2026-05-27_f932b814e516ac7a97a143b98a81fab1_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_f932b814e516ac7a97a143b98a81fab1_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 9.2MB
Sample260527-t4wvxsey21
SHA256 d5fd76cf687745f842b76d1c2b7b4ff74abeacc73a4ac8070c9edce4fdab5ce8
MD5 f932b814e516ac7a97a143b98a81fab1
SHA1 0609c68770b3586b3157133ac1ea7be0c6e9149e
SHA512 5b73bb0c5d781025a5b6bf6b2494e85605ce2b277c85d5c8610d6ef939852d9dbd3715544e33b6c80b082b97c0aeaf9ac7410e68af11c9339514b0fde0acf4c9
SSDEEP 196608:njIewwA7S3bkuwQnkkn0niTBXiLakkPqJkvpsQ5V254VTfuLhg2V0T:nLwh7S3AdQnnciTHDPqKRs2V5iVg2V2
TLSH
T1D9A612313A45C172D9A202759D7CFA6A05AC7E381B7491CBA2C83A7E1D70CC36E3965F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-27_f932b814e516ac7a97a143b98a81fab1_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 9.2MB

2026-05-27_f932b814e516ac7a97a143b98a81fab1_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 5b9e66d923c5b25021eb1f4ca214e544
SHA256 d5fd76cf687745f842b76d1c2b7b4ff74abeacc73a4ac8070c9edce4fdab5ce8
MD5 f932b814e516ac7a97a143b98a81fab1
SHA1 0609c68770b3586b3157133ac1ea7be0c6e9149e
SHA512 5b73bb0c5d781025a5b6bf6b2494e85605ce2b277c85d5c8610d6ef939852d9dbd3715544e33b6c80b082b97c0aeaf9ac7410e68af11c9339514b0fde0acf4c9
SSDEEP 196608:njIewwA7S3bkuwQnkkn0niTBXiLakkPqJkvpsQ5V254VTfuLhg2V0T:nLwh7S3AdQnnciTHDPqKRs2V5iVg2V2
TLSH
T1D9A612313A45C172D9A202759D7CFA6A05AC7E381B7491CBA2C83A7E1D70CC36E3965F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

36:04:de:e8:47:fd:8a:f5:56:3e:98:e9:40:f0:91:e6:da:af:94:f5:a5:9a:25:b1:e5:1c:81:0e:69:67:cc:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都汇电时代科技有限公司,O=成都汇电时代科技有限公司,L=成都,ST=四川,C=CN

Chains

Mar 6, 2026

CN=成都汇电时代科技有限公司,O=成都汇电时代科技有限公司,L=成都,ST=四川,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=成都汇电时代科技有限公司,O=成都汇电时代科技有限公司,L=成都,ST=四川,C=CN

Serial Number

5c:b6:fe:f2:e4:04:7b:1f:bc:60:65:6a:ba:c4:f0:76

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2025 - Jul 17, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

548902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\CD_HDSD\dllrepair\install_uninstall\Release\Install.pdb

kernel32

FindCloseChangeNotification FindFirstChangeNotificationW SearchPathW CreateDirectoryW CompareFileTime GetFileInformationByHandle SwitchToThread GetTimeZoneInformation QueryPerformanceFrequency CancelWaitableTimer SetWaitableTimer CreateWaitableTimerW DuplicateHandle ResetEvent GetThreadIOPendingFlag GetCurrentThread InterlockedCompareExchange InterlockedExchange QueryPerformanceCounter SetCurrentDirectoryW lstrlenA FreeResource ExpandEnvironmentStringsW GetDriveTypeW CreateEventW WaitForSingleObject SetEvent WritePrivateProfileStringW MultiByteToWideChar LoadLibraryExW lstrcmpiW Sleep InterlockedDecrement InterlockedIncrement DecodePointer GetVersionExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException WideCharToMultiByte GetStartupInfoW CreateProcessW GetModuleHandleW LoadLibraryW GetTickCount GetSystemInfo GetCurrentProcess OpenProcess GetProcAddress FreeLibrary CreateFileW ReadFile DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime GetFileSize SystemTimeToFileTime GetSystemTime SetFileTime GetFileTime ReadConsoleW WriteConsoleW SetFilePointerEx SetStdHandle WaitForSingleObjectEx SetConsoleCtrlHandler UnlockFile LockFile GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError MoveFileExW MoveFileW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW RemoveDirectoryW GetWindowsDirectoryW GetTempPathW FindResourceExW FindResourceW lstrlenW FindClose SizeofResource LoadResource SetLastError GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource DeleteFileA CreateFileA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW GetFileType GetStdHandle GetModuleFileNameA FreeLibraryAndExitThread ExitThread CreateThread VirtualQuery VirtualProtect TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RtlUnwind SetEndOfFile GetVersion IsBadReadPtr ExitProcess lstrcmpW GetCurrentDirectoryW MulDiv GetACP GetSystemTimeAsFileTime SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcmpA GetTempFileNameA GetTempPathA CloseHandle DeviceIoControl GetSystemWindowsDirectoryW lstrcpynW GetPrivateProfileIntW GetModuleHandleExW ResumeThread GlobalUnlock GlobalLock GlobalFree GlobalAlloc FlushFileBuffers LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetShortPathNameW GetPrivateProfileStringW LocalAlloc GetFileAttributesExW SetFilePointer GetDiskFreeSpaceExW GetEnvironmentVariableW GetTempFileNameW GetSystemDirectoryW FormatMessageW LocalFree CreateFileMappingW UnmapViewOfFile MapViewOfFile GetLocalTime GetFileSizeEx OutputDebugStringW OutputDebugStringA CopyFileW QueryDosDeviceW GetLogicalDriveStringsW GetExitCodeProcess TerminateProcess GetCurrentProcessId GetLongPathNameW WaitForMultipleObjects FileTimeToLocalFileTime WriteFile

