2026-04-24_0c9133b9b2a080b24d52cc89a903c09d_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-24_0c9133b9b2a080b24d52cc89a903c09d_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 1.6MB
Sample260424-ed9a1aes21
SHA256 a81c58fc82d4ad92cccfdc963fbf5b26908f569a1ef702a2093beadbe97a519c
MD5 0c9133b9b2a080b24d52cc89a903c09d
SHA1 258dec120478125782ac14507a3c6d270af13fb8
SHA512 2852ea35ec988a8d06cf1b0f67cb1c43ad8b794d1763b45a7e2320aa0767ab8c40b0e4cb6fc1c8547683e1311a9c3307d88de19e2961bb3bc51f0691f096d5ed
SSDEEP 24576:zGUjxn5cKPY6OC+4SclUc1m5OhbsEsFH04kJOv09Q3l1AYH/6EwETX+uJ:9dPnlUa/MFU4rv09+lT69ETX+uJ
TLSH
T1F0758C327905823AD56201709D7DFBAA98ACBD7507B441C7A3C82E3E2D305D36E36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-04-24_0c9133b9b2a080b24d52cc89a903c09d_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 1.6MB

2026-04-24_0c9133b9b2a080b24d52cc89a903c09d_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH cea930699db0f6e3f80cfbced9dc147b
SHA256 a81c58fc82d4ad92cccfdc963fbf5b26908f569a1ef702a2093beadbe97a519c
MD5 0c9133b9b2a080b24d52cc89a903c09d
SHA1 258dec120478125782ac14507a3c6d270af13fb8
SHA512 2852ea35ec988a8d06cf1b0f67cb1c43ad8b794d1763b45a7e2320aa0767ab8c40b0e4cb6fc1c8547683e1311a9c3307d88de19e2961bb3bc51f0691f096d5ed
SSDEEP 24576:zGUjxn5cKPY6OC+4SclUc1m5OhbsEsFH04kJOv09Q3l1AYH/6EwETX+uJ:9dPnlUa/MFU4rv09+lT69ETX+uJ
TLSH
T1F0758C327905823AD56201709D7DFBAA98ACBD7507B441C7A3C82E3E2D305D36E36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

c2:70:a7:fa:50:1a:2f:1b:70:b1:2a:02:2b:37:ca:aa:b4:b2:42:48:57:91:95:03:c0:2c:27:de:3a:3c:f0:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Chains

Feb 19, 2024

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Serial Number

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - May 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

788758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\MGame\BzySearch\SearchMain\bin\Release\TabxSearch.pdb

kernel32

TerminateProcess RaiseException DecodePointer ExpandEnvironmentStringsW lstrcpyW lstrcpynW GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetNativeSystemInfo GetProcessId GetStartupInfoW CreateProcessW GetCurrentThread GetCurrentProcess Sleep OutputDebugStringW GetTempPathW DeleteFileW IsBadReadPtr VirtualProtect GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCommandLineW FileTimeToSystemTime lstrlenW FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetTickCount64 GetDriveTypeW FindFirstFileW FindClose FileTimeToLocalFileTime WaitForMultipleObjects GetOverlappedResult SetNamedPipeHandleState WriteFile ReadFile CreateFileW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage GetFullPathNameW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex ResetEvent SetEvent CloseHandle WideCharToMultiByte MultiByteToWideChar GetStdHandle InitializeCriticalSectionEx GetLastError WritePrivateProfileStringW GetPrivateProfileIntW PeekNamedPipe GetFileInformationByHandle CreateDirectoryW GetTimeZoneInformation GetModuleFileNameW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetFileAttributesExW HeapDestroy CreateTimerQueue GetStringTypeW FormatMessageW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread TryEnterCriticalSection EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent LoadLibraryExW GetVersionExW MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetFileSizeEx SetFilePointer LocalFree InterlockedIncrement InterlockedDecrement LocalAlloc OpenProcess GetExitCodeProcess FindNextFileW GetACP GetCurrentDirectoryW MulDiv ExitProcess FreeResource GetFileSize lstrcmpW SetEndOfFile ResumeThread GetLocalTime GetVersion GetTempFileNameW FindFirstChangeNotificationW DeviceIoControl lstrlenA IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead FlushFileBuffers SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA VirtualAlloc VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind FindFirstFileExW SystemTimeToTzSpecificLocalTime ExitThread GetModuleHandleExW

