2026-08-11_dd305ddca9cee84ca044f27b8a558af5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_dd305ddca9cee84ca044f27b8a558af5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil
Size 19.0MB
Sample260811-sdmznavfrd
SHA256 37ba190f127316d5e321591c36156d56004d9883b3ee47d0bdef6cddd0e6a808
MD5 dd305ddca9cee84ca044f27b8a558af5
SHA1 3180bf0d92f5e3019201e7861eb0032208427f45
SHA512 73962aa8bf4eed735c3e2c2e30ba72637050b77956ba0ce6960ddd1e8569afb6020caa9dda561239142bc4ec2a4a9ed9e7733eb5583116ff7a0dbe1a6c6c0b3d
SSDEEP 393216:v7MsD+5U4G498Fia7wowy0WCQpoSJsv6tWKFdu9CaEx:qUO98oa/50WuEx
TLSH
T18517E142B6C340B1EA611170996BE36AC735B9158BB6C6D7B3883BDD9E31390793B343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-11_dd305ddca9cee84ca044f27b8a558af5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil

.exe 19.0MB

2026-08-11_dd305ddca9cee84ca044f27b8a558af5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil

IMPHASH 5ff4df93de1e71826da76be39de2957e
SHA256 37ba190f127316d5e321591c36156d56004d9883b3ee47d0bdef6cddd0e6a808
MD5 dd305ddca9cee84ca044f27b8a558af5
SHA1 3180bf0d92f5e3019201e7861eb0032208427f45
SHA512 73962aa8bf4eed735c3e2c2e30ba72637050b77956ba0ce6960ddd1e8569afb6020caa9dda561239142bc4ec2a4a9ed9e7733eb5583116ff7a0dbe1a6c6c0b3d
SSDEEP 393216:v7MsD+5U4G498Fia7wowy0WCQpoSJsv6tWKFdu9CaEx:qUO98oa/50WuEx
TLSH
T18517E142B6C340B1EA611170996BE36AC735B9158BB6C6D7B3883BDD9E31390793B343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

df:74:7d:20:d2:e7:fc:85:33:77:a9:cd:78:dc:64:af:0c:cc:b0:21:4b:ec:da:2c:5c:0c:a3:17:f6:c4:ae:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9131012030160721XG,CN=Shanghai Microvirt Software Technology Co.\, Ltd.,O=Shanghai Microvirt Software Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a589e8b4a4e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 31, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

0c:1a:bb:0f:84:12:de:30:4f:26:2d:26:66:8f:db:01:19:9f:c2:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 31, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0c:13:2c:c0:ed:df:08:4d:0c:09:42:f8:6f:b1:ab:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 5, 2025 - Sep 16, 2027

Minor OS version

Major OS version

Entry point

7323405

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExpandEnvironmentStringsW GlobalSize TerminateThread SetThreadPriority UnregisterWaitEx RegisterWaitForSingleObject GetSystemDirectoryW UnmapViewOfFile MapViewOfFile CreateFileMappingW SetEndOfFile GetFileType SetFilePointerEx FlushFileBuffers FileTimeToSystemTime MoveFileExW CopyFileW GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetFileAttributesW RemoveDirectoryW CreateDirectoryW GetFileAttributesExW GetLogicalDrives SetErrorMode SetFileTime GetFileInformationByHandleEx GetFileInformationByHandle GetFullPathNameW TlsFree TlsAlloc GetCommandLineW GetSystemTime GetLocalTime CompareStringEx GetVolumeInformationW GetDriveTypeW GetDiskFreeSpaceExW lstrlenW lstrcmpiA FindResourceW SizeofResource LockResource LoadResource FreeResource WriteFile GetThreadPriority QueryPerformanceFrequency QueryPerformanceCounter GetTickCount CreateThread FindClose FindCloseChangeNotification FindFirstChangeNotificationW WriteConsoleW HeapSize GetFileSizeEx GetOEMCP GetACP IsValidCodePage SetEnvironmentVariableW HeapReAlloc EnumSystemLocalesW GlobalLock LCMapStringW CompareStringW SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler SetFileAttributesW SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread ExitThread GetCommandLineA RtlUnwind IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx RaiseException ReleaseMutex CreateMutexW VirtualAlloc VirtualFree ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertThreadToFiber ConvertFiberToThread GetSystemTimeAsFileTime CreateFiber DeleteFiber SwitchToFiber InitializeCriticalSectionAndSpinCount SetHandleInformation GlobalFree GetOverlappedResult LocalAlloc DisconnectNamedPipe ExitProcess GetUserDefaultLangID lstrcmpW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection FindFirstFileW SwitchToThread GetSystemInfo WaitForMultipleObjects SetEvent CreateEventW GetCurrentThread DuplicateHandle GetCurrentThreadId TlsGetValue GlobalUnlock GlobalAlloc CheckRemoteDebuggerPresent WTSGetActiveConsoleSessionId GetModuleHandleExW FindNextFileW FindFirstFileExW GetGeoInfoW GetTimeZoneInformation GetUserGeoID GetUserPreferredUILanguages GetLocaleInfoW GetTimeFormatW GetDateFormatW GetCurrencyFormatW GetUserDefaultLCID WriteFileEx SleepEx PeekNamedPipe ReadFileEx IsValidLocale CancelIoEx GetVolumePathNamesForVolumeNameW DeviceIoControl SystemTimeToFileTime TzSpecificLocalTimeToSystemTime FormatMessageW GetTickCount64 GetModuleFileNameW IsProcessorFeaturePresent OutputDebugStringW ResetEvent GetProcessId WaitForSingleObjectEx GetConsoleWindow SetFilePointer GetStdHandle ConnectNamedPipe CreateNamedPipeW FreeEnvironmentStringsW GetEnvironmentStringsW CreateFileW FindNextChangeNotification DeleteFileW SetDllDirectoryW LoadLibraryExW SetCurrentDirectoryW Thread32Next Thread32First Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetModuleFileNameExW GetUserDefaultUILanguage WideCharToMultiByte MultiByteToWideChar MoveFileW LocalFree LoadLibraryW LoadLibraryA GetProcAddress GetModuleHandleW GetModuleHandleA FreeLibrary OpenProcess GetStartupInfoW CreateProcessW ResumeThread OpenThread GetExitCodeProcess TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep WaitForSingleObject GetProcessHeap HeapFree HeapAlloc WaitNamedPipeW CreatePipe SetLastError GetLastError CloseHandle ReadFile TlsSetValue

