2026-08-17_938cbf95f9a378920e71530a64ec17e5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_938cbf95f9a378920e71530a64ec17e5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil
Size 32.8MB
Sample260817-cftl8a1fjc
SHA256 6d69ef80886696ddaea8e817e0e17f9c9eefb31275d2e9ae6aa85c137737f4dc
MD5 938cbf95f9a378920e71530a64ec17e5
SHA1 015b4e099bb81ed58a3c976cc3526ee98980aab5
SHA512 750d815cf9ed3dd31fe13acd6af8a56dba35a87674a493d8c8d36c7a6e9f1e8cca7cebb67d14073a735dd68cb03cf8d515585edc1c890710a4d1e25df24d0766
SSDEEP 786432:QaDSpJwWpJ2VllaiLX7lY0gvGKh4y1/TaSbft/eKkHRv:ewKkPlJLX7lY0/y1/eSr9sRv
TLSH
T1A1772321BB42C072D5EE01B115ABA77A08796F34572488E7E3E12A6E4D715D37F3B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

2026-08-17_938cbf95f9a378920e71530a64ec17e5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

.exe 32.8MB

2026-08-17_938cbf95f9a378920e71530a64ec17e5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

IMPHASH e3518c60c8fffe44948af537846f0529
SHA256 6d69ef80886696ddaea8e817e0e17f9c9eefb31275d2e9ae6aa85c137737f4dc
MD5 938cbf95f9a378920e71530a64ec17e5
SHA1 015b4e099bb81ed58a3c976cc3526ee98980aab5
SHA512 750d815cf9ed3dd31fe13acd6af8a56dba35a87674a493d8c8d36c7a6e9f1e8cca7cebb67d14073a735dd68cb03cf8d515585edc1c890710a4d1e25df24d0766
SSDEEP 786432:QaDSpJwWpJ2VllaiLX7lY0gvGKh4y1/TaSbft/eKkHRv:ewKkPlJLX7lY0/y1/eSr9sRv
TLSH
T1A1772321BB42C072D5EE01B115ABA77A08796F34572488E7E3E12A6E4D715D37F3B30A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Digest

ac:1a:3f:a9:79:c7:1d:64:f8:69:0c:f2:f9:c5:1a:4d:c3:6c:21:5c:42:0c:8f:7c:bb:fb:95:48:da:34:ef:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120102MAD221RD4U,CN=天津立方星球文化传媒有限公司,O=天津立方星球文化传媒有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b2b3e4b89ce58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 13, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:12:0e:a6:aa:44:0f:37:e9:fd:16:13:3c:f4:58:51

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2026 - May 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

225030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetStdHandle GetFileInformationByHandle ReadFile WriteFile GetSystemTimeAsFileTime GetCurrentProcess GetSystemInfo GetModuleHandleA GlobalMemoryStatus GetProcessAffinityMask CreateFileW SetEndOfFile SetFileTime SetLastError FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetCurrentDirectoryW CreateDirectoryW DeleteFileW RemoveDirectoryW SetFileAttributesW GetTempPathW GetCurrentProcessId GetCurrentThreadId GetTickCount GetModuleFileNameW LoadLibraryExW MultiByteToWideChar WideCharToMultiByte VirtualAlloc GetVersion IsProcessorFeaturePresent LeaveCriticalSection EnterCriticalSection SetThreadAffinityMask ResumeThread CreateSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection CloseHandle LoadLibraryW GetProcAddress FreeLibrary Sleep DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize IsDebuggerPresent OutputDebugStringW GetFullPathNameW TerminateProcess GetStartupInfoW FindResourceExW LoadResource LockResource SizeofResource FindResourceW lstrlenW MoveFileExW FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType SetFilePointerEx GetConsoleOutputCP GetConsoleMode LCMapStringW GetFileSizeEx ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW WriteConsoleW VirtualFree HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode GetLastError RaiseException DecodePointer GetCommandLineW

user32

CharUpperW DefWindowProcW

ole32

CoUninitialize StringFromCLSID CoInitialize CoCreateGuid CoTaskMemFree

oleaut32

SysFreeString SysStringLen VariantCopy VariantClear SysAllocStringLen

shlwapi

PathIsDirectoryW PathCombineW PathFileExistsW PathAppendW

shell32

SHCreateDirectoryExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_938cbf95f9a378920e71530a64ec17e5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_remcos_revil

kernel32

user32

ole32

oleaut32

shlwapi

shell32

generic