2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

General

Target
2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader
Size 19.2MB
Sample260629-n68plset7l
SHA256 8f078d41f1a94a420da647c7b959a4a61d63bc8caf8e3747aecf2d48955989d1
MD5 d4540be41b93026fbe909d0897507f8c
SHA1 135f79e142ef912272e6861f164b74cc193ccc4e
SHA512 3224b2df3aa8d30a9998e7f838a87a71216645aef36878f88d09af742177bdec52c5535ec6672fda958896749e48c1b595cb3279256ad22cbff2346366786be6
SSDEEP 393216:mOp4q1ae6/CksST3fTQW6OKEIrqNp/8ZF9kvEBP0d:mOJ1mRvMOKEaZF9kvEBY
TLSH
T12417CF41FAC240F9C45F05B0751EF33FDB39AE244738C6A3E7E82E19ADB13A0596A516
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

File Explorer

2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

.exe 19.2MB

2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

SHA256 8f078d41f1a94a420da647c7b959a4a61d63bc8caf8e3747aecf2d48955989d1
MD5 d4540be41b93026fbe909d0897507f8c
SHA1 135f79e142ef912272e6861f164b74cc193ccc4e
SHA512 3224b2df3aa8d30a9998e7f838a87a71216645aef36878f88d09af742177bdec52c5535ec6672fda958896749e48c1b595cb3279256ad22cbff2346366786be6
SSDEEP 393216:mOp4q1ae6/CksST3fTQW6OKEIrqNp/8ZF9kvEBP0d:mOJ1mRvMOKEaZF9kvEBY
TLSH
T12417CF41FAC240F9C45F05B0751EF33FDB39AE244738C6A3E7E82E19ADB13A0596A516
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8561071

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.3MB

Virtual Size

10.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_d4540be41b93026fbe909d0897507f8c_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

generic