2026-08-21_2d7ae12c3642fb2613cd06fc8256b3c6_amadey_bkransomware_coinminer_darkgate_elex_floxif_glassworm_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_2d7ae12c3642fb2613cd06fc8256b3c6_amadey_bkransomware_coinminer_darkgate_elex_floxif_glassworm_maze_smoke-loader
Size 2.2MB
Sample260822-vreasaff84
SHA256 570de5ed2c9724ae0e0d6ebda947d425b7ae47d44ed0b7595114e391259c31bb
MD5 2d7ae12c3642fb2613cd06fc8256b3c6
SHA1 b6302bc211d0c5ee2211910bf745efae37cd36d9
SHA512 7dc8068ba0ba12fc14b78eb1ac9473fd043ebd8737a3bcbd3fe2000514555656061534ceed346c243b423c05bdfb394f6dff2e843d2881588d5bf9f028781740
SSDEEP 49152:vDItNUIhitqrLOef+aJn9x+Uw7X8ZzZ17KmgCskgR8:E7UIItqr5mI0+
TLSH
T155B5AE51B283B5B2E593117461B992274939BF644B37C0CF67C02F89CD78AC29ABE353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-21_2d7ae12c3642fb2613cd06fc8256b3c6_amadey_bkransomware_coinminer_darkgate_elex_floxif_glassworm_maze_smoke-loader

File Explorer

2026-08-21_2d7ae12c3642fb2613cd06fc8256b3c6_amadey_bkransomware_coinminer_darkgate_elex_floxif_glassworm_maze_smoke-loader

.exe 2.2MB

2026-08-21_2d7ae12c3642fb2613cd06fc8256b3c6_amadey_bkransomware_coinminer_darkgate_elex_floxif_glassworm_maze_smoke-loader

IMPHASH 4f383ca6825fbbb664925b2ff23a06f7
SHA256 570de5ed2c9724ae0e0d6ebda947d425b7ae47d44ed0b7595114e391259c31bb
MD5 2d7ae12c3642fb2613cd06fc8256b3c6
SHA1 b6302bc211d0c5ee2211910bf745efae37cd36d9
SHA512 7dc8068ba0ba12fc14b78eb1ac9473fd043ebd8737a3bcbd3fe2000514555656061534ceed346c243b423c05bdfb394f6dff2e843d2881588d5bf9f028781740
SSDEEP 49152:vDItNUIhitqrLOef+aJn9x+Uw7X8ZzZ17KmgCskgR8:E7UIItqr5mI0+
TLSH
T155B5AE51B283B5B2E593117461B992274939BF644B37C0CF67C02F89CD78AC29ABE353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e3:33:69:27:6a:45:2d:12:57:27:f3:14:42:5b:c4:f1:41:2b:0a:f3:e9:b9:6a:f9:25:97:f9:a3:52:92:a3:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=GRETECH CORPORATION,OU=GRETECH CORPORATION,O=GRETECH CORPORATION,L=Shinjuku,ST=Tokyo,C=JP

Chains

Nov 17, 2020

CN=GRETECH CORPORATION,OU=GRETECH CORPORATION,O=GRETECH CORPORATION,L=Shinjuku,ST=Tokyo,C=JP

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GRETECH CORPORATION,OU=GRETECH CORPORATION,O=GRETECH CORPORATION,L=Shinjuku,ST=Tokyo,C=JP

Serial Number

4f:58:fc:05:42:6c:c4:b6:5d:bc:0c:2c:2e:3a:f3:04

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 11, 2019 - Aug 15, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

556667

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\GOMProtect\bin\GOMProtectW.pdb

