2026-10-15_570be92dd28b607848a8b72f2a4d3976_amadey_avoslocker_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_570be92dd28b607848a8b72f2a4d3976_amadey_avoslocker_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil
Size 9.5MB
Sample261016-tk987sg16l
SHA256 bf3f8527ad98042e8958397a1e882b6ab74c781f1ba0709f75a2d0174ceaa568
MD5 570be92dd28b607848a8b72f2a4d3976
SHA1 390c6e4e01a4fd20e2879b0b4c36fcc8bc71ad8d
SHA512 92466070e5a487a5804e6218ca3960c04fcbc325cf6df1bfa275b44cd4e7b6f16d1ed0de345c655d9a9f3c1341c0fa40b965b99f0048cb8da7d851fba8e707e0
SSDEEP 98304:uC3FXoZfhsfrKNkRQtUMoRLIkMDDMBqLJT3ah8p6O3d0i6V047a:uC3FXoZh4Qt9oiBDlTKh8IiA047a
TLSH
T137A62A6830298F62D4F532BFCEFA6A1C699C09588B7958F7C9E10DE6140DEE72835D31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-15_570be92dd28b607848a8b72f2a4d3976_amadey_avoslocker_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

File Explorer

2026-10-15_570be92dd28b607848a8b72f2a4d3976_amadey_avoslocker_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

.exe 9.5MB

2026-10-15_570be92dd28b607848a8b72f2a4d3976_amadey_avoslocker_coinminer_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat_revil

IMPHASH 4cb9b140be09419a202aa8b445418a18
SHA256 bf3f8527ad98042e8958397a1e882b6ab74c781f1ba0709f75a2d0174ceaa568
MD5 570be92dd28b607848a8b72f2a4d3976
SHA1 390c6e4e01a4fd20e2879b0b4c36fcc8bc71ad8d
SHA512 92466070e5a487a5804e6218ca3960c04fcbc325cf6df1bfa275b44cd4e7b6f16d1ed0de345c655d9a9f3c1341c0fa40b965b99f0048cb8da7d851fba8e707e0
SSDEEP 98304:uC3FXoZfhsfrKNkRQtUMoRLIkMDDMBqLJT3ah8p6O3d0i6V047a:uC3FXoZh4Qt9oiBDlTKh8IiA047a
TLSH
T137A62A6830298F62D4F532BFCEFA6A1C699C09588B7958F7C9E10DE6140DEE72835D31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ca:f3:03:a5:87:21:6c:b8:85:f0:5b:90:00:6d:9d:f0:6e:c2:c1:24:7a:e9:8a:1f:02:af:52:5c:03:7f:09:a0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 24, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:8a:2f:31:3a:b2:c2:9c:d4:2b:06:2a:0e:46:7b:0c

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5899072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\gocart-client-build\win-intel\build\gocartclient\public\gcdirectorywatcher\binaries\windows\release\AGMService.pdb

msi

ord205 ord70

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetCredentials WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSetStatusCallback WinHttpCrackUrl WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpQueryAuthSchemes WinHttpOpenRequest

setupapi

SetupDiGetDeviceRegistryPropertyW CM_Get_DevNode_Status SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW

psapi

GetProcessImageFileNameW

shlwapi

PathStripPathW PathFileExistsW PathRemoveFileSpecW PathRemoveExtensionW PathAddExtensionW PathFindExtensionW PathAppendW PathIsDirectoryW PathRenameExtensionW PathRemoveBackslashW PathIsFileSpecW PathFindFileNameW

