2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut
Size 2.0MB
Sample260809-qvphpsycrh
SHA256 cbc77f961bf10deb4f8ae637255ea0cecb05ac188c1e3baeb9be0688c0d351e1
MD5 d7e2ee6a3a5371bb3ce14a211e460a59
SHA1 3109913196a41f0828f91769fbd93d41c13e4b3f
SHA512 74964e9dccc44754aadf0908d8c0c0fb63cbd212ecd0a6f470c0f9bae4b7c7f1d24a4205b3308338c9f1a1556fae4f8820c465e72df4279516d9ff864aab4b30
SSDEEP 49152:/xxUnkKAyo/AgidYDEevutPZAuSu9zDB:/xxBKANogidYGbAu
TLSH
T19AA5CF02FB82C5B3E893163551A6A73FCD3BAE204324D5E3C7D12E669D312D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

File Explorer

2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

.exe 2.0MB

2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

IMPHASH f722776282373a7f0a8ee1ca2d31c993
SHA256 cbc77f961bf10deb4f8ae637255ea0cecb05ac188c1e3baeb9be0688c0d351e1
MD5 d7e2ee6a3a5371bb3ce14a211e460a59
SHA1 3109913196a41f0828f91769fbd93d41c13e4b3f
SHA512 74964e9dccc44754aadf0908d8c0c0fb63cbd212ecd0a6f470c0f9bae4b7c7f1d24a4205b3308338c9f1a1556fae4f8820c465e72df4279516d9ff864aab4b30
SSDEEP 49152:/xxUnkKAyo/AgidYDEevutPZAuSu9zDB:/xxBKANogidYGbAu
TLSH
T19AA5CF02FB82C5B3E893163551A6A73FCD3BAE204324D5E3C7D12E669D312D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ce:49:f7:93:61:72:f0:26:9a:89:eb:e2:54:d2:8b:76:49:ab:df:7c:00:e9:b9:59:39:bb:c6:fd:a3:8f:56:c1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jun 15, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2156670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGWebRender.pdb

kernel32

SetLastError lstrlenW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection ReadFile GetCurrentProcess WriteFile SetFilePointer CreateEventW FormatMessageW LocalFree GetFileSize FindFirstFileW FindNextFileW FindClose FlushFileBuffers HeapFree GetFullPathNameW InitializeCriticalSectionEx LocalAlloc OutputDebugStringW HeapAlloc DecodePointer GetProcessHeap CreateMutexW ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc InitializeCriticalSection SetEvent TerminateProcess lstrcatW GetLocalTime lstrcpyW GetTickCount VirtualQuery IsDebuggerPresent SetUnhandledExceptionFilter EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess GetStdHandle IsValidCodePage GetACP GetOEMCP GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CompareStringW LCMapStringW GetFileType HeapReAlloc GetTimeZoneInformation SetFilePointerEx GetConsoleMode ReadConsoleW SetConsoleCtrlHandler GetFileSizeEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize GetConsoleOutputCP SetEndOfFile WriteConsoleW GetEnvironmentVariableW DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA CreateProcessW FileTimeToSystemTime Sleep SetFileAttributesW GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject OpenMutexW GetModuleHandleW GetCurrentProcessId LoadLibraryW CloseHandle GetLastError GetSystemDirectoryW GetTempPathW GetModuleFileNameW GetCommandLineW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetCurrentDirectoryW LoadLibraryExW DebugBreak FreeLibrary GetProcAddress

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

crypt32

CertOpenStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

ws2_32

WSAGetLastError WSACleanup recv send WSASetLastError closesocket

user32

MessageBoxW GetSystemMetrics SetRectEmpty wvsprintfW GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW SetSecurityDescriptorSacl InitializeSecurityDescriptor InitializeAcl CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegisterEventSourceW DeregisterEventSource GetSecurityDescriptorSacl SetSecurityDescriptorDacl RegCloseKey RegOpenKeyW GetLengthSid AddAccessAllowedAceEx ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo

shell32

SHGetFolderPathW

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_d7e2ee6a3a5371bb3ce14a211e460a59_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

PE Signature issue

kernel32

version

psapi

crypt32

ws2_32

user32

advapi32

shell32

bcrypt

generic