2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader
Size 4.7MB
Sample260804-svsaps1vey
SHA256 7ddb0189b98b3a532dffaf5af03987b6f27cb8a07359d2a25d6e09e30dbd4e2c
MD5 6dd6322cbfeb3658997d91c910152421
SHA1 2f56e415515c7d1dadf250c5a7130b22b4dd37db
SHA512 7ba0e544c67058b5fb44fe208383852fa84f4a1fd6f32c61dc2c913e603c00b9b3da2be19b9c28f4ebd5f00cc1b581d68ed138883c3485792f9c12e8ad7d920e
SSDEEP 98304:3Kc901hexGdeS/+9ySFoSnKz4DDDROZ63p/jfnAtbBE/tFK90MDOGFdx2:3b0Xex7yHrz47MO/jfnANBE/tFK90MDK
TLSH
T18A36BF11FBC180A2DE924234159AF77D993D5EA4472981C397B16A79EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 4.7MB

2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH d2cd7e4a58921a7b87e6d1a2b4dee47a
SHA256 7ddb0189b98b3a532dffaf5af03987b6f27cb8a07359d2a25d6e09e30dbd4e2c
MD5 6dd6322cbfeb3658997d91c910152421
SHA1 2f56e415515c7d1dadf250c5a7130b22b4dd37db
SHA512 7ba0e544c67058b5fb44fe208383852fa84f4a1fd6f32c61dc2c913e603c00b9b3da2be19b9c28f4ebd5f00cc1b581d68ed138883c3485792f9c12e8ad7d920e
SSDEEP 98304:3Kc901hexGdeS/+9ySFoSnKz4DDDROZ63p/jfnAtbBE/tFK90MDOGFdx2:3b0Xex7yHrz47MO/jfnANBE/tFK90MDK
TLSH
T18A36BF11FBC180A2DE924234159AF77D993D5EA4472981C397B16A79EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d9:9d:c1:a7:1d:05:a5:73:43:04:b7:87:51:40:d7:9b:cb:8d:9c:f9:37:2f:4d:a3:9c:77:f7:5a:1c:73:51:24

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-4022119,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jan 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

c3:75:31:73:a4:af:15:bc:81:c6:d9:5c:48:c8:1a:1b:52:d4:7c:45

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jan 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0a:3f:f9:a9:60:71:89:eb:14:c9:7f:85:25:ca:76:fd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2025 - Jan 26, 2028

Minor OS version

Major OS version

Entry point

1991582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\CrossEXService\client\projects\windows\Release\CrossEXService.pdb

crypt32

CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

kernel32

IsValidCodePage FindFirstFileExW CreateDirectoryW MoveFileExW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW SetStdHandle QueryPerformanceFrequency VirtualQuery HeapQueryInformation SetConsoleCtrlHandler GetEnvironmentStringsW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA PeekNamedPipe GetFileInformationByHandle GetDriveTypeW RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW ExitProcess SizeofResource HeapFree GetCurrentProcess GetUserDefaultLangID InitializeCriticalSectionEx HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc LoadResource FindResourceW HeapAlloc DecodePointer GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte LoadLibraryExW FindFirstFileW SetLastError FindNextFileW FindClose GetFileAttributesW Sleep GetTickCount ReadFile SetNamedPipeHandleState WriteFile CreateMutexW CreateFileW ReleaseMutex CloseHandle WaitNamedPipeW LoadLibraryExA LocalAlloc LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent FormatMessageA TerminateThread RegisterWaitForSingleObject UnregisterWait CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult UnregisterWaitEx ConnectNamedPipe TerminateProcess CreateProcessA GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemDirectoryA LoadLibraryA WriteConsoleW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetEnvironmentVariableW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree MulDiv FormatMessageW CopyFileW OutputDebugStringA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetModuleHandleA lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GlobalReAlloc GlobalHandle LocalReAlloc CompareStringW GlobalFlags lstrcmpW SetThreadPriority ResumeThread GlobalAddAtomW DeleteFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW EncodePointer GetSystemDirectoryW GlobalDeleteAtom GlobalFindAtomW GetVersionExW FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime GetLocaleInfoW GetUserDefaultUILanguage GetCurrentDirectoryW lstrcpyW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetTempPathW GetTickCount64 GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID

user32

CreatePopupMenu NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA CopyImage SystemParametersInfoW GetMenuItemInfoW DestroyMenu IntersectRect InflateRect LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow GetForegroundWindow SetActiveWindow GetMenuDefaultItem TrackPopupMenu SetMenu GetMenu GetCapture IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu UnionRect UpdateLayeredWindow MonitorFromPoint LoadIconW LoadAcceleratorsW DispatchMessageW ShowWindow LoadStringW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW FillRect ScreenToClient EndPaint BeginPaint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW CharUpperW DestroyIcon CallNextHookEx SetWindowsHookExW GetCursorPos ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW RealChildWindowFromPoint GetClassNameW GetDesktopWindow PtInRect ClientToScreen GetWindowRect IsDialogMessageW SetWindowLongW SetWindowTextW GetFocus GetDlgCtrlID CheckDlgButton MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW SetClassLongW SetWindowRgn SetParent DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW PostQuitMessage AppendMenuW RemoveMenu GetWindowTextW GetWindowTextLengthW UnhookWindowsHookEx SendMessageW EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetFocus SetScrollPos GetScrollPos GetWindow IsWindow MoveWindow SetWindowPos GetDlgItem TranslateAcceleratorW InsertMenuItemW UnpackDDElParam DrawIcon ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel UpdateWindow LoadCursorW DestroyCursor GetWindowRgn CreateMenu TranslateMessage SubtractRect

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW GetTextExtentPoint32W DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CreateFontIndirectW CombineRgn ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx GetObjectW SetTextAlign SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt DeleteObject DeleteDC GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

CryptGetUserKey RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation SetKernelObjectSecurity SetSecurityInfo RegSetValueExW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegQueryValueExW CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken InitializeSecurityDescriptor

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder DragQueryFileW DragFinish SHAppBarMessage SHBrowseForFolderW

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW StrFormatKBSizeW PathStripToRootW

uxtheme

GetThemeSysColor DrawThemeText GetThemePartSize IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoDisconnectObject CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate LoadTypeLi VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

WSACleanup getsockopt __WSAFDIsSet accept bind closesocket select listen WSAStartup getpeername inet_addr getsockname send socket connect recvfrom recv sendto ioctlsocket htonl htons inet_ntoa gethostbyaddr getservbyport WSASetLastError shutdown gethostbyname ntohs WSAGetLastError setsockopt getservbyname

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipDrawImageRectI GdipSetInterpolationMode GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6dd6322cbfeb3658997d91c910152421_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

PE Signature issue

PE Signature issue

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

version

ws2_32

bcrypt

gdiplus

oleacc

imm32

winmm

generic