kernel32

ExitThread GetSystemTimeAsFileTime RtlUnwind ExitProcess GetModuleHandleExW AreFileApisANSI SetStdHandle GetFileType HeapQueryInformation GetStdHandle GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetTickCount IsValidCodePage GetOEMCP GetCPInfo GetConsoleCP GetConsoleMode GetStringTypeW GetTimeZoneInformation SetConsoleCtrlHandler ReadConsoleW SetFilePointerEx OutputDebugStringW CreateThread IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW SetEnvironmentVariableA IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage SetConsoleMode ReadConsoleInputA FlushConsoleInputBuffer GetLocaleInfoW CompareStringW SetErrorMode VirtualQuery GetVersion GetLocalTime GlobalMemoryStatus GetDiskFreeSpaceA GetEnvironmentStrings FreeEnvironmentStringsA DeviceIoControl GetVersionExA InterlockedExchange InterlockedDecrement InterlockedIncrement lstrlenA FormatMessageA CreateMutexW CreateMutexA ReleaseMutex FindResourceExW GetFileSizeEx GetFileAttributesExW LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WaitForSingleObject WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GlobalFindAtomW GlobalAddAtomW FreeResource GetSystemDirectoryW EncodePointer lstrcmpW lstrcmpA GlobalDeleteAtom GetVersionExW GetCurrentThreadId GetCurrentThread LoadLibraryA GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindFirstFileW FindClose FileTimeToSystemTime LocalAlloc LoadLibraryExW FileTimeToLocalFileTime FormatMessageW MulDiv LocalFree GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetModuleHandleW GetModuleHandleA GetModuleFileNameW SetLastError OutputDebugStringA GetACP DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize RaiseException LeaveCriticalSection HeapDestroy InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc TerminateProcess OpenProcess CreateDirectoryW FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetFileTime ReadFile GetFileSize CreateFileW GetFileAttributesW CloseHandle Sleep FindResourceW LoadResource LockResource SizeofResource GetLastError DeleteFileW lstrlenW LCMapStringW

user32

SetWindowLongW GetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect GetWindowTextW RemovePropW GetPropW SetPropW RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow GetClassLongW IsWindow PostMessageW FindWindowExW GetWindowThreadProcessId UpdateWindow SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible WinHelpW MonitorFromWindow GetMonitorInfoW CreateDialogIndirectParamW EndDialog GetNextDlgTabItem GetClassNameW GetTopWindow GetLastActivePopup GetWindow SetWindowsHookExW CallNextHookEx SetActiveWindow GetClassInfoW LoadIconW MessageBoxA GetProcessWindowStation GetUserObjectInformationW SendMessageW IsIconic GetSystemMetrics GetClientRect DrawIcon EnableWindow UnregisterClassW SendDlgItemMessageA GetParent GetSubMenu GetMenuItemID GetMenuItemCount EnumDisplayMonitors GetActiveWindow IsWindowEnabled CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetMessageW TranslateMessage GetCursorPos SetCursor DrawTextW DrawTextExW GrayStringW TabbedTextOutW GetDC ReleaseDC BeginPaint EndPaint ClientToScreen ShowWindow SetWindowTextW IsDialogMessageW GetSysColorBrush LoadCursorW RealChildWindowFromPoint GetDesktopWindow CharUpperW PostQuitMessage UnhookWindowsHookEx RegisterWindowMessageW DispatchMessageW SetWindowPos DestroyWindow SetTimer PeekMessageW GetMessagePos GetMessageTime DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoExW CreateWindowExW DestroyMenu InvalidateRect KillTimer

gdi32

RectVisible RestoreDC SaveDC SelectObject SetMapMode TextOutW ExtTextOutW PtVisible SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx GetStockObject GetClipBox Escape DeleteObject CreateBitmap GetObjectW SetTextColor SetBkColor GetDeviceCaps DeleteDC

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegisterEventSourceA DeregisterEventSource RegSetValueExA RegQueryValueExA RegCreateKeyExA CryptEncrypt CryptImportKey CryptExportKey CryptGenRandom CryptGetKeyParam CryptGenKey CryptAcquireContextA RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey ReportEventA

shell32

ShellExecuteW SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathStripToRootW PathIsUNCW UrlUnescapeW PathFileExistsW PathFindFileNameW

ole32

CoCreateGuid CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitialize

oleaut32

SysAllocString VariantChangeType VariantClear VariantInit SysFreeString

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain

crypt32

CertGetNameStringW CryptStringToBinaryA

psapi

GetModuleFileNameExW EnumProcesses

netapi32

NetApiBufferFree NetWkstaGetInfo

wininet

InternetSetStatusCallbackW HttpOpenRequestW HttpSendRequestW InternetGetLastResponseInfoW HttpQueryInfoW InternetQueryDataAvailable InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCanonicalizeUrlW InternetCrackUrlW InternetGetConnectedState

oleacc

CreateStdAccessibleObject LresultFromObject

generic

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=18, id=110, productName=VS2005 build 50727, version=50727,

count=13, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=318, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=589, id=1, productName=Unmarked objects,

count=88, id=225, productName=VS2013 build 21005, version=21005,

count=44, id=223, productName=VS2013 build 21005, version=21005,

count=251, id=224, productName=VS2013 build 21005, version=21005,

count=74, id=225, version=20806,

count=12, id=229, version=30723,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,