user32

SetWindowLongW GetParent GetClassNameW GetWindow MonitorFromWindow DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow GetSystemMetrics GetMenu SetPropW GetPropW AdjustWindowRectEx LoadImageW SetWindowRgn MessageBoxW MonitorFromPoint CharPrevW DrawTextW SetRect DrawIconEx GetIconInfo HideCaret ShowCaret GetSysColor RemovePropW GetMessagePos IsRectEmpty DrawFocusRect FillRect GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn FindWindowExW IsWindowEnabled GetWindowDC IntersectRect MapWindowPoints SetCaretPos GetCaretBlinkTime CreateCaret InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC SetCapture GetKeyState CharNextW SetWindowPos UpdateLayeredWindow IsChild CreateWindowExW DispatchMessageW TranslateMessage GetMessageW LoadCursorW OffsetRect UnionRect InflateRect SetCursor FindWindowW EnumDisplayMonitors GetMonitorInfoW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow wvsprintfW RegisterClipboardFormatW GetClipboardData SetClipboardData CloseClipboard OpenClipboard BringWindowToTop AttachThreadInput PtInRect CopyRect ScreenToClient GetCaretPos GetCursorPos GetClientRect SetWindowTextW RedrawWindow KillTimer SetTimer GetFocus SetFocus IsZoomed IsIconic IsWindowVisible ShowWindow DestroyWindow PostQuitMessage UnregisterHotKey RegisterHotKey DestroyIcon TrackPopupMenu DeleteMenu InsertMenuW GetMenuItemCount DestroyMenu CreatePopupMenu GetMenuStringW SendMessageW ClientToScreen GetWindowRect ReleaseCapture MoveWindow IsWindow PostMessageW GetShellWindow WaitForInputIdle wsprintfW GetWindowLongW GetDlgCtrlID EmptyClipboard

advapi32

LockServiceDatabase QueryServiceConfigW QueryServiceLockStatusW UnlockServiceDatabase RegCreateKeyW ChangeServiceConfigW RegGetValueW DuplicateTokenEx LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenThreadToken AllocateAndInitializeSid EqualSid FreeSid GetTokenInformation RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW RegSetValueExW QueryServiceStatus OpenServiceW

shell32

SHGetDesktopFolder SHGetSpecialFolderPathW ord680 ShellExecuteW DragQueryFileW ShellExecuteExW ord727 SHGetFileInfoW SHFileOperationW SHParseDisplayName SHBindToParent ord155 SHGetFolderPathW SHCreateDirectoryExW ord18

ole32

CreateStreamOnHGlobal OleLockRunning OleInitialize CoInitialize CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize CLSIDFromString CLSIDFromProgID

oleaut32

SafeArrayPutElement SafeArrayCreate VariantClear VariantInit VariantTimeToSystemTime SysAllocString SysFreeString SystemTimeToVariantTime

shlwapi

PathAppendW PathRemoveFileSpecW StrCmpIW PathFindFileNameW PathFileExistsW PathFindExtensionW StrStrIW PathIsDirectoryW wnsprintfW PathAddBackslashW PathCombineW SHAutoComplete PathFindExtensionA StrRetToBufW

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

comctl32

ord17 ord410 ord412 _TrackMouseEvent ImageList_DrawEx ImageList_GetIconSize ord413 InitCommonControlsEx ImageList_Destroy

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipImageGetFrameDimensionsCount GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdiplusStartup GdipSaveImageToFile GdipCreateTexture GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCloneBitmapAreaI GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipDrawImageRectI GdipDrawImageRectRectI GdipClosePathFigure

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdi32

CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice ExtTextOutW GetTextMetricsW SelectObject TextOutW RestoreDC Rectangle GetStockObject SetBkColor DeleteDC CreatePen CreateFontIndirectW SetDIBColorTable CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode GetObjectW SetWindowOrgEx CreateRoundRectRgn GetDeviceCaps CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W SelectClipRgn SaveDC ExtSelectClipRgn DeleteObject

msimg32

GradientFill AlphaBlend

generic

count=39, id=259, version=24610,

count=199, id=261, version=24610,

count=30, id=260, version=24610,

count=9, id=260, version=27045,

count=20, id=261, version=27045,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=2, id=199, version=41118,

count=27, id=259, version=26706,

count=2, id=261, version=27049,

count=65, id=261, version=27051,

count=1, id=263, version=24610,

count=4, id=261, version=27031,

count=134, id=261, version=26706,

count=40, id=260, version=26706,

count=17, id=262, version=24610,

count=39, id=257, version=24610,

count=611, id=1, productName=Unmarked objects,

count=40, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,