user32

SetWindowLongW CreateWindowExW UnregisterClassW RegisterClassW CallNextHookEx SetTimer DefWindowProcW GetQueueStatus PeekMessageW KillTimer DestroyWindow MessageBoxW PostThreadMessageW EnumWindows GetWindowLongW GetWindowRect SetWindowPos GetWindowThreadProcessId GetShellWindow SetWindowsHookExW ChangeWindowMessageFilterEx RealGetWindowClassW GetWindowTextW CloseTouchInputHandle GetTouchInputInfo MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW GetDesktopWindow CharNextExA SystemParametersInfoW GetSystemMenu EnableMenuItem GetSysColor GetSystemMetrics UpdateLayeredWindowIndirect GetCaretBlinkTime GetDoubleClickTime IsWindow MessageBeep EndPaint BeginPaint IsIconic GetAncestor InvalidateRect SetForegroundWindow ReleaseCapture GetParent UpdateLayeredWindow GetClientRect DrawIconEx RegisterDeviceNotificationW UnregisterDeviceNotification GetUserObjectInformationW GetProcessWindowStation GetMessageExtraInfo GetAsyncKeyState TrackMouseEvent GetIconInfo GetCursor GetCursorInfo CreateIconIndirect CreateCursor LoadCursorW SetCursorPos GetClipboardFormatNameW EnumDisplayDevicesW RegisterClipboardFormatW GetMenuItemInfoW ModifyMenuW CreatePopupMenu TrackPopupMenu SetMenu DestroyMenu FlashWindowEx SetCursor SetCapture SetParent GetUpdateRect SetFocus ReleaseDC GetDC PostMessageW UnhookWindowsHookEx SetLayeredWindowAttributes UnregisterTouchWindow DrawMenuBar InsertMenuW RemoveMenu AppendMenuW CreateMenu LoadIconW GetKeyState MapVirtualKeyW GetKeyboardState SetMenuItemInfoW ToUnicode TrackPopupMenuEx IsZoomed ToAscii MonitorFromWindow EnumDisplayMonitors GetMonitorInfoW HideCaret SetCaretPos CreateCaret GetKeyboardLayout IsWindowEnabled DestroyCaret ShowCaret RegisterWindowMessageW FindWindowA SetClipboardViewer IsHungAppWindow ChangeClipboardChain GetFocus ChildWindowFromPointEx RegisterClassExW WindowFromPoint GetClassInfoW GetKeyboardLayoutList UnregisterPowerSettingNotification RegisterPowerSettingNotification GetSysColorBrush LoadImageW GetCursorPos AdjustWindowRectEx IsTouchWindow MonitorFromPoint GetWindow GetMenu IsWindowVisible SetWindowRgn ScreenToClient SendMessageW SetWindowTextW GetWindowPlacement DestroyCursor ShowWindow GetCapture DestroyIcon RegisterTouchWindow ClientToScreen IsChild SetWindowPlacement AttachThreadInput GetForegroundWindow MoveWindow

