2026-08-09_b270ebc6c6bfc83c96edbeb5f82a6f09_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_play_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_b270ebc6c6bfc83c96edbeb5f82a6f09_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_play_revil
Size 16.7MB
Sample260809-wxedeabp2x
SHA256 88835c9af5246b1f6ca68fbe3ca2e3179f51c0698a6781156fbbeaf5ac569754
MD5 b270ebc6c6bfc83c96edbeb5f82a6f09
SHA1 4085734bce8c23f45b375535790606529800454e
SHA512 2dbab234ef54e0dd6e01cbcd46f56c3cf4034038a84caecdc85924657ed0192245ae3a575a6c0ba523a9e854e912ffe2291736159b80959e9afdfe9907f4753a
SSDEEP 393216:vyPuuTuGuz4gsIMOGxmJ64PZhI99k9quY9waS9o3:EPuGujaxmzI9OQP
TLSH
T1F0071252FF4285B1D8C2017562EA6B7F493D9E248B3484C3DBD029FA88705D2673F79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_b270ebc6c6bfc83c96edbeb5f82a6f09_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_play_revil

.exe 16.7MB

2026-08-09_b270ebc6c6bfc83c96edbeb5f82a6f09_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_play_revil

IMPHASH c3040b653e23477ce06b0852cca130e2
SHA256 88835c9af5246b1f6ca68fbe3ca2e3179f51c0698a6781156fbbeaf5ac569754
MD5 b270ebc6c6bfc83c96edbeb5f82a6f09
SHA1 4085734bce8c23f45b375535790606529800454e
SHA512 2dbab234ef54e0dd6e01cbcd46f56c3cf4034038a84caecdc85924657ed0192245ae3a575a6c0ba523a9e854e912ffe2291736159b80959e9afdfe9907f4753a
SSDEEP 393216:vyPuuTuGuz4gsIMOGxmJ64PZhI99k9quY9waS9o3:EPuGujaxmzI9OQP
TLSH
T1F0071252FF4285B1D8C2017562EA6B7F493D9E248B3484C3DBD029FA88705D2673F79A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b6:f9:ca:ff:37:96:b6:09:79:d2:c4:fc:a8:19:a5:2d:32:15:46:45:51:fa:bc:56:d2:cc:c0:aa:c3:1f:91:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MA7EUJ0408,CN=Chengdu Aishang Office Technology Co.\, Ltd.,O=Chengdu Aishang Office Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#131b5369636875616e205469616e6675204e6577204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 31, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:41:cc:5a:c5:d7:73:88:cd:8d:35:d1:46:0a:c3:b2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2025 - Jul 29, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

896266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xd_gitlab\DLLRepair\main\Output\bin\Release\Win32\Setup.pdb

kernel32

LockResource GetLastError HeapSize InitializeCriticalSectionEx GetModuleFileNameW GetCommandLineW HeapFree HeapReAlloc FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap EnterCriticalSection LeaveCriticalSection GetCurrentThreadId MultiByteToWideChar RaiseException CompareStringEx LCMapStringEx GetLocaleInfoEx GetProcAddress GetModuleHandleW TryAcquireSRWLockExclusive FreeLibrary lstrcmpiW LoadLibraryExW SetLastError LocalAlloc CreateFileA WriteConsoleW GetCurrentDirectoryW GetTimeZoneInformation GetStringTypeW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleOutputCP SetConsoleCtrlHandler SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle FreeLibraryAndExitThread ExitThread RtlUnwind MulDiv FreeResource CreateThread CopyFileW CreateDirectoryW MoveFileW ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA ReleaseSemaphore CreateFiberEx DeleteFiber SwitchToFiber GetACP GetModuleHandleExW FormatMessageA LoadLibraryA GetSystemDirectoryA TlsFree TlsSetValue TlsGetValue IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte CloseHandle OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObject LoadLibraryW lstrlenW GlobalAlloc GlobalFree lstrcmpA CreateProcessW GetExitCodeProcess CreatePipe ReadFile SetEndOfFile SetFilePointer CreateFileW GetFileSizeEx FindFirstFileW RemoveDirectoryW DeleteFileW FindNextFileW FindClose MoveFileExW SetFileAttributesW GetTickCount GetFileAttributesExW DeviceIoControl GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW lstrcmpW LocalFileTimeToFileTime LocalFree GetPrivateProfileStringW SystemTimeToFileTime GetSystemTime GetPrivateProfileIntW GetThreadLocale SetThreadLocale VerSetConditionMask VerifyVersionInfoW GetVersionExW CreateMutexW lstrlenA InitializeCriticalSection Sleep GetSystemInfo GetLocalTime VirtualProtect ExitProcess GetSystemDirectoryW GetEnvironmentVariableW GetVersion GetNativeSystemInfo GetFileSize WriteFile ReleaseMutex ResetEvent SetEvent PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateEventW CreateIoCompletionPort GetQueuedCompletionStatus FlushFileBuffers QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount WritePrivateProfileStringW GetFullPathNameW FormatMessageW WaitForSingleObjectEx GetEnvironmentVariableA CompareFileTime GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx GetModuleHandleA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc SizeofResource

