2026-09-19_4d84eee231d5dcb5d952521600444f6d_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_4d84eee231d5dcb5d952521600444f6d_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil
Size 2.0MB
Sample260919-pppe3sfd57
SHA256 7e8bd4dde150be4d3aefaeac3d64229a84c729ebda70eb860af1a4e4a1ab7b20
MD5 4d84eee231d5dcb5d952521600444f6d
SHA1 2f61349ae02df13ab43c2f9143d58b4a14a36304
SHA512 b52007c26edbb074e1a93e5808160ac8d00e820737a7f72218dd8cf05b4c4838dc1c09778f44f179169e9f734fcdd2feb4237e4b169d48c75ccf4aee53a036ae
SSDEEP 49152:ClRdlRG34vGt3rM4Q8ZLMtP6sQ9WE8Hqq:ClRdlRGgGt3rM4issQU
TLSH
T190A5D012FBC280B3E9930574517AAB3F8D3AAD205724D5D7C7D03DAA9C312D16A3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-19_4d84eee231d5dcb5d952521600444f6d_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

.exe 2.0MB

2026-09-19_4d84eee231d5dcb5d952521600444f6d_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

IMPHASH 3fd67b33f9631294c22c5978e7ef1042
SHA256 7e8bd4dde150be4d3aefaeac3d64229a84c729ebda70eb860af1a4e4a1ab7b20
MD5 4d84eee231d5dcb5d952521600444f6d
SHA1 2f61349ae02df13ab43c2f9143d58b4a14a36304
SHA512 b52007c26edbb074e1a93e5808160ac8d00e820737a7f72218dd8cf05b4c4838dc1c09778f44f179169e9f734fcdd2feb4237e4b169d48c75ccf4aee53a036ae
SSDEEP 49152:ClRdlRG34vGt3rM4Q8ZLMtP6sQ9WE8Hqq:ClRdlRGgGt3rM4issQU
TLSH
T190A5D012FBC280B3E9930574517AAB3F8D3AAD205724D5D7C7D03DAA9C312D16A3E396
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

5e:fe:b7:35:6d:ed:96:2f:bc:b8:b4:ee:84:ca:69:88:b8:8b:dc:17:f0:c3:3f:10:24:c7:64:7e:72:16:8e:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Sep 18, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

474346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGDownload.pdb

shlwapi

PathFileExistsW

wininet

InternetWriteFile InternetQueryOptionW HttpOpenRequestW InternetSetOptionW HttpSendRequestExW HttpEndRequestW InternetCloseHandle InternetConnectW HttpQueryInfoW InternetReadFile InternetOpenUrlW HttpAddRequestHeadersW InternetOpenW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

SetLastError OpenEventW GetOverlappedResult CreateFileMappingW CreateNamedPipeW DisconnectNamedPipe GetVersionExW ConnectNamedPipe CopyFileW UnmapViewOfFile MapViewOfFile OpenFileMappingW GetFileAttributesW ResumeThread GetProcessHeap HeapFree CreateDirectoryW FileTimeToSystemTime ReadFile FlushFileBuffers MultiByteToWideChar GetCommandLineW GetSystemDirectoryW FreeLibrary OpenMutexW ExitThread CreateThread LocalFree FindFirstFileW FindNextFileW FindClose GetFullPathNameW InitializeCriticalSectionEx LocalAlloc DecodePointer CreateMutexW ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter InitializeCriticalSectionAndSpinCount InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EncodePointer LCMapStringEx GetLastError GetSystemTimeAsFileTime HeapAlloc GetStringTypeW GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx GetStartupInfoW InitializeSListHead RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime ExitProcess GetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetCurrentDirectoryW SetStdHandle WriteFileEx GetFileSizeEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA ReadFileEx InitializeCriticalSection lstrlenW lstrcatW lstrcpyW FormatMessageW LoadLibraryW LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW SetFileAttributesW SetEndOfFile GetFileSize DeleteFileW CreateEventW WaitForMultipleObjectsEx SetEvent LeaveCriticalSection VirtualQuery GetLocalTime CreateProcessW GetCurrentThreadId GetCurrentProcessId GetCurrentProcess SetUnhandledExceptionFilter OutputDebugStringW IsDebuggerPresent WriteFile SetFilePointer CreateFileW WideCharToMultiByte GetTickCount WaitForMultipleObjects Sleep WaitForSingleObject DeleteCriticalSection SetErrorMode CloseHandle DebugBreak EnterCriticalSection SetConsoleCtrlHandler

user32

wsprintfW GetProcessWindowStation GetUserObjectInformationW wvsprintfW TranslateMessage DispatchMessageW PeekMessageW MsgWaitForMultipleObjectsEx MessageBoxW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

advapi32

RegCreateKeyExW CryptEnumProvidersW CryptSignHashW GetSecurityDescriptorSacl SetSecurityDescriptorDacl BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityDescriptorSacl InitializeSecurityDescriptor InitializeAcl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid RegCloseKey RegOpenKeyExW RegQueryValueExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey RegSetValueExW CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash

shell32

SHGetFolderPathW

bcrypt

BCryptGenRandom

winmm

timeGetTime

ws2_32

closesocket WSACleanup WSAGetLastError recv send WSASetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_4d84eee231d5dcb5d952521600444f6d_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil

shlwapi

wininet

version

kernel32

user32

crypt32

advapi32

shell32

bcrypt

winmm

ws2_32

generic