2026-08-09_33cac1908709ea1e2f06437b058d6035_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_33cac1908709ea1e2f06437b058d6035_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader
Size 2.4MB
Sample260809-nandssdr7w
SHA256 8c9b7abd1eb096221001881255c3268aae71dc6ec18a22281f1667b359cf2a70
MD5 33cac1908709ea1e2f06437b058d6035
SHA1 a4249827d5fc47d66d08c532811a7eda7f881850
SHA512 ab615675570cdfc8fd7e34f2c151013bad035ca815815b0f0d41fceda8010a467403db115b28da4217baa1a349864c1effd2aabd15bca03bb25cf595a7568cc8
SSDEEP 49152:JWETn/DO7vpDY2gyz1ElNPJD+8yrnLzDzz:JWETnrOzhN51g/D+8O
TLSH
T11FB5AD52FB82CEB1F4920135A0A78B7F4E795E2047E4C0D3879E2C6599306D1B6FB3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_33cac1908709ea1e2f06437b058d6035_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

.exe 2.4MB

2026-08-09_33cac1908709ea1e2f06437b058d6035_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

IMPHASH 711ef244d34993eebde1de46716653d6
SHA256 8c9b7abd1eb096221001881255c3268aae71dc6ec18a22281f1667b359cf2a70
MD5 33cac1908709ea1e2f06437b058d6035
SHA1 a4249827d5fc47d66d08c532811a7eda7f881850
SHA512 ab615675570cdfc8fd7e34f2c151013bad035ca815815b0f0d41fceda8010a467403db115b28da4217baa1a349864c1effd2aabd15bca03bb25cf595a7568cc8
SSDEEP 49152:JWETn/DO7vpDY2gyz1ElNPJD+8yrnLzDzz:JWETnrOzhN51g/D+8O
TLSH
T11FB5AD52FB82CEB1F4920135A0A78B7F4E795E2047E4C0D3879E2C6599306D1B6FB3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ba:ce:bb:be:8b:53:fc:f8:ce:95:70:3f:3b:e7:6a:83:c9:b1:e1:49:88:bf:38:8d:d7:75:93:a6:32:8c:c1:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300MA5G7J4U1P,CN=Shenzhen Chongcheng zhisui Technology Co.\, Ltd,O=Shenzhen Chongcheng zhisui Technology Co.\, Ltd,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e58d97e5b1b1e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 3, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:f1:f6:49:57:31:51:93:3e:26:db:dc:0b:dc:16:b0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 17, 2025 - Jan 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1480446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DecodePointer GetModuleHandleW InterlockedIncrement lstrcmpiW LoadLibraryExW HeapReAlloc HeapSize GetFileSize ReadFile CreateFileW WideCharToMultiByte WriteFile FindClose FileTimeToSystemTime lstrcpyW GetTempPathW GetFileAttributesW GetFileAttributesExW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetTickCount LoadLibraryW GetLongPathNameW GetEnvironmentVariableW GetDriveTypeW GetSystemDirectoryW CreateDirectoryW WTSGetActiveConsoleSessionId LocalFree GetCurrentProcess GetCurrentThreadId GetSystemInfo GetVolumeInformationW GetVersionExW ReleaseMutex CreateMutexW GlobalAlloc GlobalFree LocalAlloc RaiseException TerminateProcess ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl OutputDebugStringA SetPriorityClass FindResourceW GetLastError MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetModuleFileNameW InterlockedDecrement SizeofResource SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetCurrentProcessId DeleteCriticalSection CreateThread Sleep CreateEventW WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection MapViewOfFile CloseHandle FlushViewOfFile UnmapViewOfFile OpenFileMappingW IsBadReadPtr FreeLibrary GetProcessHeap GetProcAddress HeapAlloc GetNativeSystemInfo LoadLibraryA VirtualAlloc FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime LoadResource lstrlenW VirtualFree SetLastError HeapFree VirtualProtect GetPrivateProfileStringW OpenProcess WritePrivateProfileStringW FreeLibraryAndExitThread ExitThread RtlUnwind OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle GetFileType WaitForMultipleObjects SleepEx GetCPInfo GetStringTypeW GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter InitializeCriticalSectionEx EncodePointer LCMapStringEx

user32

wsprintfW CharNextW LoadStringW MessageBoxW GetUserObjectInformationW GetProcessWindowStation

advapi32

RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegEnumKeyW DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor ReportEventW GetTokenInformation OpenProcessToken ImpersonateLoggedOnUser RevertToSelf RegQueryValueExW RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW PathAddBackslashW

wldap32

ord301 ord22 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord41 ord50 ord60 ord211 ord46 ord143

ws2_32

htons ntohs setsockopt socket connect accept gethostname ioctlsocket WSAIoctl getaddrinfo getpeername freeaddrinfo recvfrom sendto listen getsockopt WSAStartup WSACleanup recv send WSAGetLastError __WSAFDIsSet select WSASetLastError bind closesocket getsockname

wtsapi32

WTSQueryUserToken

wininet

InternetQueryOptionW HttpQueryInfoW InternetCloseHandle InternetSetOptionW InternetOpenUrlW InternetReadFile InternetOpenW

generic

count=18, id=241, version=40116,

count=197, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=253, version=28518,

count=19, id=260, version=30034,

count=26, id=259, version=30034,

count=14, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=12, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=93, id=261, version=30034,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=383, id=1, productName=Unmarked objects,

count=35, id=261, version=30148,

count=19, id=265, version=30148,

count=1, id=255, version=30148,

count=1, id=151,

count=1, id=258, version=30148,