user32

SetForegroundWindow BringWindowToTop SetActiveWindow FindWindowW IsWindowVisible IsIconic GetDC ReleaseDC SetFocus PostMessageW GetProcessWindowStation GetUserObjectInformationW DestroyIcon LoadImageW SetRectEmpty IsRectEmpty GetIconInfo CopyRect MonitorFromPoint SystemParametersInfoW BeginPaint EndPaint GetShellWindow InvalidateRect PtInRect TrackMouseEvent GetCursorPos SetCapture ReleaseCapture GetForegroundWindow SetWindowRgn EnableWindow IsZoomed MonitorFromRect OffsetRect SetLayeredWindowAttributes SetCursor ScreenToClient GetDoubleClickTime IntersectRect DrawTextW FillRect UnionRect UpdateLayeredWindow wsprintfW RegisterClassExW CreateWindowExW AttachThreadInput SetTimer LoadCursorW KillTimer GetClassInfoExW GetWindowLongW DefWindowProcW CallWindowProcW GetWindow GetWindowRect SetWindowPos MonitorFromWindow SendMessageW ShowWindow IsWindow GetMonitorInfoW MapWindowPoints MoveWindow LoadIconW SetWindowLongW GetClientRect GetDlgItem ClientToScreen GetWindowThreadProcessId UnregisterClassW TranslateMessage CharNextW PeekMessageW DispatchMessageW MessageBoxW DestroyWindow GetMessageW GetParent PostQuitMessage EqualRect

advapi32

DeleteService OpenProcessToken DuplicateTokenEx OpenSCManagerW AllocateAndInitializeSid CheckTokenMembership FreeSid CreateProcessWithTokenW CloseServiceHandle ControlService StartServiceW ChangeServiceConfigW QueryServiceConfigW QueryServiceStatus OpenServiceW RegEnumKeyW GetUserNameW RegGetValueW RegEnumValueW CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptReleaseContext CryptHashData CryptDeriveKey CryptEncrypt CryptDecrypt DeregisterEventSource RegisterEventSourceW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegQueryValueExW ReportEventW CryptEnumProvidersW CryptSignHashW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptGetHashParam CryptGenRandom

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ord165 SHChangeNotify ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ShellExecuteExW

ole32

CoTaskMemAlloc CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoInitialize CoUninitialize CoInitializeSecurity CoCreateGuid

oleaut32

LoadTypeLi VarUI4FromStr SysFreeString VarBstrCmp LoadRegTypeLi VariantClear SysStringLen VarDateFromStr VariantTimeToSystemTime VariantInit SysAllocString

shlwapi

PathFileExistsW PathFindFileNameW PathRemoveFileSpecW SHGetValueW PathIsRootW PathCombineW PathRemoveBackslashW PathFindExtensionW PathSearchAndQualifyW SHDeleteValueW PathStripToRootW PathIsDirectoryW PathAppendW PathRemoveExtensionW

crypt32

CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

ws2_32

WSACleanup setsockopt getaddrinfo WSASocketA shutdown socket WSAStartup getservbyname getservbyport gethostbyaddr inet_addr closesocket sendto freeaddrinfo recvfrom ntohl ioctlsocket getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAIoctl getpeername recv listen htonl WSAWaitForMultipleEvents WSAGetLastError ntohs WSASetLastError gethostname inet_ntoa gethostbyname htons __WSAFDIsSet select accept bind connect getsockname

wldap32

ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord79 ord133 ord145 ord219 ord147 ord46 ord301 ord14 ord216

gdiplus

GdiplusStartup GdipDrawString GdipSetTextRenderingHint GdipDeleteBrush GdipCreateSolidFill GdipDeleteFont GdipCreateFont GdipCreateBitmapFromStream GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectI GdipCreateBitmapFromFile GdipSetInterpolationMode GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDeleteFontFamily

wininet

InternetConnectW InternetSetOptionW InternetOpenW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetReadFile HttpOpenRequestW HttpQueryInfoW

psapi

EnumProcessModules

netapi32

Netbios

secur32

GetUserNameExW

iphlpapi

GetIpAddrTable GetAdaptersInfo

gdi32

SetTextCharacterExtra GetCurrentObject GetObjectW GetStockObject SetPixel CreateDIBSection DeleteObject CreateCompatibleDC SelectObject GetTextColor BitBlt DeleteDC SetStretchBltMode StretchBlt GetBitmapBits GetDeviceCaps CreateRoundRectRgn CombineRgn CreateRectRgn SetBkMode SetTextColor CreateSolidBrush SaveDC CreateRectRgnIndirect ExtSelectClipRgn RestoreDC CreatePen Rectangle CreateFontIndirectW SetBitmapBits

comctl32

DrawShadowText ord17

msimg32

AlphaBlend

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

875KB

Virtual Size

874KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12.2MB

Virtual Size

12.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b270ebc6c6bfc83c96edbeb5f82a6f09_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_njrat_play_revil

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

ws2_32

wldap32

gdiplus

wininet

psapi

netapi32

secur32

iphlpapi

gdi32

comctl32

msimg32

generic