef_write_json cef_get_path cef_launch_process cef_is_cert_status_error cef_is_cert_status_minor_error cef_begin_tracing cef_end_tracing cef_now_from_system_trace_time cef_execute_java_script_with_user_gesture_for_tests cef_api_hash cef_browser_host_create_browser cef_browser_host_create_browser_sync cef_log cef_string_wide_to_utf8 cef_string_map_alloc cef_string_map_free cef_command_line_create cef_command_line_get_global cef_cookie_manager_get_global_manager cef_cookie_manager_get_blocking_manager cef_cookie_manager_create_manager cef_image_create cef_process_message_create cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_drag_data_create cef_request_context_get_global_context cef_request_context_create_context cef_create_context_shared cef_menu_model_create cef_menu_button_create cef_panel_create cef_browser_view_create cef_browser_view_get_for_browser cef_label_button_create cef_textfield_create cef_window_create_top_level cef_v8value_create_undefined cef_v8value_create_null cef_v8value_create_bool cef_v8value_create_int cef_v8value_create_uint cef_v8value_create_double cef_v8value_create_date cef_v8value_create_string cef_v8value_create_object cef_v8value_create_array cef_v8value_create_array_buffer cef_v8value_create_function cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_stream_reader_create_for_file cef_stream_reader_create_for_data cef_stream_reader_create_for_handler cef_binary_value_create cef_value_create cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_list_value_create cef_dictionary_value_create cef_scroll_view_create cef_display_get_primary cef_display_get_nearest_point cef_display_get_matching_bounds cef_display_get_count cef_display_get_alls cef_task_runner_get_for_current_thread cef_task_runner_get_for_thread cef_string_multimap_alloc cef_string_multimap_free cef_request_create cef_zip_reader_create cef_v8stack_trace_get_current cef_response_create cef_post_data_create cef_print_settings_create cef_post_data_element_create cef_string_utf16_cmp cef_time_to_timet cef_time_from_timet cef_get_current_platform_thread_id cef_string_utf16_to_lower cef_time_now cef_time_delta cef_string_utf16_set cef_enable_highdpi_support cef_directory_exists

iphlpapi

GetAdaptersInfo

crypt32

CryptBinaryToStringW CryptStringToBinaryA CryptBinaryToStringA CryptStringToBinaryW

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

591KB

Virtual Size

591KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=259, version=30795,

count=215, id=261, version=30795,

count=135, id=261, version=27045,

count=2, productName=Unmarked objects (old),

count=4, id=261, version=27051,

count=4, id=261, version=27031,

count=6, id=261, version=27032,

count=305, id=260, version=27034,

count=7, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=75, id=261, version=26706,

count=29, id=260, version=30795,

count=29, id=257, version=30795,

count=542, id=1, productName=Unmarked objects,

count=68, id=261, version=27053,

count=1, id=255, version=27053,

count=1, id=151,

count=1, id=258, version=27053,