2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader
Size 1.4MB
Sample260824-nk3apsfp5x
SHA256 d069aa1bc14b25a36e373e42c4919f436f8a0cad6da079ed9ce7ed3af9d45403
MD5 571166d0019101b7810539874c80b96c
SHA1 1ef517d9623e923be35d9dfda40214d324b75aca
SHA512 70ec73fe3091b0c476de21a58e9f8bddf4c726436c6efdcac76f03789e5b46d5bd8b8a013d18182420a57a33feabc861a1cb9c907ed127aecea2144cca337d93
SSDEEP 24576:3nPuN2AQFI1KGj3e8Z5m+uWonpdV153lWfgUDB/I9Auo/cvCmFlB:3PuRkSxTjv1cV15Kgk/IgAl
TLSH
T15B65E110B9D18032D6B3293547B6D9724D7CBC301E309A8F23C85A796F759D0AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader

File Explorer

2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader

.exe 1.4MB

2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader

IMPHASH 8833ffd22e44ff490fd3a40e000dd0bc
SHA256 d069aa1bc14b25a36e373e42c4919f436f8a0cad6da079ed9ce7ed3af9d45403
MD5 571166d0019101b7810539874c80b96c
SHA1 1ef517d9623e923be35d9dfda40214d324b75aca
SHA512 70ec73fe3091b0c476de21a58e9f8bddf4c726436c6efdcac76f03789e5b46d5bd8b8a013d18182420a57a33feabc861a1cb9c907ed127aecea2144cca337d93
SSDEEP 24576:3nPuN2AQFI1KGj3e8Z5m+uWonpdV153lWfgUDB/I9Auo/cvCmFlB:3PuRkSxTjv1cV15Kgk/IgAl
TLSH
T15B65E110B9D18032D6B3293547B6D9724D7CBC301E309A8F23C85A796F759D0AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e5:f9:78:47:a5:52:1b:28:6f:e1:7e:f6:b9:67:c7:f8:df:0f:e0:e4:e3:1d:1c:18:32:38:90:b8:d1:e0:21:55

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jan 9, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c3:28:67:7c:49:fe:42:e8:3d:52:83:27:c2:5e:46:43:ec:75:2d:7d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jan 9, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 14, 2015 - Dec 14, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2015 - Dec 16, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:16:c0:09:98:dc:c6:8f:a2:7d:25:c3:86:36:a8:83:bb

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

19712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetCommandLineA GetLastError SetLastError GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryExW RtlUnwind OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW ReadFile SetFilePointer CreateFileMappingW GetTempFileNameW FindResourceExW FindResourceW LoadResource VerSetConditionMask CreateDirectoryW CopyFileW SizeofResource FormatMessageW HeapDestroy GetTempPathW RaiseException VerifyVersionInfoW LockResource RemoveDirectoryW lstrcmpiW DeleteFileW LocalFree CreateProcessW WaitForSingleObject GetExitCodeProcess MapViewOfFile UnmapViewOfFile VirtualQuery

shlwapi

PathAppendW PathQuoteSpacesW

ole32

CoUninitialize CoInitializeEx

shell32

ord680 SHGetFolderPathW

user32

wvsprintfW MessageBoxW CharLowerBuffW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_571166d0019101b7810539874c80b96c_amadey_bkransomware_coinminer_elex_karagany_luca-stealer_lynx_maze_njrat_rhadamanthys_smoke-loader

PE Signature issue

PE Signature issue

kernel32

shlwapi

ole32

shell32

user32

generic