2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut
Size 2.0MB
Sample260809-wrcydswvez
SHA256 a3f4007592d80e56b358a9bafaa1825e5fcfc253d0b6d3e3fc096b4683e3191f
MD5 dcdf5bf8438284ae0a8e3dd1e58c9695
SHA1 3c2db239b1d4b51bd9b4ac80a3fefe03c7cbe536
SHA512 19a73a48c868474219f15dfd3f442a28d18d634be717eb5a941c7d9ca711bf2997b997cb8bd2bc9e6d394a52ab8521b3124261c676bbcef8ff0c1d5e6a554f3d
SSDEEP 49152:rxxUnkKAyo/AgidYDEevutPZAuSu9zDB:rxxBKANogidYGbAu
TLSH
T139A5CF02FB82C5B3E893163551A6A73FCD3BAE204324D5E3C7D12E669D312D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

File Explorer

2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

.exe 2.0MB

2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

IMPHASH f722776282373a7f0a8ee1ca2d31c993
SHA256 a3f4007592d80e56b358a9bafaa1825e5fcfc253d0b6d3e3fc096b4683e3191f
MD5 dcdf5bf8438284ae0a8e3dd1e58c9695
SHA1 3c2db239b1d4b51bd9b4ac80a3fefe03c7cbe536
SHA512 19a73a48c868474219f15dfd3f442a28d18d634be717eb5a941c7d9ca711bf2997b997cb8bd2bc9e6d394a52ab8521b3124261c676bbcef8ff0c1d5e6a554f3d
SSDEEP 49152:rxxUnkKAyo/AgidYDEevutPZAuSu9zDB:rxxBKANogidYGbAu
TLSH
T139A5CF02FB82C5B3E893163551A6A73FCD3BAE204324D5E3C7D12E669D312D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

94:a7:34:48:77:0c:66:14:7d:a6:7d:a5:fb:92:58:0e:d2:29:74:b3:ee:05:10:41:e7:fb:0d:2b:13:d4:e2:c4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jun 15, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2161165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGWebRender.pdb

kernel32

SetLastError lstrlenW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection ReadFile GetCurrentProcess WriteFile SetFilePointer CreateEventW FormatMessageW LocalFree GetFileSize FindFirstFileW FindNextFileW FindClose FlushFileBuffers HeapFree GetFullPathNameW InitializeCriticalSectionEx LocalAlloc OutputDebugStringW HeapAlloc DecodePointer GetProcessHeap CreateMutexW ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc InitializeCriticalSection SetEvent TerminateProcess lstrcatW GetLocalTime lstrcpyW GetTickCount VirtualQuery IsDebuggerPresent SetUnhandledExceptionFilter EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess GetStdHandle IsValidCodePage GetACP GetOEMCP GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CompareStringW LCMapStringW GetFileType HeapReAlloc GetTimeZoneInformation SetFilePointerEx GetConsoleMode ReadConsoleW SetConsoleCtrlHandler GetFileSizeEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize GetConsoleOutputCP SetEndOfFile WriteConsoleW GetEnvironmentVariableW DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA CreateProcessW FileTimeToSystemTime Sleep SetFileAttributesW GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject OpenMutexW GetModuleHandleW GetCurrentProcessId LoadLibraryW CloseHandle GetLastError GetSystemDirectoryW GetTempPathW GetModuleFileNameW GetCommandLineW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetCurrentDirectoryW LoadLibraryExW DebugBreak FreeLibrary GetProcAddress

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

crypt32

CertOpenStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

ws2_32

WSAGetLastError WSACleanup recv send WSASetLastError closesocket

user32

MessageBoxW GetSystemMetrics SetRectEmpty wvsprintfW GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW SetSecurityDescriptorSacl InitializeSecurityDescriptor InitializeAcl CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegisterEventSourceW DeregisterEventSource GetSecurityDescriptorSacl SetSecurityDescriptorDacl RegCloseKey RegOpenKeyW GetLengthSid AddAccessAllowedAceEx ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo

shell32

SHGetFolderPathW

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_dcdf5bf8438284ae0a8e3dd1e58c9695_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_virut

PE Signature issue

kernel32

version

psapi

crypt32

ws2_32

user32

advapi32

shell32

bcrypt

generic