2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat
Size 5.6MB
Sample260811-2fa8batblh
SHA256 29cdf5e0210561541c92dc62b6dcc8528a85304b6ef9d9efe6496aa909402d02
MD5 93cf7211d88bd57b94823fcea2fd7134
SHA1 db69265012e5a15a815a52e42e85134286e69058
SHA512 679aeac4edb78dee2d5228fa66ff821f34fe43bab20d53dcd9c4a0ab24937b9a3d50c7e84421b0aca594117cd59c3cafc13c37141b17372184383a2620cbee66
SSDEEP 98304:ciY9LAwrBqOLnNp1SibRzQCUwJcAms+y/5tpKjQRxfbqc37frcB8ACNY0PGKjnD:crAwgOfrD/5tpKjQ7P37f4CNxP5jD
TLSH
T1A346BEE379808072C6120370A82DB73D89FDAEF01A75D653AF94265DEE724D2D636783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat

File Explorer

2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat

.exe 5.6MB

2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat

IMPHASH afebbbe9b9799717740964fe8e1f9091
SHA256 29cdf5e0210561541c92dc62b6dcc8528a85304b6ef9d9efe6496aa909402d02
MD5 93cf7211d88bd57b94823fcea2fd7134
SHA1 db69265012e5a15a815a52e42e85134286e69058
SHA512 679aeac4edb78dee2d5228fa66ff821f34fe43bab20d53dcd9c4a0ab24937b9a3d50c7e84421b0aca594117cd59c3cafc13c37141b17372184383a2620cbee66
SSDEEP 98304:ciY9LAwrBqOLnNp1SibRzQCUwJcAms+y/5tpKjQRxfbqc37frcB8ACNY0PGKjnD:crAwgOfrD/5tpKjQ7P37f4CNxP5jD
TLSH
T1A346BEE379808072C6120370A82DB73D89FDAEF01A75D653AF94265DEE724D2D636783
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

44:68:14:78:b6:61:c5:bb:9a:db:2f:30:27:ba:96:b5:c4:3c:50:42:e5:77:a0:57:1c:77:37:49:95:db:86:3c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 19, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1d:f3:14:e9:79:07:11:80:07:30:0a:3e:ad:c4:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2023 - Oct 6, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3291884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildServer\bna-2\work-git\agent-repository\build\bin\win32-i386-vc141-release\Agent.pdb

wintrust

WinVerifyTrust

bcrypt

BCryptGenRandom

advapi32

CryptSetHashParam RegOpenKeyExA CryptEncrypt CryptImportKey OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership DuplicateTokenEx FreeSid GetTokenInformation SetTokenInformation LookupPrivilegeValueW CreateProcessWithTokenW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfigW ControlService CreateServiceW DeleteService QueryServiceStatus StartServiceW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW GetSecurityInfo SetSecurityInfo OpenThreadToken AccessCheck DuplicateToken EqualSid GetFileSecurityW GetSecurityDescriptorDacl InitializeSecurityDescriptor MapGenericMask SetSecurityDescriptorDacl QueryServiceObjectSecurity SetServiceObjectSecurity SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildTrusteeWithSidW ConvertStringSidToSidW GetAce InitializeAcl RegDeleteKeyW RegEnumValueW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptHashData CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW RegGetValueW CryptGetHashParam CryptGenRandom

dxgi

CreateDXGIFactory1

iphlpapi

GetExtendedTcpTable

powrprof

CallNtPowerInformation

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl

crypt32

CertCreateCertificateChainEngine CertFindExtension CertGetNameStringA CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertGetCertificateContextProperty CertDuplicateCertificateContext CertOpenSystemStoreA CryptStringToBinaryA CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext CertDeleteCertificateFromStore CertAddCertificateContextToStore CertCreateCertificateContext CertEnumCertificatesInStore CertOpenStore CryptQueryObject CertGetNameStringW CryptProtectData CryptUnprotectData CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore

