2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil
Size 2.8MB
Sample260820-bvbvaacr71
SHA256 f1283eb3805f366dd8f465ee4ae00fd12d237673c083017333aa6f66e8d80c6e
MD5 c353abdcd70579d9e307979db543e062
SHA1 df765dd29abf19e00856be5cf2e62182454e74bb
SHA512 57f0de75e51105e722b7adc0e72174dc64ec2050191e21039d1443749501125f099f3f049991361d74fe0fd12eb54948c3ae5767fefb4b55266e0941664cfb8c
SSDEEP 49152:1cVWm09B8XUzs4MgGsWMYVExSi+P+Ez68ToDhdK0HkEU1X1Y4f:1cVWNqfMyEXJtlc
TLSH
T150D5BE03FBC281E1E8F2217926BB577E8D3D6924972485D39B911C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

File Explorer

2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

.exe 2.8MB

2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

IMPHASH afb64912f33cb6418e087415b120fd33
SHA256 f1283eb3805f366dd8f465ee4ae00fd12d237673c083017333aa6f66e8d80c6e
MD5 c353abdcd70579d9e307979db543e062
SHA1 df765dd29abf19e00856be5cf2e62182454e74bb
SHA512 57f0de75e51105e722b7adc0e72174dc64ec2050191e21039d1443749501125f099f3f049991361d74fe0fd12eb54948c3ae5767fefb4b55266e0941664cfb8c
SSDEEP 49152:1cVWm09B8XUzs4MgGsWMYVExSi+P+Ez68ToDhdK0HkEU1X1Y4f:1cVWNqfMyEXJtlc
TLSH
T150D5BE03FBC281E1E8F2217926BB577E8D3D6924972485D39B911C6DBC311C1A63E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3d:ea:8c:44:8b:6b:8f:1e:07:08:d4:3a:68:ba:0e:23:96:b0:dd:e0:33:85:ee:ed:43:00:c1:1d:6b:9b:58:96:64:07:00:05:06:18:c6:28:37:68:60:99:83:68:7e:14

Digest Algorithm

sha384

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Apr 15, 2024

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

09:be:bd:8f:ba:e0:11:98:c5:52:55:0b:a6:80:f1:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 6, 2023 - May 15, 2025

Minor OS version

Major OS version

Entry point

1731151

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoTalk Updater\KakaoUpdate Build real stage\build\KakaoUpdate.pdb

kernel32

OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize DosDateTimeToFileTime GetFileTime WideCharToMultiByte FileTimeToSystemTime GetModuleFileNameW FreeLibrary GetTimeZoneInformation GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc TlsFree SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers MoveFileExW GetTickCount CreateSemaphoreW ResumeThread LocalFree GetCommandLineW GetLocalTime GetTempPathW OpenSemaphoreW WaitForSingleObject WaitForSingleObjectEx ReleaseMutex ReleaseSemaphore CloseHandle WriteConsoleW HeapSize SetEnvironmentVariableW CopyFileW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId CreateDirectoryW GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageW CreateProcessW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW DeleteFileW FreeEnvironmentStringsW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetStdHandle GetFileType GetEnvironmentVariableW VirtualFree GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SetFilePointer GetFileSizeEx GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW GetUserObjectInformationW GetProcessWindowStation CreateDialogParamW ShowWindow UpdateWindow GetDlgItem GetWindowLongW TranslateAcceleratorW SetWindowTextW DialogBoxParamW DestroyWindow DefWindowProcW PostQuitMessage MessageBoxW EndDialog PostMessageW FindWindowW GetWindowThreadProcessId BeginPaint SendMessageW LoadStringW TranslateMessage GetMessageW LoadAcceleratorsW EndPaint SetWindowLongW ExitWindowsEx

advapi32

CryptEnumProvidersW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExW SetNamedSecurityInfoW RegOpenKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

ws2_32

inet_addr ioctlsocket getsockopt ntohs select gethostbyname WSAStartup WSACleanup WSAGetLastError htonl htons inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError recv send connect setsockopt socket shutdown closesocket

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetCertificateContextProperty

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c353abdcd70579d9e307979db543e062_amadey_coinminer_elex_floxif_glassworm_hijackloader_lightspy_luca-stealer_lynx_njrat_revil

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

crypt32

generic