2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut
Size 2.5MB
Sample260925-gqechazt2l
SHA256 59cfc68164923101aaf25d4b9011f471dd1e0ebd435683492ec38caeca79a980
MD5 8356edb02f23a55461b012ba1ef08fb3
SHA1 0d15f22ff832f5111b1efc0201cd2d0fe07ef86d
SHA512 aaac3f8739f7d66b64fbc362621ef75b3a7e35c4f11794fbffd69bd06b7eed483f271bcecd2e6fdc14ca7260748fd7cc0ba63f77e035b8fc923dba8cf4050624
SSDEEP 49152:dWUw30ro0Smc4AXOKFBHMeIy2wBclbczWofUJFw9Y32/ztP3ZxlRT1Zv2KsnHGq:dWUEK78FfB6bczBwFCVrxl7FJ
TLSH
T1F5C5BF12FB8180B1E49302745577A73F893EBA35572885C7ABC02D6D9C306D2A63E76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut

File Explorer

2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut

.exe 2.5MB

2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut

IMPHASH ceb73912bbf3714fd0ba8b9025920bb7
SHA256 59cfc68164923101aaf25d4b9011f471dd1e0ebd435683492ec38caeca79a980
MD5 8356edb02f23a55461b012ba1ef08fb3
SHA1 0d15f22ff832f5111b1efc0201cd2d0fe07ef86d
SHA512 aaac3f8739f7d66b64fbc362621ef75b3a7e35c4f11794fbffd69bd06b7eed483f271bcecd2e6fdc14ca7260748fd7cc0ba63f77e035b8fc923dba8cf4050624
SSDEEP 49152:dWUw30ro0Smc4AXOKFBHMeIy2wBclbczWofUJFw9Y32/ztP3ZxlRT1Zv2KsnHGq:dWUEK78FfB6bczBwFCVrxl7FJ
TLSH
T1F5C5BF12FB8180B1E49302745577A73F893EBA35572885C7ABC02D6D9C306D2A63E76F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0f:87:dc:30:e3:8d:e9:bc:b2:68:9b:3f:24:6f:ac:9f:a5:59:6e:31:4d:36:54:03:6d:63:7e:ac:4a:8e:4a:fd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Jun 25, 2025

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2660681

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Tools\agent\workspace\WeChatUpdate\WechatUpdate\Release\WeChatUpdate.pdb

kernel32

TlsAlloc TlsGetValue TlsSetValue TlsFree GetThreadId CreateSemaphoreA CreateEventA GetModuleHandleA WaitForSingleObjectEx ReleaseSemaphore SetEvent LocalFree FormatMessageA CreateFileA SetEndOfFile SetLastError MapViewOfFileEx UnmapViewOfFile CreateFileMappingA GetEnvironmentVariableW GetDiskFreeSpaceExW GetFileAttributesExW GetFileTime GetFullPathNameW SetFilePointerEx MoveFileExW SetWaitableTimer CreateWaitableTimerW CopyFileW WaitForMultipleObjectsEx ResetEvent Thread32First Thread32Next AreFileApisANSI GetFileSizeEx SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibrary GetWindowsDirectoryW GetSystemInfo DeleteFileW GetTimeZoneInformation SetFileAttributesW GetSystemDirectoryW GetVersionExW SwitchToThread WriteConsoleW DeviceIoControl GetSystemTimeAsFileTime CreateThread WaitForSingleObject GetTempPathW DosDateTimeToFileTime GetFileType SystemTimeToFileTime GetCurrentDirectoryW CloseHandle DuplicateHandle CreateFileW SetFilePointer WriteFile GetCurrentProcess GetFileAttributesW WritePrivateProfileStringW GetFileInformationByHandle GetProcAddress LoadLibraryW GetFileSize GetLogicalDriveStringsW lstrlenW QueryDosDeviceW TerminateThread SetUnhandledExceptionFilter GetCurrentProcessId SetCurrentDirectoryW GetModuleFileNameW GetSystemDefaultUILanguage GlobalUnlock GetModuleHandleW GlobalLock GlobalFree GlobalAlloc FreeResource GetTickCount ReadConsoleA SetConsoleMode LoadLibraryA ConvertFiberToThread DeleteFiber Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess ReleaseMutex FindClose CreateMutexW RemoveDirectoryW TerminateProcess FindNextFileW FindFirstFileW GetPrivateProfileStringW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection OpenEventA ReadFile CreateDirectoryW FindResourceW LoadResource FindResourceExW LockResource SizeofResource WideCharToMultiByte GetLocalTime Sleep MultiByteToWideChar GetCurrentThreadId GetShortPathNameW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind MulDiv GetACP ExitProcess InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW InitializeCriticalSectionAndSpinCount OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx FileTimeToSystemTime LCMapStringEx EncodePointer HeapSize InitializeCriticalSectionEx HeapFree QueryPerformanceFrequency QueryPerformanceCounter GetExitCodeThread TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock

user32

DrawTextW GetDC GetProcessWindowStation CreateAcceleratorTableW InvalidateRgn GetWindowTextW GetWindowTextLengthW SetWindowTextW GetCaretPos GetSysColor SetCaretPos HideCaret ReleaseDC SetWindowPos EnableWindow ShowCaret CreateCaret CharPrevW SetRect CharNextW PostQuitMessage FillRect GetWindowRect MoveWindow GetWindowThreadProcessId PostMessageW TranslateMessage SetFocus PostThreadMessageA DispatchMessageW ShowWindow GetSystemMetrics GetWindow GetMessageW GetCursorPos IsIconic PtInRect KillTimer UpdateLayeredWindow IsZoomed GetClientRect SetWindowLongW SetCursor LoadCursorW ClientToScreen SetTimer CreateWindowExW SetWindowRgn EqualRect GetWindowLongW DestroyWindow SetPropW TranslateAcceleratorW LoadStringW SendMessageW IsWindow SwitchToThisWindow BringWindowToTop FindWindowW UnregisterClassW IntersectRect wsprintfW DefWindowProcW MessageBoxW GetPropW RegisterClassExW LoadAcceleratorsW GetKeyState GetUpdateRect BeginPaint EndPaint IsRectEmpty InvalidateRect MapWindowPoints ScreenToClient GetFocus SetCapture ReleaseCapture GetParent GetMonitorInfoW MonitorFromWindow SetLayeredWindowAttributes LoadImageW RegisterClassW GetClassInfoExW CallWindowProcW OffsetRect InflateRect wvsprintfW GetUserObjectInformationW

gdi32

CreateCompatibleDC GetStockObject DeleteDC CreatePen Rectangle GetObjectW DeleteObject CreateSolidBrush RoundRect CreateFontIndirectW SaveDC RestoreDC SetWindowOrgEx GetTextMetricsW CreateRoundRectRgn SelectObject GetClipBox ExtSelectClipRgn StretchBlt SetStretchBltMode SetBkColor ExtTextOutW CreatePenIndirect MoveToEx LineTo GetObjectA SetTextColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GetDeviceCaps BitBlt CombineRgn CreateRectRgnIndirect SetDIBColorTable CreateDIBSection CreateCompatibleBitmap SelectClipRgn SetBkMode

advapi32

CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptGenRandom CryptReleaseContext CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteKeyExW RegQueryInfoKeyW GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegCreateKeyW RegDeleteValueW DuplicateTokenEx RegEnumValueW RegQueryValueExW GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptEnumProvidersW

shell32

ShellExecuteExW SHGetSpecialFolderLocation ShellExecuteW SHGetKnownFolderPath SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW

ole32

CLSIDFromString OleLockRunning CoCreateInstance CoInitializeEx CreateStreamOnHGlobal CLSIDFromProgID CoTaskMemFree

gdiplus

GdipGetImageHeight GdipCreateBitmapFromStream GdiplusStartup GdipAlloc GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipDisposeImage GdipGetImagePixelFormat GdiplusShutdown GdipDrawImageI GdipFree GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipCreateFromHDC GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawString GdipSetTextRenderingHint GdipCreateLineBrushI GdipGetImageWidth GdipCreateBitmapFromScan0

shlwapi

PathRemoveFileSpecW StrCmpW PathFileExistsW

dbghelp

MiniDumpWriteDump

msimg32

AlphaBlend

userenv

GetAllUsersProfileDirectoryW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comctl32

_TrackMouseEvent ord17

ws2_32

closesocket WSASetLastError send recv WSAGetLastError WSACleanup

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

imm32

ImmGetContext ImmReleaseContext ImmNotifyIME ImmSetCompositionWindow

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_8356edb02f23a55461b012ba1ef08fb3_amadey_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_revil_smoke-loader_virut

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

shlwapi

dbghelp

msimg32

userenv

version

comctl32

ws2_32

oleaut32

imm32

crypt32

bcrypt

generic