kernel32

HeapSize HeapFree HeapAlloc GetDateFormatW GetTimeFormatW ExitThread GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetLocaleInfoA OutputDebugStringA IsValidLocale ExitProcess GetProcessHeap IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow SetErrorMode SetConsoleCtrlHandler DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetProcessId OpenProcess GetWindowsDirectoryW GetVersionExW CreateJobObjectW OpenJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject GetModuleFileNameW GetModuleHandleW GetProcAddress LocalAlloc LocalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetVolumePathNameW ReadFile SetFileAttributesW SetFilePointer WriteFile CopyFileW MoveFileExW FileTimeToSystemTime CreateFileMappingW OpenFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GlobalMemoryStatusEx GetModuleHandleA GlobalMemoryStatus FormatMessageA GetCurrentThread GlobalFree lstrlenW IsWow64Process FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter GetCurrentThreadId RtlCaptureContext IsDebuggerPresent TerminateProcess OpenThread SuspendThread ResumeThread GetThreadContext VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Thread32First Thread32Next SetEvent CreateEventW CreateThread LoadLibraryW FindClose FindFirstFileW GetFileAttributesW GetTempPathW SetLastError CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency Module32FirstW Module32NextW GetSystemTime SystemTimeToFileTime WriteConsoleW GetModuleHandleExW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetFileType DeleteFiber FormatMessageW GetSystemTimeAsFileTime ConvertFiberToThread SetStdHandle LoadLibraryA FindNextFileW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateMutexW OpenMutexW Sleep GetFullPathNameW QueryFullProcessImageNameA DeleteFileW SetEndOfFile SetFilePointerEx GetFileSizeEx CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetOverlappedResult CancelIoEx SetThreadPriority GetThreadPriority GetProcessAffinityMask SetThreadAffinityMask InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW RemoveDirectoryW MoveFileW FlushFileBuffers GetSystemInfo GetLogicalProcessorInformationEx GetNativeSystemInfo GetTimeZoneInformation InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryEnterCriticalSection ResetEvent GetVolumeNameForVolumeMountPointW DeviceIoControl ReleaseSemaphore CreateSemaphoreExW DuplicateHandle VirtualProtect CreateActCtxW ActivateActCtx DeactivateActCtx ReleaseMutex SetEnvironmentVariableW GetComputerNameW OutputDebugStringW SleepEx VerSetConditionMask GetSystemDirectoryW VerifyVersionInfoW GetTickCount WaitForSingleObjectEx GetEnvironmentVariableA SwitchToThread GetExitCodeThread EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW CreateTimerQueue SignalObjectAndWait GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetCommandLineA GetCommandLineW FindFirstFileExW SystemTimeToTzSpecificLocalTime GetFileInformationByHandle PeekNamedPipe GetConsoleOutputCP FreeEnvironmentStringsW

shell32

CommandLineToArgvW SHChangeNotify SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CoInitializeSecurity

ws2_32

inet_ntop WSAIoctl getpeername WSASetLastError __WSAFDIsSet shutdown getsockname connect freeaddrinfo getaddrinfo send recv ioctlsocket inet_pton socket setsockopt listen htons htonl getsockopt closesocket bind accept WSCEnumProtocols WSACleanup WSAStartup ntohs ntohl WSAGetLastError select

user32

ShowWindow TranslateMessage DispatchMessageW PeekMessageW GetForegroundWindow GetShellWindow GetWindowThreadProcessId DefWindowProcW CreateWindowExW GetWindow EnumThreadWindows GetDesktopWindow IsWindowVisible MessageBoxW GetUserObjectInformationW GetProcessWindowStation LoadStringW LoadIconW LoadCursorW UpdateWindow RegisterClassExW

oleaut32

SysAllocString SysFreeString VariantInit VariantClear VariantChangeType SysStringLen SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantCopy

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_93cf7211d88bd57b94823fcea2fd7134_amadey_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_njrat

PE Signature issue

wintrust

bcrypt

advapi32

dxgi

iphlpapi

powrprof

rpcrt4

version

winhttp

crypt32

kernel32

shell32

ole32

ws2_32

user32

oleaut32

generic