2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader
Size 4.7MB
Sample260928-e1ae7avs2m
SHA256 e5987f97015a59f5dd6235fe828fbb94ebad820e141a3c0ee2ef809a1cebcad3
MD5 773aa0c6bb5b0f350b31a97e64af383c
SHA1 99a482c799ab93d0183980f433310c0c6b1f34e0
SHA512 e651c33811885c8e5061ba02a716cf6c2876d73f56a6feb398a9d17127d5d0dd527c994487abcf258582ff35e54eae403d5bbbe1c9bdc9978e2d72020d170c10
SSDEEP 98304:3Kc90Rh5xGdeS/+9ySFoSnKz4DDDROZ63p/jfnAtbBE/tFK90MDOGFdxr:3b0T5x7yHrz47MO/jfnANBE/tFK90MDX
TLSH
T1AC36BF11FBC180A2DE924234159AF77D993D5EA4472981C397B16A79EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 4.7MB

2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH d2cd7e4a58921a7b87e6d1a2b4dee47a
SHA256 e5987f97015a59f5dd6235fe828fbb94ebad820e141a3c0ee2ef809a1cebcad3
MD5 773aa0c6bb5b0f350b31a97e64af383c
SHA1 99a482c799ab93d0183980f433310c0c6b1f34e0
SHA512 e651c33811885c8e5061ba02a716cf6c2876d73f56a6feb398a9d17127d5d0dd527c994487abcf258582ff35e54eae403d5bbbe1c9bdc9978e2d72020d170c10
SSDEEP 98304:3Kc90Rh5xGdeS/+9ySFoSnKz4DDDROZ63p/jfnAtbBE/tFK90MDOGFdxr:3b0T5x7yHrz47MO/jfnANBE/tFK90MDX
TLSH
T1AC36BF11FBC180A2DE924234159AF77D993D5EA4472981C397B16A79EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2f:57:94:ba:37:74:fe:d3:64:8c:8e:f0:2a:53:2f:2c:4f:38:00:a8:d6:58:e9:4a:aa:45:23:c2:12:ac:46:37

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-4022119,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jan 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

75:fe:65:13:81:00:14:96:5b:36:77:20:38:a5:4c:16:1f:df:46:9a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jan 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0a:3f:f9:a9:60:71:89:eb:14:c9:7f:85:25:ca:76:fd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2025 - Jan 26, 2028

Minor OS version

Major OS version

Entry point

1991582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\CrossEXService\client\projects\windows\Release\CrossEXService.pdb

crypt32

CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

kernel32

IsValidCodePage FindFirstFileExW CreateDirectoryW MoveFileExW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW SetStdHandle QueryPerformanceFrequency VirtualQuery HeapQueryInformation SetConsoleCtrlHandler GetEnvironmentStringsW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA PeekNamedPipe GetFileInformationByHandle GetDriveTypeW RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW ExitProcess SizeofResource HeapFree GetCurrentProcess GetUserDefaultLangID InitializeCriticalSectionEx HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc LoadResource FindResourceW HeapAlloc DecodePointer GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte LoadLibraryExW FindFirstFileW SetLastError FindNextFileW FindClose GetFileAttributesW Sleep GetTickCount ReadFile SetNamedPipeHandleState WriteFile CreateMutexW CreateFileW ReleaseMutex CloseHandle WaitNamedPipeW LoadLibraryExA LocalAlloc LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent FormatMessageA TerminateThread RegisterWaitForSingleObject UnregisterWait CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult UnregisterWaitEx ConnectNamedPipe TerminateProcess CreateProcessA GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemDirectoryA LoadLibraryA WriteConsoleW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetEnvironmentVariableW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree MulDiv FormatMessageW CopyFileW OutputDebugStringA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetModuleHandleA lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GlobalReAlloc GlobalHandle LocalReAlloc CompareStringW GlobalFlags lstrcmpW SetThreadPriority ResumeThread GlobalAddAtomW DeleteFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW EncodePointer GetSystemDirectoryW GlobalDeleteAtom GlobalFindAtomW GetVersionExW FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime GetLocaleInfoW GetUserDefaultUILanguage GetCurrentDirectoryW lstrcpyW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetTempPathW GetTickCount64 GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID

user32

CreatePopupMenu NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA CopyImage SystemParametersInfoW GetMenuItemInfoW DestroyMenu IntersectRect InflateRect LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow GetForegroundWindow SetActiveWindow GetMenuDefaultItem TrackPopupMenu SetMenu GetMenu GetCapture IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu UnionRect UpdateLayeredWindow MonitorFromPoint LoadIconW LoadAcceleratorsW DispatchMessageW ShowWindow LoadStringW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW FillRect ScreenToClient EndPaint BeginPaint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW CharUpperW DestroyIcon CallNextHookEx SetWindowsHookExW GetCursorPos ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW RealChildWindowFromPoint GetClassNameW GetDesktopWindow PtInRect ClientToScreen GetWindowRect IsDialogMessageW SetWindowLongW SetWindowTextW GetFocus GetDlgCtrlID CheckDlgButton MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW SetClassLongW SetWindowRgn SetParent DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW PostQuitMessage AppendMenuW RemoveMenu GetWindowTextW GetWindowTextLengthW UnhookWindowsHookEx SendMessageW EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetFocus SetScrollPos GetScrollPos GetWindow IsWindow MoveWindow SetWindowPos GetDlgItem TranslateAcceleratorW InsertMenuItemW UnpackDDElParam DrawIcon ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel UpdateWindow LoadCursorW DestroyCursor GetWindowRgn CreateMenu TranslateMessage SubtractRect

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW GetTextExtentPoint32W DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CreateFontIndirectW CombineRgn ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx GetObjectW SetTextAlign SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt DeleteObject DeleteDC GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

CryptGetUserKey RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation SetKernelObjectSecurity SetSecurityInfo RegSetValueExW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegQueryValueExW CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken InitializeSecurityDescriptor

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder DragQueryFileW DragFinish SHAppBarMessage SHBrowseForFolderW

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW StrFormatKBSizeW PathStripToRootW

uxtheme

GetThemeSysColor DrawThemeText GetThemePartSize IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoDisconnectObject CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate LoadTypeLi VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

WSACleanup getsockopt __WSAFDIsSet accept bind closesocket select listen WSAStartup getpeername inet_addr getsockname send socket connect recvfrom recv sendto ioctlsocket htonl htons inet_ntoa gethostbyaddr getservbyport WSASetLastError shutdown gethostbyname ntohs WSAGetLastError setsockopt getservbyname

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipDrawImageRectI GdipSetInterpolationMode GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_773aa0c6bb5b0f350b31a97e64af383c_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

PE Signature issue

PE Signature issue

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

version

ws2_32

bcrypt

gdiplus

oleacc

imm32

winmm

generic