2026-06-27_c44d0f67cb3b12b93159a835dc3c80b6_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_c44d0f67cb3b12b93159a835dc3c80b6_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader_virut
Size 1.5MB
Sample260629-dnmpbabz21
SHA256 77c9b4e13d025bf1de10a780b7eb170c05869e1ac00c7464fcf14612d130c981
MD5 c44d0f67cb3b12b93159a835dc3c80b6
SHA1 c1ae53bbdbfcffb56b64c197fa0aab206f9ea24d
SHA512 2598555df398a4bbd8e2226f9e2f1c075aeb683738ff3257442c28558875b9b60f55627950b9964e177002dcdde4b3f499e9740bd250a556b1564199b7484cd8
SSDEEP 24576:syQsA58lXBHYkUYQgAQtu6O3w1obEXEXz25X9tARERb8a:CsDzHYtgQ6O3rQXj9uRE+a
TLSH
T119658D3179338032E57201B099B8AB6EC46DFA354B7149CBA3C81F3E59349D35A36B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_c44d0f67cb3b12b93159a835dc3c80b6_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader_virut

File Explorer

2026-06-27_c44d0f67cb3b12b93159a835dc3c80b6_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader_virut

.exe 1.5MB

2026-06-27_c44d0f67cb3b12b93159a835dc3c80b6_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader_virut

IMPHASH 8a6a7372a78d018e350f8bc5726c1da3
SHA256 77c9b4e13d025bf1de10a780b7eb170c05869e1ac00c7464fcf14612d130c981
MD5 c44d0f67cb3b12b93159a835dc3c80b6
SHA1 c1ae53bbdbfcffb56b64c197fa0aab206f9ea24d
SHA512 2598555df398a4bbd8e2226f9e2f1c075aeb683738ff3257442c28558875b9b60f55627950b9964e177002dcdde4b3f499e9740bd250a556b1564199b7484cd8
SSDEEP 24576:syQsA58lXBHYkUYQgAQtu6O3w1obEXEXz25X9tARERb8a:CsDzHYtgQ6O3rQXj9uRE+a
TLSH
T119658D3179338032E57201B099B8AB6EC46DFA354B7149CBA3C81F3E59349D35A36B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6f:dc:17:7c:f3:75:27:ab:03:43:b8:ff:84:31:f3:b5:c7:2c:37:45:9e:6d:3a:90:f9:46:1e:e8:76:ec:48:42

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 29, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1560491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\851777\out\Release\SodaDownloader.pdb

kernel32

SizeofResource WriteFile SetFilePointer OutputDebugStringW FindResourceW FindResourceExW GetPrivateProfileIntW GetPrivateProfileStringW InterlockedCompareExchange GetFileSize lstrlenA InterlockedExchange TerminateThread GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree SetEndOfFile SetFileAttributesW DeleteFileW MoveFileExW lstrlenW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetTempPathW MapViewOfFileEx InterlockedIncrement InterlockedDecrement GetCommandLineW MapViewOfFile CreateFileMappingW LockResource GetModuleHandleW DeviceIoControl DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetProcessHeap IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers IsValidLocale GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes GetCurrentThreadId TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetFileAttributesW GetCurrentThread GetProcessAffinityMask ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP CreateDirectoryW GetCurrentDirectoryW SetFileTime VerifyVersionInfoW VerSetConditionMask HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent LoadResource HeapSize GetOEMCP GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject MulDiv SetThreadAffinityMask LocalFree LoadLibraryW GetProcAddress GetModuleFileNameW HeapDestroy FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer UnmapViewOfFile CreateFileW

user32

BringWindowToTop GetSystemMetrics GetDC ReleaseDC MonitorFromWindow PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId DrawTextW GetDesktopWindow GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData EqualRect UnionRect IntersectRect SetCursor LoadCursorW PtInRect IsRectEmpty OffsetRect ScreenToClient GetCursorPos InvalidateRect SetWindowRgn LoadImageW KillTimer SetTimer PeekMessageW GetMonitorInfoW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect SetWindowTextW SetFocus PostQuitMessage SendMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW GetUpdateRect IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos wsprintfW MonitorFromPoint CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint

gdi32

SetStretchBltMode SetTextColor CreateDIBSection GetObjectA GetObjectW StretchBlt SetBkMode GetDeviceCaps CreateFontIndirectW DeleteObject GetStockObject SetBkColor BitBlt CreateRoundRectRgn CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn CreateCompatibleDC DeleteDC SelectObject SetWindowOrgEx

advapi32

RegCloseKey RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW EnumServicesStatusW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExA

shell32

ShellExecuteExW ShellExecuteW CommandLineToArgvW SHGetFolderPathW ord165

ole32

CoUninitialize OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc CoInitializeEx

oleaut32

SysFreeString LoadTypeLi LoadRegTypeLi VarUI4FromStr SysAllocString VariantInit SysStringLen

shlwapi

SHGetValueW ord176 PathCanonicalizeW StrStrIA StrTrimA StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW PathFileExistsW SHSetValueA SHGetValueA PathIsRelativeW PathRemoveFileSpecW

version

VerQueryValueW

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmDisableIME

crypt32

CryptBinaryToStringA CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

wininet

HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW

gdiplus

GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCreateFontFromDC GdipDrawImageRectRectI GdipCloneStringFormat GdipFillEllipse GdipDrawPath GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateFontFromLogfontA GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipFillPath GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipCreateMatrix

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=26, id=259, version=26706,

count=38, id=261, version=27051,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=36, id=260, version=26706,

count=129, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=658, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=260, version=27048,

count=31, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,