2026-08-09_0281ea914ea55c1cced1f80289a55aaf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_0281ea914ea55c1cced1f80289a55aaf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader
Size 2.3MB
Sample260809-nc91ksab99
SHA256 82825750114ece11044d25e588ec34675b44314dbb1b2e60a9320429d54d6529
MD5 0281ea914ea55c1cced1f80289a55aaf
SHA1 d8ea23e3cd16a860e16814e162c02e98b72f868d
SHA512 5c43bf7cdf9a64a4fe50413aaeab91f8311f50cc87dc67bcbb6faa3d1f45ddf3c8c7f21672b3da8dcea85ac139914b90afc0dde32e605dbbae17342940c3fb96
SSDEEP 49152:yzkYvuJCA+upd6N4uPu3MHFUOwPw+eYX4EOp0z6GXm:mnvuJEg6a2yMHJ9+ec4X
TLSH
T148B5AD52FB82CEB1F4920131A1AB873E4A7A5E2143E4C4D3C79D2C759A701D1B6FB3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_0281ea914ea55c1cced1f80289a55aaf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

.exe 2.3MB

2026-08-09_0281ea914ea55c1cced1f80289a55aaf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

IMPHASH 1d0b245eba1501afafa4b386a95dae87
SHA256 82825750114ece11044d25e588ec34675b44314dbb1b2e60a9320429d54d6529
MD5 0281ea914ea55c1cced1f80289a55aaf
SHA1 d8ea23e3cd16a860e16814e162c02e98b72f868d
SHA512 5c43bf7cdf9a64a4fe50413aaeab91f8311f50cc87dc67bcbb6faa3d1f45ddf3c8c7f21672b3da8dcea85ac139914b90afc0dde32e605dbbae17342940c3fb96
SSDEEP 49152:yzkYvuJCA+upd6N4uPu3MHFUOwPw+eYX4EOp0z6GXm:mnvuJEg6a2yMHJ9+ec4X
TLSH
T148B5AD52FB82CEB1F4920131A1AB873E4A7A5E2143E4C4D3C79D2C759A701D1B6FB3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

08:fc:57:e8:ae:b9:9f:5c:29:0b:9f:38:a8:81:17:32:c3:f0:84:9f:75:28:48:38:38:0d:48:1b:16:b7:a1:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300MA5G7J4U1P,CN=Shenzhen Chongcheng zhisui Technology Co.\, Ltd,O=Shenzhen Chongcheng zhisui Technology Co.\, Ltd,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e58d97e5b1b1e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 3, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:f1:f6:49:57:31:51:93:3e:26:db:dc:0b:dc:16:b0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 17, 2025 - Jan 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1446252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathAddBackslashW SHDeleteKeyW

kernel32

HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GlobalAlloc GlobalFree LocalAlloc VirtualAlloc VirtualFree GetExitCodeProcess GetCurrentThreadId WaitForSingleObject Sleep GetModuleHandleW CreateProcessW QueryDosDeviceW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVolumeInformationW GetSystemInfo GetTickCount GetVersionExW ReleaseMutex CreateMutexW EnterCriticalSection LeaveCriticalSection DeviceIoControl OutputDebugStringA SetPriorityClass SetLastError GetPrivateProfileIntW GetModuleFileNameW GetFileAttributesExW SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WTSGetActiveConsoleSessionId IsValidCodePage FindFirstFileExW SetStdHandle GetFullPathNameW GetCurrentDirectoryW SetFileAttributesW CreateFileW lstrcpyW FileTimeToSystemTime ReadFile WriteFile GetFileSize GetCurrentProcess GetCurrentProcessId FormatMessageW GetLastError LocalFree GetPrivateProfileStringW TerminateProcess OpenProcess GetTempPathW CreateThread lstrlenW MoveFileExW FindNextFileW FindFirstFileW DeleteFileW RemoveDirectoryW FindClose GetSystemDirectoryW LoadLibraryW CloseHandle GetProcAddress FreeLibrary GetCPInfo GetStringTypeW FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID WritePrivateProfileStringW DecodePointer CreateDirectoryW GetDriveTypeW GetEnvironmentVariableW GetLogicalDriveStringsW GetLongPathNameW GetOEMCP IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle GetFileType WaitForMultipleObjects SleepEx GetSystemTimeAsFileTime FormatMessageA InitializeCriticalSectionEx EncodePointer LCMapStringEx QueryPerformanceCounter InitializeCriticalSection

user32

LoadStringW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW

advapi32

ReportEventW RegisterEventSourceW RegOpenKeyW DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken ImpersonateLoggedOnUser RevertToSelf RegEnumKeyW RegDeleteKeyExW RegCreateKeyExA RegQueryValueExW RegDeleteKeyW RegCreateKeyExW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource

shell32

SHGetSpecialFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose

psapi

EnumProcessModules GetModuleFileNameExW GetProcessImageFileNameW

wldap32

ord143 ord46 ord211 ord60 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord50 ord41

ws2_32

WSACleanup recv send WSAGetLastError __WSAFDIsSet gethostname ioctlsocket select WSASetLastError bind closesocket connect getpeername getsockname getsockopt WSAStartup ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen htons

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_0281ea914ea55c1cced1f80289a55aaf_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader

shlwapi

kernel32

user32

advapi32

shell32

ole32

crypt32

psapi

wldap32

ws2_32

wtsapi32

generic