General

  • Target
    2026-09-01_3725289fe3d266b2ab4c4acdaa9ccf7c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil
  • Size 19.2MB
  • Sample260901-yda8raz1gy
  • SHA256 b5bfa23550176f953a1de91b186dc9a5c566525844474e976c45be02da426474
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

File Explorer

  • 2026-09-01_3725289fe3d266b2ab4c4acdaa9ccf7c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil
    .exe 19.2MB

2026-09-01_3725289fe3d266b2ab4c4acdaa9ccf7c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil

  • IMPHASH 22c3903f5bade1317854c9395576d8a5
  • SHA256 b5bfa23550176f953a1de91b186dc9a5c566525844474e976c45be02da426474
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • CryptOne packer

    Detects CryptOne packer defined in NCC blogpost.

Digest
16:90:c4:0c:81:4f:78:85:46:96:e2:aa:10:9c:9d:3d:52:db:79:18:84:14:7a:ab:8e:97:cd:df:1f:5e:f1:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN
Minor OS version
0
Major OS version
6
Entry point
10777987
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\landun\pinyin_agent\workspace\p-8e18b00276fd470e835a1e79d9eeecd4\src\bin\Release_Win32\SGTool.pdb