2026-10-31_71d49952ea3671b789063e4e38ca840c_amadey_blankgrabber_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_71d49952ea3671b789063e4e38ca840c_amadey_blankgrabber_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat_revil_smoke-loader
Size 23.6MB
Sample261102-ag6xtsd12v
SHA256 80a3eca5f1e07364b73aebb464190fad801a7053588367c3a1a4355b1d5f852b
MD5 71d49952ea3671b789063e4e38ca840c
SHA1 b57e73b7a8d1b3f22a34232fc4980d9897649b39
SHA512 b28b2a4592d6f5888ecd0be87176b46ceb9246fecf0e01f22b946b97e1731f07148092b682a1c475557a7322b5322e85cb23e2f1e7728e6fce99a651e4298569
SSDEEP 393216:geKx3xUY5dURGhk0d2L9HO4b3wQl5L9C0lhR2eTXOcXTpnAinF:hQhUY5dUkk0gL9BfT3pAinF
TLSH
T1AC479F22755DA033F082C1B2563C5B7E873DE931076940C79ED4EA6A3DA4AC31F36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-31_71d49952ea3671b789063e4e38ca840c_amadey_blankgrabber_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat_revil_smoke-loader

File Explorer

2026-10-31_71d49952ea3671b789063e4e38ca840c_amadey_blankgrabber_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat_revil_smoke-loader

.exe 23.6MB

2026-10-31_71d49952ea3671b789063e4e38ca840c_amadey_blankgrabber_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_njrat_revil_smoke-loader

IMPHASH 45605556ea8d14342388716cc5f0c60b
SHA256 80a3eca5f1e07364b73aebb464190fad801a7053588367c3a1a4355b1d5f852b
MD5 71d49952ea3671b789063e4e38ca840c
SHA1 b57e73b7a8d1b3f22a34232fc4980d9897649b39
SHA512 b28b2a4592d6f5888ecd0be87176b46ceb9246fecf0e01f22b946b97e1731f07148092b682a1c475557a7322b5322e85cb23e2f1e7728e6fce99a651e4298569
SSDEEP 393216:geKx3xUY5dURGhk0d2L9HO4b3wQl5L9C0lhR2eTXOcXTpnAinF:hQhUY5dUkk0gL9BfT3pAinF
TLSH
T1AC479F22755DA033F082C1B2563C5B7E873DE931076940C79ED4EA6A3DA4AC31F36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

aa:05:12:af:26:11:4d:fd:a7:cf:be:9e:3c:2c:b2:79:1c:33:39:30:5a:b0:3c:64:10:59:ad:d2:8e:be:5b:77

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Chains

Sep 21, 2026

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Serial Number

04:7d:f4:69:4f:cc:50:04:b5:cf:f6:be:10:bf:c8:e8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - May 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

