2026-08-05_18a83c487d396cb6482641b8470c2bb1_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_18a83c487d396cb6482641b8470c2bb1_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil
Size 4.8MB
Sample260805-pgjvmaxbre
SHA256 044e0f0b80d19181373fa5a4122e42cb39a64e0f0e2716cbc0bc11356aa250db
MD5 18a83c487d396cb6482641b8470c2bb1
SHA1 40e74cf1fbf976313016ebdecf225d854aa40e68
SHA512 a09525afeb3c8a4427bb842cdc9f7f4b83c68696710d605d352ac8c14e48057e69d46a311edb3b3d4b5c0f4905988874eaca982dfc03e639516353307c6be151
SSDEEP 49152:HvPvkhuOoqbL1eO5iCtqFy9waBFbUAjy/BiN99elg2FCCVThwQCPsw/vgEPlUzVD:HvPS04i+QewobUAjQiuFCCVNwhhvgc4D
TLSH
T18036BF45B601C175E9D202F851BFA77F462CAE240B35A8F387D019BB9C352C3593EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

2026-08-05_18a83c487d396cb6482641b8470c2bb1_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

.exe 4.8MB

2026-08-05_18a83c487d396cb6482641b8470c2bb1_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

IMPHASH 4ac3bb763aa8aa281ab658ba04264ce0
SHA256 044e0f0b80d19181373fa5a4122e42cb39a64e0f0e2716cbc0bc11356aa250db
MD5 18a83c487d396cb6482641b8470c2bb1
SHA1 40e74cf1fbf976313016ebdecf225d854aa40e68
SHA512 a09525afeb3c8a4427bb842cdc9f7f4b83c68696710d605d352ac8c14e48057e69d46a311edb3b3d4b5c0f4905988874eaca982dfc03e639516353307c6be151
SSDEEP 49152:HvPvkhuOoqbL1eO5iCtqFy9waBFbUAjy/BiN99elg2FCCVThwQCPsw/vgEPlUzVD:HvPS04i+QewobUAjQiuFCCVNwhhvgc4D
TLSH
T18036BF45B601C175E9D202F851BFA77F462CAE240B35A8F387D019BB9C352C3593EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Digest

d7:46:39:28:7e:63:f2:c6:32:84:53:8c:64:ab:c8:cb:75:6f:c7:4f:a6:5b:44:8d:4a:a8:c9:3e:e3:c7:92:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120102MAD221RD4U,CN=天津立方星球文化传媒有限公司,O=天津立方星球文化传媒有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b2b3e4b89ce58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 13, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:12:0e:a6:aa:44:0f:37:e9:fd:16:13:3c:f4:58:51

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2026 - May 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1526873

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Jenkins\.jenkins\workspace\popularize_group\safekey_universal_external\app_locker_service\FileFortBuild\filefort_service.pdb

kernel32

CopyFileW FindAtomW AddAtomW DeleteAtom GetModuleHandleW GetPrivateProfileStringW SystemTimeToFileTime FileTimeToSystemTime WritePrivateProfileStringW GetPrivateProfileIntW GlobalMemoryStatus FreeLibrary GetTickCount64 GetTickCount GetLocalTime GetSystemTime GetSystemInfo GetCurrentProcess GetProcessTimes SetLastError OutputDebugStringW FindResourceW SizeofResource LockResource LoadResource FindResourceExW VirtualProtect GetCurrentProcessId HeapSetInformation SetErrorMode SetUnhandledExceptionFilter GetCommandLineW GetCurrentThreadId WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle LoadLibraryW GetProcAddress GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy IsBadReadPtr TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared QueryPerformanceCounter GetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW SetFileAttributesW GetTempPathW SetEvent ReleaseMutex CreateMutexW TerminateProcess GetStartupInfoW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MoveFileExW GetTimeZoneInformation MultiByteToWideChar CreateFileMappingW MapViewOfFileEx UnmapViewOfFile LoadLibraryExW lstrcmpiW FlushFileBuffers GetFileSize ReadFile WriteFile WideCharToMultiByte DeviceIoControl GetSystemFirmwareTable UnhandledExceptionFilter LocalFree FormatMessageW InitializeSRWLock Sleep GetSystemDirectoryA LoadLibraryA FormatMessageA GetStdHandle GetFileType GetModuleHandleExW GetEnvironmentVariableW GetACP SwitchToFiber DeleteFiber CreateFiberEx CreateEventA GetExitCodeThread ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemWindowsDirectoryW GetVersionExW FreeResource lstrcmpA GetCurrentDirectoryW ExitProcess lstrcmpW lstrcpynW GetVersion GetTempFileNameW SetEndOfFile SetFilePointer MapViewOfFile WaitForSingleObjectEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA DuplicateHandle ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind ExitThread WriteConsoleW SetFilePointerEx GetConsoleOutputCP SetConsoleCtrlHandler GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW RaiseException QueryPerformanceFrequency DecodePointer

