2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play
Size 4.9MB
Sample260511-ppgp8shz8s
SHA256 674e89833a95a8e5e8fd9cef49976f5544d99410787138d8e986b64844f06d83
MD5 05b87ff14f47093b6a8db5c066c8ea61
SHA1 436bedf94cea6f438d37917d812093bc46e10e4f
SHA512 43f57ac3705f05fda5545d8915a1bce6854e359f9971b4badc24f79bb377fba227dcc6bf9d79a57ef1fe263e423ade982d2138ad8ba4c29a596a5eea2dd88631
SSDEEP 98304:U2zC5DSxIED25fumsCBmINVWyTBKDfAl4mt:UsCLTur8mLzfAl4K
TLSH
T1A736E0C1EC03D113D3794131602582FDFC667A5CEB66987E3194D976A62AFF8A0A87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play

File Explorer

2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play

.exe 4.9MB

2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play

IMPHASH 0c3b09a5aa2b5d310c0a40c3058c2026
SHA256 674e89833a95a8e5e8fd9cef49976f5544d99410787138d8e986b64844f06d83
MD5 05b87ff14f47093b6a8db5c066c8ea61
SHA1 436bedf94cea6f438d37917d812093bc46e10e4f
SHA512 43f57ac3705f05fda5545d8915a1bce6854e359f9971b4badc24f79bb377fba227dcc6bf9d79a57ef1fe263e423ade982d2138ad8ba4c29a596a5eea2dd88631
SSDEEP 98304:U2zC5DSxIED25fumsCBmINVWyTBKDfAl4mt:UsCLTur8mLzfAl4K
TLSH
T1A736E0C1EC03D113D3794131602582FDFC667A5CEB66987E3194D976A62AFF8A0A87C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:0f:c5:7d:0e:f6:21:09:f1:c7:14:95:f5:10:7a:e0:e7:98:6c:85:20:c7:72:6b:91:a2:21:5d:7b:a4:6a:0e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 26, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Minor OS version

Major OS version

Entry point

107183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource FindResourceW GetTickCount LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess FindClose MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW WideCharToMultiByte VirtualQuery SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime InitializeCriticalSection LoadLibraryExW WriteConsoleW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetStdHandle GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx OutputDebugStringW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc TryEnterCriticalSection GetProcessHandleCount TerminateProcess HeapFree OpenProcess GetCurrentProcessId WriteFile EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetModuleHandleW IsDebuggerPresent CreateEventW GetModuleFileNameW Sleep CloseHandle FreeResource CreateFileW ExitProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount lstrcmpiW

user32

GetMessageW TranslateMessage DispatchMessageW ReleaseDC DestroyWindow MessageBoxW PeekMessageW DefWindowProcW CharNextW MonitorFromWindow GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW SendMessageW GetWindowLongW WaitForInputIdle

gdi32

CreateDIBSection CreateCompatibleDC GetDeviceCaps GetObjectW DeleteObject SelectObject SetDIBColorTable DeleteDC

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VarUI4FromStr

comctl32

ImageList_AddMasked InitCommonControlsEx ImageList_Create ImageList_Destroy

ws2_32

WSACleanup

gdiplus

GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdiplusShutdown GdipFree GdipGetImageWidth

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_05b87ff14f47093b6a8db5c066c8ea61_amadey_darkgate_elex_luca-stealer_njrat_play

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic