2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader
Size 2.0MB
Sample260416-sd17aaez5v
SHA256 d9ab47dcf4fc5f6b5f57a4efe10a4943a1e86c1fcc49b5131234eea4bfb58365
MD5 a173f5d8ae42a11b2146289d5f89cd51
SHA1 c5c0056ac1790973de13202682e84881b33586f8
SHA512 ec2fb3d2d28639797a1c7a669037047e7c9d8c0a3aa6dea0238cf22367a9f9725ebf74fe5ec18404796f0d193401d261fa88e22063560391d4a3b986fa2379d2
SSDEEP 24576:WHQy5Sk2vQfUH35DMw2n/qIjtAT3GCaewsAjeWWh4f1tLeyWcRq4a:q92IfU35DMnCIjtAylljeWWhipXq
TLSH
T1C9A56C21BBB492E9D9B70974CA719336A6757D200B30E6CB925C725D4E33EC05E37B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader

.exe 2.0MB

2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader

IMPHASH c8aa01ee81dfa614588a44bb990de12a
SHA256 d9ab47dcf4fc5f6b5f57a4efe10a4943a1e86c1fcc49b5131234eea4bfb58365
MD5 a173f5d8ae42a11b2146289d5f89cd51
SHA1 c5c0056ac1790973de13202682e84881b33586f8
SHA512 ec2fb3d2d28639797a1c7a669037047e7c9d8c0a3aa6dea0238cf22367a9f9725ebf74fe5ec18404796f0d193401d261fa88e22063560391d4a3b986fa2379d2
SSDEEP 24576:WHQy5Sk2vQfUH35DMw2n/qIjtAT3GCaewsAjeWWh4f1tLeyWcRq4a:q92IfU35DMnCIjtAylljeWWhipXq
TLSH
T1C9A56C21BBB492E9D9B70974CA719336A6757D200B30E6CB925C725D4E33EC05E37B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

71548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x86\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent CloseHandle WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject ReleaseMutex CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW DecodePointer FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwind RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

rpcrt4

RpcServerRegisterIfEx RpcImpersonateClient RpcRevertToSelf NdrServerCall2 RpcServerUnregisterIf RpcServerUseProtseqEpW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_a173f5d8ae42a11b2146289d5f89cd51_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader

advapi32

kernel32

rpcrt4

wintrust

generic