shell32

SHCreateItemFromParsingName CommandLineToArgvW ord727 Shell_NotifyIconGetRect SHGetFileInfoW SHGetStockIconInfo ShellExecuteW SHGetMalloc SHBrowseForFolderW SHGetKnownFolderIDList SHGetPathFromIDListW SHCreateItemFromIDList Shell_NotifyIconW SHChangeNotify

ole32

StringFromGUID2 RegisterDragDrop CoLockObjectExternal CoTaskMemFree OleInitialize OleSetClipboard CoCreateGuid CoUninitialize CoCreateInstance CoInitialize RevokeDragDrop OleIsCurrentClipboard OleGetClipboard OleFlushClipboard CoInitializeEx DoDragDrop ReleaseStgMedium CoGetMalloc OleUninitialize

advapi32

CryptGetUserKey DuplicateToken BuildTrusteeWithSidW CopySid GetLengthSid RegSetValueExW RegQueryValueExA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExA RegEnumValueW RegDeleteKeyW RegCreateKeyExW CreateServiceW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey SetNamedSecurityInfoW SetEntriesInAclW StartServiceW QueryServiceStatusEx OpenServiceA OpenSCManagerW CloseServiceHandle ChangeServiceConfigA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority FreeSid DuplicateTokenEx CheckTokenMembership AllocateAndInitializeSid OpenProcessToken LookupAccountSidW MapGenericMask AccessCheck GetEffectiveRightsFromAclW RegEnumKeyExW RegFlushKey SystemFunction036 InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegNotifyChangeKeyValue DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam GetNamedSecurityInfoW CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW

ws2_32

gethostname WSAStartup WSACleanup WSAAsyncSelect htonl getsockopt getnameinfo getaddrinfo ntohl freeaddrinfo WSAIoctl setsockopt htons WSANtohs WSANtohl WSAGetLastError WSASocketW getsockname WSAConnect bind listen WSAAccept WSARecvFrom WSARecv WSAHtonl WSASendTo WSASend select __WSAFDIsSet closesocket recv send WSASetLastError getpeername

gdi32

CombineRgn DeleteObject SelectClipRgn CreateRectRgn OffsetRgn SetLayout SetPixelFormat GetPixelFormat SwapBuffers ChoosePixelFormat DescribePixelFormat CreateBitmap DeleteDC CreateDCW CreateCompatibleDC SelectObject CreateCompatibleBitmap GetObjectW GetBitmapBits GetDeviceCaps BitBlt GetRegionData GdiFlush CreateDIBSection CreateFontIndirectW GetFontData EnumFontFamiliesExW AddFontMemResourceEx RemoveFontMemResourceEx GetTextMetricsW AddFontResourceExW RemoveFontResourceExW GetStockObject GetTextFaceW GetOutlineTextMetricsW GetTextExtentPoint32W SetGraphicsMode SetWorldTransform GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsI GetCharABCWidthsW SetTextColor SetBkMode SetTextAlign ExtTextOutW GetDIBits

oleaut32

SafeArrayCreateVector SysFreeString SysAllocString SafeArrayPutElement

imm32

ImmAssociateContextEx ImmSetCandidateWindow ImmGetOpenStatus ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME

winmm

timeSetEvent timeKillEvent PlaySoundW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

uxtheme

GetThemeColor GetThemePartSize OpenThemeData GetThemeInt GetThemeMargins GetThemeEnumValue GetThemeTransitionDuration GetThemePropertyOrigin GetThemeBool ord47 CloseThemeData IsThemeActive GetCurrentThemeName GetThemeBackgroundRegion SetWindowTheme IsAppThemed IsThemeBackgroundPartiallyTransparent

dwmapi

DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute DwmEnableBlurBehindWindow

iphlpapi

ConvertInterfaceNameToLuidW ConvertInterfaceIndexToLuid ConvertInterfaceLuidToGuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW GetAdaptersAddresses GetAdaptersInfo

crypt32

CertCloseStore CertOpenSystemStoreW CertFindCertificateInStore CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertDuplicateCertificateContext

userenv

GetUserProfileDirectoryW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

NetShareEnum NetApiBufferFree

bcrypt

BCryptGenRandom

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.5MB

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

336KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_dd305ddca9cee84ca044f27b8a558af5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil

kernel32

user32

shell32

ole32

advapi32

ws2_32

gdi32

oleaut32

imm32

winmm

wtsapi32

uxtheme

dwmapi

iphlpapi

crypt32

userenv

version

netapi32

bcrypt

generic