2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader
Size 4.6MB
Sample261015-p77pdadh48
SHA256 e96dc5d852e495e55036c76e54a32e6579b97a839af7cd8524a6a13253fb372c
MD5 5a174272c7f8993809920672eeea7264
SHA1 b5347ef6866b16ce568bdc92ebeb7e4d0edc3dd3
SHA512 ad3a411e207c5133bdbe76d7040c325f124ed454e2a2ccdae21e23df90e36750f76355654c49e1ca9517568ad839d9f73eb22d10e3301e6de78319d16222d88d
SSDEEP 98304:xKcoKQDdXeGQOJ0mEjaVABteoGsCLI4xvV+/AjzDrMlEETPO:xiKyXekiaK3ChdbjzDrgNTO
TLSH
T1F736BF21BB45C0AED94302343599F77B993C6D654769C0C387B17A6FA8338C25A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 4.6MB

2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH 9289b6a6ce28275fbdfd9373928a628c
SHA256 e96dc5d852e495e55036c76e54a32e6579b97a839af7cd8524a6a13253fb372c
MD5 5a174272c7f8993809920672eeea7264
SHA1 b5347ef6866b16ce568bdc92ebeb7e4d0edc3dd3
SHA512 ad3a411e207c5133bdbe76d7040c325f124ed454e2a2ccdae21e23df90e36750f76355654c49e1ca9517568ad839d9f73eb22d10e3301e6de78319d16222d88d
SSDEEP 98304:xKcoKQDdXeGQOJ0mEjaVABteoGsCLI4xvV+/AjzDrMlEETPO:xiKyXekiaK3ChdbjzDrgNTO
TLSH
T1F736BF21BB45C0AED94302343599F77B993C6D654769C0C387B17A6FA8338C25A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d2:c6:5a:54:d6:aa:7b:32:a8:69:fa:e5:3d:83:55:4d:ca:9f:71:0f:eb:1b:32:f0:a1:da:0a:fe:2b:fc:f7:a4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-4022119,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Mar 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ec:b4:2e:0d:46:d9:c9:61:9c:08:74:7e:22:1e:79:29:8a:5f:40:ed

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Mar 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:55:32:d2:f9:7e:d0:c2:b1:b1:6c:aa:81:43:00:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2024 - Jan 10, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1984558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\CrossEXService\client\projects\windows\Release\CrossEXService.pdb

crypt32

CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

kernel32

IsValidCodePage FindFirstFileExW CreateDirectoryW MoveFileExW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW SetStdHandle QueryPerformanceFrequency VirtualQuery HeapQueryInformation SetConsoleCtrlHandler GetEnvironmentStringsW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA PeekNamedPipe GetFileInformationByHandle GetDriveTypeW RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW ExitProcess SizeofResource HeapFree GetCurrentProcess GetUserDefaultLangID InitializeCriticalSectionEx HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc LoadResource FindResourceW HeapAlloc DecodePointer GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte LoadLibraryExW FindFirstFileW SetLastError FindNextFileW FindClose GetFileAttributesW Sleep GetTickCount ReadFile SetNamedPipeHandleState WriteFile CreateMutexW CreateFileW ReleaseMutex CloseHandle WaitNamedPipeW LoadLibraryExA LocalAlloc LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent FormatMessageA TerminateThread RegisterWaitForSingleObject UnregisterWait CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult UnregisterWaitEx ConnectNamedPipe TerminateProcess CreateProcessA GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemDirectoryA LoadLibraryA WriteConsoleW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetEnvironmentVariableW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree MulDiv FormatMessageW CopyFileW OutputDebugStringA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetModuleHandleA lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GlobalReAlloc GlobalHandle LocalReAlloc CompareStringW GlobalFlags lstrcmpW SetThreadPriority ResumeThread GlobalAddAtomW DeleteFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW EncodePointer GetSystemDirectoryW GlobalDeleteAtom GlobalFindAtomW GetVersionExW FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime GetLocaleInfoW GetUserDefaultUILanguage GetCurrentDirectoryW lstrcpyW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetTempPathW GetTickCount64 GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID

user32

CreatePopupMenu NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA CopyImage SystemParametersInfoW GetMenuItemInfoW DestroyMenu IntersectRect InflateRect LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow GetForegroundWindow SetActiveWindow GetMenuDefaultItem TrackPopupMenu SetMenu GetMenu GetCapture IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu UnionRect UpdateLayeredWindow MonitorFromPoint LoadIconW LoadAcceleratorsW DispatchMessageW ShowWindow LoadStringW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW FillRect ScreenToClient EndPaint BeginPaint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW CharUpperW DestroyIcon CallNextHookEx SetWindowsHookExW GetCursorPos ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW RealChildWindowFromPoint GetClassNameW GetDesktopWindow PtInRect ClientToScreen GetWindowRect IsDialogMessageW SetWindowLongW SetWindowTextW GetFocus GetDlgCtrlID CheckDlgButton MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW SetClassLongW SetWindowRgn SetParent DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW PostQuitMessage AppendMenuW RemoveMenu GetWindowTextW GetWindowTextLengthW UnhookWindowsHookEx SendMessageW EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetFocus SetScrollPos GetScrollPos GetWindow IsWindow MoveWindow SetWindowPos GetDlgItem TranslateAcceleratorW InsertMenuItemW UnpackDDElParam DrawIcon ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel UpdateWindow LoadCursorW DestroyCursor GetWindowRgn CreateMenu TranslateMessage SubtractRect

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW GetTextExtentPoint32W DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CreateFontIndirectW CombineRgn ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx GetObjectW SetTextAlign SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt DeleteObject DeleteDC GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

CryptGetUserKey RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation SetKernelObjectSecurity SetSecurityInfo RegSetValueExW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegQueryValueExW CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken InitializeSecurityDescriptor

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder DragQueryFileW DragFinish SHAppBarMessage SHBrowseForFolderW

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW StrFormatKBSizeW PathStripToRootW

uxtheme

GetThemeSysColor DrawThemeText GetThemePartSize IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoDisconnectObject CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate LoadTypeLi VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

htonl ntohs getsockopt __WSAFDIsSet accept bind closesocket select listen WSAStartup getpeername getsockname send socket connect recvfrom recv sendto ioctlsocket htons inet_addr inet_ntoa gethostbyaddr getservbyport WSASetLastError shutdown WSACleanup gethostbyname WSAGetLastError setsockopt getservbyname

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipDrawImageRectI GdipSetInterpolationMode GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_5a174272c7f8993809920672eeea7264_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader

PE Signature issue

PE Signature issue

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

version

ws2_32

bcrypt

gdiplus

oleacc

imm32

winmm

generic