2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat
Size 1.5MB
Sample260629-mqlpgac18n
SHA256 5b1cfac1d9ec08098aebf806dc0462c0cef1e50b147254e162607f631cde0239
MD5 0183bd7ff973db4dd75351141bd82aaf
SHA1 c61813816f2f9cf35ecf9bd3cc73c3b5a134e03a
SHA512 0c0e745d78809691382babc6b58b82583f0d13c0cc4cfce3f5b0eaba7af188fcc2bdcfd2b806540e2c64cb80e3e2862d832ffa22ef6b3224b536e83a4e1fb2df
SSDEEP 49152:e4k2IUSMtessQ5Mq6+kj5GXlEIQuMgcqf8D:oaessFP9Qw
TLSH
T180757C61E6436026EA730077F5F97369582C6F70072868D363D8BA6D6B31DD1BE32A43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

File Explorer

2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

.exe 1.5MB

2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

IMPHASH bc950b49cba037dad3e104170dce8c95
SHA256 5b1cfac1d9ec08098aebf806dc0462c0cef1e50b147254e162607f631cde0239
MD5 0183bd7ff973db4dd75351141bd82aaf
SHA1 c61813816f2f9cf35ecf9bd3cc73c3b5a134e03a
SHA512 0c0e745d78809691382babc6b58b82583f0d13c0cc4cfce3f5b0eaba7af188fcc2bdcfd2b806540e2c64cb80e3e2862d832ffa22ef6b3224b536e83a4e1fb2df
SSDEEP 49152:e4k2IUSMtessQ5Mq6+kj5GXlEIQuMgcqf8D:oaessFP9Qw
TLSH
T180757C61E6436026EA730077F5F97369582C6F70072868D363D8BA6D6B31DD1BE32A43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8f:75:8a:04:ba:04:91:49:95:72:76:c5:32:b0:b2:8a:60:4f:90:9d:45:13:6a:da:69:43:b2:80:c9:ca:7e:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Chains

Feb 8, 2025

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

e9:3a:4f:00:a2:96:79:1d:32:1e:36:d2:98:2d:9f:42:35:7a:d5:88

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Chains

Feb 8, 2025

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Serial Number

07:32:e2:a9:4e:3f:6f:85:a2:6d:b0:9c:a0:3f:c4:8f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 22, 2024

Timespan

Oct 22, 2024 - Oct 21, 2025

Minor OS version

Major OS version

Entry point

674622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP MultiByteToWideChar WriteFile SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryW GetFileAttributesW LocalFree OpenProcess GetCurrentProcessId MulDiv GetVersionExW GlobalAlloc GetModuleHandleA GetLocalTime lstrcmpiW lstrcpynW InterlockedIncrement InterlockedDecrement lstrcpyW LocalAlloc GetCurrentProcess TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose CloseHandle FindNextFileW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead Sleep SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetCurrentThread GetThreadTimes ExitProcess LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind GetModuleHandleExW GetStdHandle GetStringTypeW GetFileType GetConsoleMode ReadConsoleW SetFilePointerEx LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleCP WriteConsoleW ReadFile GetFileSize GlobalUnlock GlobalLock WideCharToMultiByte FormatMessageW GetModuleHandleW GetTickCount CreateFileW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW SetLastError QueryPerformanceCounter GetCurrentThreadId TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent GetCurrentDirectoryW FreeLibraryAndExitThread lstrlenW DeleteCriticalSection GetProcessHeap HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetCommandLineW FreeLibrary GetProcAddress LoadLibraryW GetModuleFileNameW FreeResource LockResource SizeofResource LoadResource FindResourceW

user32

InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW UpdateLayeredWindow InflateRect SetCursor MessageBoxW SetWindowRgn LoadCursorW GetPropW SetPropW GetSystemMetrics EnableWindow ShowWindow GetClassInfoExW RegisterClassW CallWindowProcW DefWindowProcW wsprintfW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent SetWindowLongW GetWindowLongW PtInRect IsRectEmpty OffsetRect UnionRect IntersectRect DrawTextA MapWindowPoints ScreenToClient GetCursorPos GetClientRect InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC KillTimer SetTimer ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CharNextW IsZoomed IsIconic IsWindowVisible SetWindowPos CreateWindowExW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW FindWindowW IsWindow wsprintfA GetWindowTextLengthW GetWindowRect MoveWindow DestroyWindow PostQuitMessage CreateAcceleratorTableW GetWindowTextW SetWindowTextW EqualRect DrawIconEx DestroyIcon PrivateExtractIconsW UpdateWindow ClientToScreen IsWindowEnabled GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu SetRect FillRect DrawTextW CharPrevW MonitorFromPoint GetWindowRgn GetSysColor RegisterClassExW

advapi32

RegQueryValueExW RegCloseKey GetUserNameW OpenProcessToken GetTokenInformation LookupAccountSidW RegOpenKeyExW RegSetValueExW

shell32

CommandLineToArgvW SHGetFileInfoW DragQueryFileW SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW

ole32

CoInitializeEx CoUninitialize CoCreateInstance DoDragDrop OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

shlwapi

PathRemoveFileSpecW PathIsDirectoryW PathAddBackslashW PathFileExistsW PathStripToRootW

ws2_32

gethostname gethostbyname WSAStartup

gdi32

CreateSolidBrush CreateCompatibleBitmap CreateRectRgnIndirect CreateFontIndirectW GetClipBox GetCharABCWidthsW CreateDIBitmap GetTextExtentPoint32W CreateCompatibleDC CreatePen CreatePenIndirect DeleteObject GetDeviceCaps CombineRgn CreateDIBSection PtInRegion CreateRectRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile LineTo SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor GetObjectA MoveToEx TextOutW GdiFlush CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits SelectObject SaveDC GetStockObject RestoreDC Rectangle RemoveFontMemResourceEx DeleteDC BitBlt AddFontMemResourceEx

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

gdiplus

GdipDrawImageI GdipDrawLine GdipGetImageGraphicsContext GdipSetPenEndCap GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipCreatePath GdipDeletePath GdipAddPathLine ord1 GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipReleaseDC GdipSetSmoothingMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetWorldTransform GdipResetWorldTransform GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawImageRectRect GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawImageRectI GdipTranslateWorldTransform GdipRotateWorldTransform GdipCreatePen2 GdipSetPenStartCap

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_0183bd7ff973db4dd75351141bd82aaf_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

gdi32

comctl32

gdiplus

imm32

generic