2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader
Size 4.7MB
Sample261024-qlc4bazs2m
SHA256 5b2b7d7bce234da8d82fd12480dbb38553d7b86da1201c383be87a43bd81fdf7
MD5 51eef50d8f0115ab82ef7066d8e96195
SHA1 02fb19c81dce5cd688a0f814d4d7b474d254449c
SHA512 a28642aba88616fb17b2af86ca30b987cc2cbf928f5691da81cc8cc72543f6e395f1e19d2196ae2a17b625896c82ddeb72d3897dfd5b561f23d9328fbdc9191a
SSDEEP 98304:NKcuHdMeOD/kDRaDvrnJQdolZ9s+OAc3vfZ/4j27mbZ4:NgHddO7v6+lk+UfZ/4jAmt4
TLSH
T12136BF11FBC180A2DE524234159AF779A93D5EE4472981C397B17A69EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

File Explorer

2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

.exe 4.7MB

2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

IMPHASH d2cd7e4a58921a7b87e6d1a2b4dee47a
SHA256 5b2b7d7bce234da8d82fd12480dbb38553d7b86da1201c383be87a43bd81fdf7
MD5 51eef50d8f0115ab82ef7066d8e96195
SHA1 02fb19c81dce5cd688a0f814d4d7b474d254449c
SHA512 a28642aba88616fb17b2af86ca30b987cc2cbf928f5691da81cc8cc72543f6e395f1e19d2196ae2a17b625896c82ddeb72d3897dfd5b561f23d9328fbdc9191a
SSDEEP 98304:NKcuHdMeOD/kDRaDvrnJQdolZ9s+OAc3vfZ/4j27mbZ4:NgHddO7v6+lk+UfZ/4jAmt4
TLSH
T12136BF11FBC180A2DE524234159AF779A93D5EE4472981C397B17A69EB330C2873F3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d3:be:37:b5:cb:3e:51:54:14:7f:2e:94:9c:1d:95:cd:c7:88:48:cf:42:64:0b:b9:d7:b3:c7:11:85:1a:f4:ba

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-4022119,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Nov 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

48:1f:38:ec:6d:a2:e1:35:1a:46:6c:7a:cc:1c:4a:45:b1:be:1a:0a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Nov 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0f:55:32:d2:f9:7e:d0:c2:b1:b1:6c:aa:81:43:00:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2024 - Jan 10, 2026

Minor OS version

Major OS version

Entry point

1991758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\CrossEXService\client\projects\windows\Release\CrossEXService.pdb

crypt32

CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

kernel32

IsValidCodePage FindFirstFileExW CreateDirectoryW MoveFileExW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW SetStdHandle QueryPerformanceFrequency VirtualQuery HeapQueryInformation SetConsoleCtrlHandler GetEnvironmentStringsW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA PeekNamedPipe GetFileInformationByHandle GetDriveTypeW RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW ExitProcess SizeofResource HeapFree GetCurrentProcess GetUserDefaultLangID InitializeCriticalSectionEx HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc LoadResource FindResourceW HeapAlloc DecodePointer GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte LoadLibraryExW FindFirstFileW SetLastError FindNextFileW FindClose GetFileAttributesW Sleep GetTickCount ReadFile SetNamedPipeHandleState WriteFile CreateMutexW CreateFileW ReleaseMutex CloseHandle WaitNamedPipeW LoadLibraryExA LocalAlloc LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent FormatMessageA TerminateThread RegisterWaitForSingleObject UnregisterWait CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult UnregisterWaitEx ConnectNamedPipe TerminateProcess CreateProcessA GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemDirectoryA LoadLibraryA WriteConsoleW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetEnvironmentVariableW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree MulDiv FormatMessageW CopyFileW OutputDebugStringA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetModuleHandleA lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GlobalReAlloc GlobalHandle LocalReAlloc CompareStringW GlobalFlags lstrcmpW SetThreadPriority ResumeThread GlobalAddAtomW DeleteFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW EncodePointer GetSystemDirectoryW GlobalDeleteAtom GlobalFindAtomW GetVersionExW FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime GetLocaleInfoW GetUserDefaultUILanguage GetCurrentDirectoryW lstrcpyW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetTempPathW GetTickCount64 GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID

user32

CreatePopupMenu NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA CopyImage SystemParametersInfoW GetMenuItemInfoW DestroyMenu IntersectRect InflateRect LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow GetForegroundWindow SetActiveWindow GetMenuDefaultItem TrackPopupMenu SetMenu GetMenu GetCapture IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu UnionRect UpdateLayeredWindow MonitorFromPoint LoadIconW LoadAcceleratorsW DispatchMessageW ShowWindow LoadStringW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW FillRect ScreenToClient EndPaint BeginPaint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW CharUpperW DestroyIcon CallNextHookEx SetWindowsHookExW GetCursorPos ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW RealChildWindowFromPoint GetClassNameW GetDesktopWindow PtInRect ClientToScreen GetWindowRect IsDialogMessageW SetWindowLongW SetWindowTextW GetFocus GetDlgCtrlID CheckDlgButton MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW SetClassLongW SetWindowRgn SetParent DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW PostQuitMessage AppendMenuW RemoveMenu GetWindowTextW GetWindowTextLengthW UnhookWindowsHookEx SendMessageW EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetFocus SetScrollPos GetScrollPos GetWindow IsWindow MoveWindow SetWindowPos GetDlgItem TranslateAcceleratorW InsertMenuItemW UnpackDDElParam DrawIcon ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel UpdateWindow LoadCursorW DestroyCursor GetWindowRgn CreateMenu TranslateMessage SubtractRect

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW GetTextExtentPoint32W DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CreateFontIndirectW CombineRgn ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx GetObjectW SetTextAlign SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt DeleteObject DeleteDC GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

CryptGetUserKey RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation SetKernelObjectSecurity SetSecurityInfo RegSetValueExW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegQueryValueExW CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken InitializeSecurityDescriptor

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder DragQueryFileW DragFinish SHAppBarMessage SHBrowseForFolderW

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW StrFormatKBSizeW PathStripToRootW

uxtheme

GetThemeSysColor DrawThemeText GetThemePartSize IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoDisconnectObject CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate LoadTypeLi VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

WSACleanup getsockopt __WSAFDIsSet accept bind closesocket select listen WSAStartup getpeername inet_addr getsockname send socket connect recvfrom recv sendto ioctlsocket htonl htons inet_ntoa gethostbyaddr getservbyport WSASetLastError shutdown gethostbyname ntohs WSAGetLastError setsockopt getservbyname

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipDrawImageRectI GdipSetInterpolationMode GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_51eef50d8f0115ab82ef7066d8e96195_amadey_coinminer_darkgate_elex_floxif_glassworm_graphican_luca-stealer_lynx_njrat_revil_smoke-loader

PE Signature issue

PE Signature issue

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

version

ws2_32

bcrypt

gdiplus

oleacc

imm32

winmm

generic