shell32

SHGetKnownFolderPath SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW

rpcrt4

RpcStringFreeW UuidToStringW RpcStringFreeA UuidToStringA UuidCreate

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

netapi32

NetApiBufferFree NetWkstaGetInfo

ws2_32

inet_ntoa

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

kernel32

GetCurrentProcessId WideCharToMultiByte GetModuleHandleA GetProcAddress GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW RemoveDirectoryW DecodePointer DuplicateHandle RaiseException HeapDestroy HeapReAlloc HeapSize DeleteCriticalSection GetCurrentProcess TerminateProcess ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject LocalAlloc LocalFree MultiByteToWideChar FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLogicalDriveStringsW QueryDosDeviceW SetLastError GetCurrentThreadId CreateProcessW ProcessIdToSessionId GetSystemTime GetComputerNameExW GetVersionExW FormatMessageW SystemTimeToFileTime GetLocaleInfoA OutputDebugStringA GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency GetTempPathW GetModuleHandleExW SetFileAttributesW FreeLibrary LoadLibraryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WriteFile SetFilePointer GetCurrentThread GetTimeZoneInformation GlobalFree TryEnterCriticalSection ReadFile GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW CreateMutexW GetProcessTimes OpenMutexW GetStdHandle GetFileType GetModuleHandleW LoadLibraryA GlobalMemoryStatus FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapCompact GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI SwitchToThread FlushConsoleInputBuffer MoveFileW lstrcmpA lstrcmpW SetHandleInformation CreatePipe PeekNamedPipe FileTimeToSystemTime Process32FirstW DeviceIoControl GetNativeSystemInfo GetThreadTimes SetFilePointerEx TerminateThread ConnectNamedPipe CreateNamedPipeW GetFileTime GetACP IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateToolhelp32Snapshot CreateSemaphoreW ReleaseSemaphore CompareFileTime DeleteTimerQueue DeleteTimerQueueTimer VerifyVersionInfoW lstrlenW VerSetConditionMask GetModuleFileNameW K32GetProcessImageFileNameW K32EnumProcesses CreateTimerQueueTimer CreateTimerQueue FindResourceW SizeofResource LockResource LoadResource InitializeCriticalSectionAndSpinCount ReadDirectoryChangesW QueueUserWorkItem GetTickCount CreateThread WaitForMultipleObjects Sleep CreateEventW WaitForSingleObject ResetEvent SetEvent GetOverlappedResult GetProcessHeap HeapFree HeapAlloc GetLastError CloseHandle CreateFileW InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime SetFileTime MoveFileExW ExitProcess SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread GetConsoleCP GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentDirectoryW SetStdHandle SetConsoleMode ReadConsoleInputW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation ChangeTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualAlloc VirtualProtect VirtualFree InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx LocalFileTimeToFileTime Process32NextW lstrcatW OpenProcess DosDateTimeToFileTime ReleaseMutex

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA

advapi32

ControlService EnumDependentServicesW OpenServiceW QueryServiceStatusEx RevertToSelf CreateProcessAsUserW OpenProcessToken DeregisterEventSource RegisterEventSourceW ReportEventW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW ChangeServiceConfig2W CopySid CryptGenRandom CryptReleaseContext CryptAcquireContextA ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventA RegisterEventSourceA OpenThreadToken SetSecurityInfo GetNamedSecurityInfoW CreateWellKnownSid GetUserNameW SetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW ConvertSidToStringSidA CloseServiceHandle LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid EqualSid DuplicateTokenEx CreateRestrictedToken AllocateAndInitializeSid SetThreadToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey QueryServiceStatus OpenSCManagerW DeleteService CreateServiceW

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize CoInitializeEx CoInitializeSecurity CoCreateGuid

oleaut32

VariantInit SysAllocStringByteLen VariantClear SysStringLen SysFreeString SysAllocString

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptDecodeObject CryptMsgClose

wintrust

WinVerifyTrust

secur32

GetUserNameExW

bcrypt

BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

generic

count=25, id=259, version=26715,

count=217, id=261, version=26715,

count=19, id=260, version=28117,

count=26, id=259, version=28117,

count=26, id=260, version=26715,

count=5, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=137, id=265, version=28316,

count=2, id=262, version=26715,

count=5, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=31, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=164, id=261, version=28117,

count=40, id=257, version=26715,

count=468, id=1, productName=Unmarked objects,

count=324, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=239, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,