2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil
Size 2.8MB
Sample260809-hs2q9asgpb
SHA256 0ab93efe9b92164a8894465c071b16b63764f96dba63e81826219d8c91dd8f43
MD5 2350ad42baf3592d62a60400e0fb8cbb
SHA1 b0828477e52b6566b92d2ce25f635faf22a8bb63
SHA512 746302504fa50a8e0765881b2af8581eba1f0643c13dcf5f790fe6f5b811b66182a2375b6668b60c509287b330c0c8a66886d718cb607ed7e0bb9d6ca541d725
SSDEEP 49152:EcV7m09B8XUzs4MgGsIMYVExSi+P+Ez68ToDhdK0HkEU1X1Y4S:EcV7NqRMyEXJtll
TLSH
T1C4D5BE03FBC280E1E8F2217925BB577E8D7D6924972485D39B912C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

File Explorer

2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

.exe 2.8MB

2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

IMPHASH afb64912f33cb6418e087415b120fd33
SHA256 0ab93efe9b92164a8894465c071b16b63764f96dba63e81826219d8c91dd8f43
MD5 2350ad42baf3592d62a60400e0fb8cbb
SHA1 b0828477e52b6566b92d2ce25f635faf22a8bb63
SHA512 746302504fa50a8e0765881b2af8581eba1f0643c13dcf5f790fe6f5b811b66182a2375b6668b60c509287b330c0c8a66886d718cb607ed7e0bb9d6ca541d725
SSDEEP 49152:EcV7m09B8XUzs4MgGsIMYVExSi+P+Ez68ToDhdK0HkEU1X1Y4S:EcV7NqRMyEXJtll
TLSH
T1C4D5BE03FBC280E1E8F2217925BB577E8D7D6924972485D39B912C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4a:24:53:ad:8d:03:4e:15:71:aa:e7:d1:c5:21:cb:00:0b:b7:c8:5c:12:20:b2:03:d4:f8:82:88:56:0b:96:c2:e6:a1:c5:65:a0:d6:78:0a:d9:78:68:be:76:51:a8:16

Digest Algorithm

sha384

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Apr 15, 2024

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

09:be:bd:8f:ba:e0:11:98:c5:52:55:0b:a6:80:f1:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 6, 2023 - May 15, 2025

Minor OS version

Major OS version

Entry point

1731151

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoTalk Updater\KakaoUpdate Build real stage\build\KakaoUpdate.pdb

kernel32

OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize DosDateTimeToFileTime GetFileTime WideCharToMultiByte FileTimeToSystemTime GetModuleFileNameW FreeLibrary GetTimeZoneInformation GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc TlsFree SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers MoveFileExW GetTickCount CreateSemaphoreW ResumeThread LocalFree GetCommandLineW GetLocalTime GetTempPathW OpenSemaphoreW WaitForSingleObject WaitForSingleObjectEx ReleaseMutex ReleaseSemaphore CloseHandle WriteConsoleW HeapSize SetEnvironmentVariableW CopyFileW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId CreateDirectoryW GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageW CreateProcessW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW DeleteFileW FreeEnvironmentStringsW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetStdHandle GetFileType GetEnvironmentVariableW VirtualFree GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SetFilePointer GetFileSizeEx GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW GetUserObjectInformationW GetProcessWindowStation CreateDialogParamW ShowWindow UpdateWindow GetDlgItem GetWindowLongW TranslateAcceleratorW SetWindowTextW DialogBoxParamW DestroyWindow DefWindowProcW PostQuitMessage MessageBoxW EndDialog PostMessageW FindWindowW GetWindowThreadProcessId BeginPaint SendMessageW LoadStringW TranslateMessage GetMessageW LoadAcceleratorsW EndPaint SetWindowLongW ExitWindowsEx

advapi32

CryptEnumProvidersW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExW SetNamedSecurityInfoW RegOpenKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

ws2_32

inet_addr ioctlsocket getsockopt ntohs select gethostbyname WSAStartup WSACleanup WSAGetLastError htonl htons inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError recv send connect setsockopt socket shutdown closesocket

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetCertificateContextProperty

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2350ad42baf3592d62a60400e0fb8cbb_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

crypt32

generic