user32

GetParent GetClassNameW GetWindow RegisterClassW SetPropW GetPropW LoadImageW IsZoomed GetMonitorInfoW wvsprintfW SetCursor OffsetRect IntersectRect SetWindowTextW GetWindowTextW GetWindowTextLengthW CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx SetWindowRgn RemovePropW GetWindowDC IsRectEmpty ReleaseDC GetDC EndPaint UnregisterClassW GetMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW RegisterWindowMessageW PostMessageW PostQuitMessage BeginPaint UpdateLayeredWindow KillTimer CallWindowProcW RegisterClassExW MapWindowPoints ScreenToClient InvalidateRect GetUpdateRect ReleaseCapture SetCapture GetKeyState GetFocus SetTimer SetForegroundWindow CharNextW IsIconic IsWindowVisible GetClassInfoExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetCursorPos GetWindowLongW SetWindowLongW LoadCursorW SetWindowPos SetFocus EnableWindow PtInRect IsChild MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW SystemParametersInfoW CopyRect GetWindowRect SendMessageTimeoutW SendMessageW MonitorFromWindow GetIconInfo GetClientRect

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHFileOperationW ShellExecuteW SHCreateDirectoryExW

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc CoInitialize CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathFileExistsW PathCombineW SHGetValueW PathFindFileNameW StrCpyW PathFindExtensionW PathRemoveExtensionW PathIsDirectoryW StrStrIW StrCmpNIW StrTrimA StrStrIA StrCmpIW PathAppendW

gdiplus

GdipDisposeImage GdipSaveImageToFile GdipFree GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdiplusShutdown GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateFromHDC GdipDeleteGraphics GdipSetInterpolationMode GdipGraphicsClear GdipGetImageEncodersSize GdipGetImageEncoders GdipDrawImagePointRectI GdipDrawImageRectRectI GdipCreateBitmapFromFile GdipCloneBrush GdipDeleteBrush GdipSetSmoothingMode GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipFillPath GdipDrawImagePointsI GdipAlloc GdiplusStartup GdipCloneImage GdipCreateBitmapFromScan0

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreW CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

ws2_32

WSASetLastError inet_pton htonl __WSAFDIsSet closesocket connect ioctlsocket getpeername getsockname getsockopt ntohs recv select send getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr htons setsockopt shutdown socket WSAStartup WSACleanup WSAGetLastError WSASocketW getaddrinfo freeaddrinfo getnameinfo gethostbyname

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

gdi32

CreateDCW SetDIBitsToDevice ExtTextOutW TextOutW MoveToEx SetStretchBltMode StretchBlt SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetClipBox GetCharABCWidthsW CreateRectRgnIndirect SetTextColor SetBkMode CreateSolidBrush CreateRoundRectRgn SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle GetTextExtentPoint32W GetStockObject CreatePen CreateFontIndirectW SetViewportOrgEx CreateRectRgn CombineRgn BitBlt GetObjectW CreateDIBSection SelectObject GetDIBits DeleteObject CreateCompatibleDC DeleteDC CreateCompatibleBitmap

advapi32

RegQueryValueExW RegSetValueExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptGenRandom CryptDecrypt DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW OpenProcessToken GetTokenInformation RegCloseKey RegOpenKeyExW RegDeleteValueW RegCreateKeyExW

msimg32

AlphaBlend GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_18a83c487d396cb6482641b8470c2bb1_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

kernel32

user32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

version

crypt32

ws2_32

iphlpapi

gdi32

advapi32

msimg32

generic