15491232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb

dbghelp

SymFromAddr SymSetOptions SymGetOptions SymInitialize

kernel32

SetNamedPipeHandleState TransactNamedPipe RemoveVectoredExceptionHandler GetCurrentThreadId GetModuleFileNameW LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetLastError lstrcmpiW DeleteCriticalSection RaiseException DecodePointer LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress GetModuleHandleW MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW InitializeCriticalSectionEx TryAcquireSRWLockExclusive WaitForMultipleObjects WaitForSingleObject PostQueuedCompletionStatus FormatMessageW ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive TerminateThread CloseHandle QueueUserAPC LocalFree WideCharToMultiByte FormatMessageA CreateEventA CreateDirectoryW CreateThread GetCurrentThread SetLastError MoveFileExW GetTempPathW ExpandEnvironmentStringsW CreateEventW GetUserGeoID GetGeoInfoW GetLocaleInfoW GlobalMemoryStatusEx GetComputerNameW DeleteFileW MoveFileW GetSystemTimeAsFileTime GetUserDefaultLCID LCMapStringA GetStringTypeExA LoadLibraryA SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentProcess FindFirstFileW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose LoadLibraryW CreateFileW CreateProcessW GetSystemDirectoryW WriteFile HeapFree HeapSize HeapReAlloc HeapAlloc HeapDestroy GetProcessHeap GetTempFileNameW InitializeSRWLock SetWaitableTimer GetQueuedCompletionStatus SleepEx CreateIoCompletionPort CreateWaitableTimerW GetSystemDefaultUILanguage GetUserDefaultUILanguage LCIDToLocaleName GetProcessId ProcessIdToSessionId OpenEventW GetNativeSystemInfo GetSystemPowerStatus ResetEvent GetProcessHeaps K32GetProcessMemoryInfo K32GetPerformanceInfo GetProcessTimes GetSystemTime SystemTimeToFileTime GetProcessHandleCount IsWow64Process OpenProcess K32GetModuleBaseNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW UnregisterWaitEx WaitNamedPipeW ReadFile ResumeThread TerminateProcess QueryFullProcessImageNameW K32GetModuleFileNameExW K32EnumProcesses RegisterWaitForSingleObject GetExitCodeProcess GetSystemInfo VerSetConditionMask VerifyVersionInfoW CreatePipe SetHandleInformation WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA ReleaseSemaphore QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy GetFileAttributesW GetPrivateProfileStringW GetFileInformationByHandle GetFileType GetStdHandle ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree Sleep VirtualAlloc VirtualProtect VirtualFree GetModuleHandleExW GetEnvironmentVariableW GetACP InitializeCriticalSection TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetExitCodeThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateFileA CreateNamedPipeW GetOverlappedResult CancelIoEx WaitNamedPipeA DeviceIoControl OpenThread GetTickCount GetComputerNameExA GetComputerNameExW GetVersionExW GlobalAlloc GlobalFree OpenMutexW CreateFileMappingA OpenFileMappingA UnmapViewOfFile ReleaseMutex SwitchToThread MapViewOfFileEx CreateMutexW InitOnceExecuteOnce RemoveDirectoryW GetTickCount64 GetThreadId VirtualQuery Module32FirstW Module32NextW RtlCaptureStackBackTrace SetFileAttributesW FlushFileBuffers MapViewOfFile CreateFileMappingW GetFileSize LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI K32EnumProcessModules GetSystemFirmwareTable LCMapStringW GetStringTypeExW GetVolumeInformationW WTSGetActiveConsoleSessionId GetEnvironmentVariableA GetFileSizeEx GetCurrentDirectoryW LocalFileTimeToFileTime SetFileTime GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW LocalAlloc GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetDateFormatW GetLocalTime SleepConditionVariableSRW GetLogicalProcessorInformation GetThreadTimes GetVersion AddVectoredExceptionHandler IsDebuggerPresent TryAcquireSRWLockShared GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetFileTime SetFilePointerEx GetWindowsDirectoryW CopyFileExW WaitForMultipleObjectsEx OpenEventA CreateWaitableTimerA UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW GetSystemTimes Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetBinaryTypeW RtlUnwind InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread SetStdHandle ExitProcess GetDriveTypeW PeekNamedPipe SetEnvironmentVariableW GetConsoleOutputCP GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW IsValidLocale EnumSystemLocalesW HeapQueryInformation IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

api-ms-win-devices-query-l1-1-0

DevCreateObjectQuery

srvcli

NetShareEnum

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

Name

.text

Size

16.3MB

Virtual Size

16.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

898KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

907KB

Virtual Size

907KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=217, id=261, version=35215,

count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=253, version=35207,

count=18, id=260, version=35207,

count=28, id=259, version=35207,

count=26, id=259, version=35215,

count=124, id=261, version=35207,

count=1, id=262, version=35215,

count=8, id=205, version=50522,

count=47, id=260, version=35215,

count=5, id=257, version=35215,

count=2, id=259, version=35227,

count=336, id=261, version=35227,

count=70, productName=Unmarked objects (old),

count=1013, id=260, version=35227,

count=740, id=1, productName=Unmarked objects,

count=2561, id=265, version=35227,

count=1, id=255, version=35227,

count=1, id=151,

count=1, id=258, version=35227,