2026-08-13_32bca53612a876ba53975319099e8fb3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_32bca53612a876ba53975319099e8fb3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader
Size 2.5MB
Sample260813-l36dzafk21
SHA256 2dde61337df910bcd14735c5c2583d81b2d69e76da7111550d53b36f70f13e7d
MD5 32bca53612a876ba53975319099e8fb3
SHA1 af1e7ecae53586a3392400208fdc3159109e7104
SHA512 100bc85965190511dffa001927ce6a98a719cd2a9d4f391d2fae910fc16eb68a253184387fd822dcdb5ebdd84f0f52922ceb0ec7f0e7e469c522bafe6cc9eaac
SSDEEP 49152:2tYa0z3WOLVXqlT57IHm7H+vlBPHjHYnsPbQQq4TBVPaOP57NrdzS560WsOv4Is:pRXql5EGDMBPMsPEISE7Nrdz1E
TLSH
T17EC5CF12FB818072E6A3053956BA677B5D3DA9304729C5D3E3D02A6C5D303E2BA3D787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-13_32bca53612a876ba53975319099e8fb3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

.exe 2.5MB

2026-08-13_32bca53612a876ba53975319099e8fb3_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil_smoke-loader

IMPHASH d93dc8f19f3c9570830d6277bed0ed7d
SHA256 2dde61337df910bcd14735c5c2583d81b2d69e76da7111550d53b36f70f13e7d
MD5 32bca53612a876ba53975319099e8fb3
SHA1 af1e7ecae53586a3392400208fdc3159109e7104
SHA512 100bc85965190511dffa001927ce6a98a719cd2a9d4f391d2fae910fc16eb68a253184387fd822dcdb5ebdd84f0f52922ceb0ec7f0e7e469c522bafe6cc9eaac
SSDEEP 49152:2tYa0z3WOLVXqlT57IHm7H+vlBPHjHYnsPbQQq4TBVPaOP57NrdzS560WsOv4Is:pRXql5EGDMBPMsPEISE7Nrdz1E
TLSH
T17EC5CF12FB818072E6A3053956BA677B5D3DA9304729C5D3E3D02A6C5D303E2BA3D787
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

cb:09:86:e8:16:21:be:af:c9:4d:d9:f6:a8:90:73:15:83:43:f4:2d:40:36:97:3b:ab:04:e3:a3:27:a1:72:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Oriental Webcasting Co. Ltd.,OU=技术管理中心,O=Shanghai Oriental Webcasting Co. Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 25, 2021

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

28:cf:d4:65:57:b4:0e:ab:2f:60:ef:b3:7f:0e:6f:cb

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2020 - Jan 16, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

277434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\srf_develop\ShuRuFa\程序\Trunk\Bundles\DongFang\Bin\pdbmap\Mutual32.pdb

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW PathFileExistsW SHDeleteKeyW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage GetTimeZoneInformation WriteConsoleW SetStdHandle EnumSystemLocalesW IsValidLocale LCMapStringW GetStringTypeW FindFirstFileExW ExitProcess GetStdHandle VirtualQuery HeapQueryInformation GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetFileType GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx RtlUnwind SetEnvironmentVariableA SetPriorityClass DeviceIoControl CreateMutexW ReleaseMutex lstrcpyW GetLongPathNameW GetSystemInfo CreateProcessW GetExitCodeProcess OutputDebugStringW SetConsoleCtrlHandler GetDriveTypeW GetCurrentProcessId GetLastError GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetTempPathW MoveFileExW GetFileInformationByHandle SetFileTime FileTimeToLocalFileTime OpenProcess VirtualAlloc LocalFree LocalAlloc GetProcAddress CreateFileW GetModuleFileNameW FileTimeToSystemTime VerSetConditionMask GlobalLock GetFileAttributesExA SleepEx GetSystemDirectoryA QueryPerformanceFrequency VerifyVersionInfoA ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FormatMessageA GetSystemTime FlushConsoleInputBuffer GlobalMemoryStatus ReadConsoleInputA SetConsoleMode SystemTimeToTzSpecificLocalTime GetFileTime lstrlenW CreateEventW CloseHandle Sleep WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetExitCodeThread TerminateThread CreateThread WritePrivateProfileStringW LocalFileTimeToFileTime FileTimeToDosDateTime DosDateTimeToFileTime CreateFileA SetFileAttributesA GetFileAttributesA GetFileSize WriteFile ReadFile SetFilePointer DeleteFileW LockResource LoadResource SizeofResource FindResourceW FindClose SystemTimeToFileTime GetTickCount FindFirstFileW MoveFileW GetSystemDirectoryW CopyFileW GetVersionExW HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThread FindNextFileW CreateDirectoryW RemoveDirectoryW WideCharToMultiByte DecodePointer HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount MultiByteToWideChar GetACP OutputDebugStringA SetLastError GetModuleHandleA LoadLibraryW GlobalAlloc GlobalUnlock GetPrivateProfileStringW GetPrivateProfileIntW GlobalFree MulDiv FormatMessageW EncodePointer GetCurrentThreadId FreeLibrary FreeResource LoadLibraryExW GlobalDeleteAtom lstrcmpW LoadLibraryA GlobalAddAtomW GlobalFindAtomW FlushFileBuffers GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile UnlockFile DuplicateHandle GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetUserDefaultLCID GetCurrentDirectoryW SetErrorMode SetFileAttributesW GetFileSizeEx GetFileAttributesExW GetFileAttributesW VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW GlobalFlags LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc lstrcmpA GetThreadLocale

