2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 3.0MB
Sample260415-tkdv1ac19j
SHA256 5981f0d0e01344e0e1c73f35029d6100bab8f711e7470dc3ebf019455289f0c8
MD5 88732f9c2f604e86d1d9c8f06b16036b
SHA1 3c064ef5f5d0dc68d4b53fd4829c1baacd25cf84
SHA512 187866adf986783e4b9b1dbff2efd548994b6b278fa8f5ae060dac9c6e9daa51fea993be514c3c7c72cb25ca4cb3ed64382b71f059322f8530b2a59ec524a170
SSDEEP 49152:vM84pw5WSytLdGwnNTB3vxhZqhaK6zbfqdlIrRokp:Ufw5stJVHhxRrRok
TLSH
T124E59D11A7E14023E1B2297189BAE7555A74BF712F32C1DFAA50711EAE32BC18933737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 3.0MB

2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 0d961b3fef71afead7edd942f9b51e7d
SHA256 5981f0d0e01344e0e1c73f35029d6100bab8f711e7470dc3ebf019455289f0c8
MD5 88732f9c2f604e86d1d9c8f06b16036b
SHA1 3c064ef5f5d0dc68d4b53fd4829c1baacd25cf84
SHA512 187866adf986783e4b9b1dbff2efd548994b6b278fa8f5ae060dac9c6e9daa51fea993be514c3c7c72cb25ca4cb3ed64382b71f059322f8530b2a59ec524a170
SSDEEP 49152:vM84pw5WSytLdGwnNTB3vxhZqhaK6zbfqdlIrRokp:Ufw5stJVHhxRrRok
TLSH
T124E59D11A7E14023E1B2297189BAE7555A74BF712F32C1DFAA50711EAE32BC18933737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

\\OFFBLD490\OfficeRW\Target\ACE\x86\ship\0\AceCnflt.pdb

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaResume __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaForEachCollObj __vbaExitProc ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaStrTextCmp __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVarZero __vbaNextEachCollObj __vbaChkstk EVENT_SINK_AddRef ord560 ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord670 __vbaCastObjVar _adj_fpatan __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface ord710 __vbaUI1I4 __vbaExceptHandler ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 __vbaFailedFriend __vbaFPException __vbaInStrVar __vbaStrVarVal ord534 __vbaVarCat __vbaI2Var __vbaStopExe ord644 ord645 _CIlog __vbaErrorOverflow __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord573 __vbaI4Str ord681 __vbaFreeStrList __vbaVarTextTstGt _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaI4Var __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaAryVarVarg __vbaFpI4 ord616 ord617 __vbaLateMemCallLd _CIatan ord618 __vbaStrMove __vbaCastObj _allmul _CItan _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_88732f9c2f604e86d1d9c8f06b16036b_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

msvbvm60

generic