user32

GetWindowTextLengthW SetTimer KillTimer PostMessageW FindWindowExW GetWindowThreadProcessId GetShellWindow SendMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow DestroyWindow ShowWindow UpdateLayeredWindow SetWindowPos GetFocus GetAsyncKeyState SetCapture ReleaseCapture DrawTextW GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW DrawIconEx GetClientRect SystemParametersInfoW MsgWaitForMultipleObjectsEx GetAncestor GetWindowInfo MonitorFromPoint EnumDisplaySettingsW GetDesktopWindow WindowFromPoint GetForegroundWindow IsDialogMessageW OffsetRect GetActiveWindow EndDialog MessageBoxW wsprintfW RegisterWindowMessageW SendMessageTimeoutW SendNotifyMessageW FindWindowW CopyRect EqualRect UnionRect PtInRect SetCursor DrawFocusRect DestroyCursor MoveWindow EnumThreadWindows wvsprintfW InflateRect IsChild IsZoomed SetFocus GetKeyState GetUpdateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos IntersectRect IsRectEmpty GetClassNameW RegisterClassW EnableWindow GetMenu SetPropW GetPropW AdjustWindowRectEx CopyImage SetWindowRgn CharPrevW SetRect DestroyIcon GetWindowRect GetIconInfo HideCaret ShowCaret ClientToScreen GetSysColor CreateAcceleratorTableW InvalidateRgn RemovePropW GetWindowDC DialogBoxParamW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow MapWindowPoints SetForegroundWindow GetSystemMetrics IsIconic IsWindowVisible PostQuitMessage CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW FillRect ScreenToClient

gdi32

CreateFontW CreateFontIndirectW CreatePen GetTextExtentPoint32W Rectangle GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn GetDeviceCaps CombineRgn GetCharABCWidthsW GetClipBox ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode TextOutW ExtTextOutW GdiFlush CreateSolidBrush CreateDCW GetDIBits SetDIBitsToDevice EnumFontFamiliesW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateRectRgnIndirect DeleteDC DeleteObject GetStockObject RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetTextColor CreateDIBSection GetObjectW SetViewportOrgEx SetDIBColorTable RectVisible OffsetViewportOrgEx

advapi32

CryptContextAddRef CryptDecrypt GetTokenInformation EqualSid DeleteAce CheckTokenMembership FreeSid AllocateAndInitializeSid RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey DuplicateTokenEx LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCreateKeyW CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW GetUserNameW

shell32

ord165 SHCreateDirectoryExW SHChangeNotify SHBrowseForFolderW ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW SHGetPathFromIDListW

ole32

CLSIDFromProgID CLSIDFromString CoInitializeSecurity OleRun StringFromGUID2 OleUninitialize OleLockRunning CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize CoCreateGuid OleInitialize

oleaut32

SysAllocString VariantCopy SysAllocStringLen SysStringLen SysFreeString SysStringByteLen SysAllocStringByteLen VarUI4FromStr SafeArrayPutElement SafeArrayCreate CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit VariantClear

shlwapi

SHGetValueW StrCmpNIW StrTrimA StrStrIA PathCompactPathW StrToIntW PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameW AssocQueryStringW StrRStrIW PathRemoveExtensionW StrStrIW StrToInt64ExW SHDeleteValueW PathIsPrefixW PathRemoveFileSpecW SHSetValueW PathIsRelativeW ord12 SHCreateStreamOnFileEx StrCmpIW ord214 ord213 PathIsDirectoryW ord154 wnsprintfW

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

gdiplus

GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipGetImageEncoders GdipGetImageEncodersSize GdipGetPropertyItem GdipGetImagePalette GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdipGetImagePaletteSize GdipDrawImagePointsI GdipFillPath GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipGetImageHeight GdipCreateBitmapFromStream GdipDrawImageRectI GdipCreateBitmapFromStreamICM GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipCreateFromHDC GdipSetTextRenderingHint GdipDrawString GdipFillRectangleI GdipMeasureString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRectI GdipDrawImageRectRect GdipDrawImagePointRectI GdipCreatePen1 GdipDeletePen GdipDrawRectangleI GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipSetPenMode GdipSetPenDashStyle GdipSetSmoothingMode GdipDrawLineI GdipDrawPath GdipFillEllipseI ord1 GdipDrawEllipseI GdipClosePathFigure GdipCreateTexture GdipSaveImageToFile GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipSetInterpolationMode GdipGraphicsClear GdiplusStartup

psapi

EnumProcesses GetProcessImageFileNameW GetModuleFileNameExW

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpSetOption WinHttpWriteData WinHttpReadData WinHttpConnect WinHttpCloseHandle

msi

ord195

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

secur32

GetUserNameExW

wininet

InternetCrackUrlW InternetGetCookieExW

iphlpapi

GetAdaptersInfo

msimg32

GradientFill AlphaBlend

generic

count=30, id=241, version=40116,

count=166, id=243, version=40116,

count=34, id=242, version=40116,

count=65, id=261, version=27051,

count=3, id=199, version=41118,

count=22, id=259, version=26706,

count=2, id=260, version=27034,

count=6, id=261, version=27054,

count=1, id=260, version=27053,

count=16, id=265, version=27053,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=261, version=27045,

count=35, id=260, version=26706,

count=72, id=261, version=26706,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=585, id=1, productName=Unmarked objects,

count=73, id=261, version=27053,

count=1, id=256, version=27053,

count=1, id=255, version=27053,

count=1, id=151,

count=1, id=258, version=27053,