user32

GetSysColorBrush LoadCursorW RealChildWindowFromPoint SystemParametersInfoW DestroyMenu ClientToScreen GetWindowDC SetRectEmpty TabbedTextOutW GrayStringW DrawTextExW DrawTextW MapDialogRect SetWindowContextHelpId GetWindowThreadProcessId SetCursor PostQuitMessage TranslateMessage MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetMessageW CharUpperW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW GetMonitorInfoW MonitorFromWindow WinHelpW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW PtInRect EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient InvalidateRect SetCapture ReleaseCapture CharNextW CopyAcceleratorTableW InvalidateRgn SetRect IntersectRect IsRectEmpty GetNextDlgGroupItem MessageBeep RegisterClipboardFormatW PostThreadMessageW GetClientRect SendDlgItemMessageA SetWindowLongW GetWindowLongW UnregisterClassW LoadIconW GetDesktopWindow MessageBoxW AdjustWindowRectEx RemovePropW GetPropW GetCursorPos ReleaseDC GetDC SetForegroundWindow SetPropW GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture EnumDisplayMonitors FindWindowW wsprintfW LoadStringW GetKeyState GetSubMenu IsIconic IsWindowVisible GetSystemMetrics RegisterWindowMessageW PostMessageW GetWindowRect EnableWindow KillTimer SetTimer SetWindowPos SendMessageW IsWindow EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW IsDialogMessageW GetWindow GetWindowTextW SetWindowTextW IsWindowEnabled SetFocus GetDlgCtrlID SetDlgItemTextW GetDlgItem MoveWindow ShowWindow LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus GetMenuItemCount GetMenuItemID GetParent OffsetRect wsprintfA

gdi32

GetMapMode GetRgnBox CreateRectRgnIndirect GetTextColor GetBkColor ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetMapMode SelectObject ExtSelectClipRgn SaveDC RestoreDC RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetStockObject GetClipBox Escape DeleteObject DeleteDC GetObjectW SetTextColor SetBkColor GetDeviceCaps CreateBitmap

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW CryptEnumProvidersA CryptSignHashA CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA ReportEventA RegisterEventSourceA DeregisterEventSource RegQueryValueExW RegSetValueExW DuplicateTokenEx LookupAccountSidW GetTokenInformation ImpersonateLoggedOnUser RegEnumValueW RegOpenKeyW RegDeleteValueW RevertToSelf OpenProcessToken EqualSid GetLengthSid InitializeAcl GetAclInformation AddAce GetAce AddAccessAllowedAce GetSecurityDescriptorControl RegQueryValueW StartServiceW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegEnumKeyW LookupAccountNameW GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

comctl32

ord17

ole32

CoFreeUnusedLibraries CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromProgID CLSIDFromString CoCreateGuid OleUninitialize CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter OleInitialize

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString VariantChangeType SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect VariantCopy SafeArrayDestroy

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty

cabinet

ord20 ord21 ord22 ord23 ord14 ord10 ord13 ord11

wininet

InternetReadFile InternetOpenW InternetSetFilePointer HttpQueryInfoW InternetCloseHandle InternetOpenUrlW

oleacc

LresultFromObject CreateStdAccessibleObject

iphlpapi

GetAdaptersInfo

wldap32

ord30 ord200 ord301 ord50 ord143 ord217 ord46 ord211 ord60 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79

ws2_32

gethostbyname getservbyname WSAGetLastError socket __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSAIoctl WSAStartup WSACleanup getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname shutdown htonl

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

493KB

Virtual Size

493KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=241, version=40116,

count=220, id=243, version=40116,

count=30, id=242, version=40116,

count=631, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=199, version=41118,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=259, version=24123,

count=36, id=260, version=24123,

count=168, id=261, version=24123,

count=831, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=122, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,