2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 4.2MB
Sample260629-th2jaaaz2r
SHA256 72710d3ac19f28bf7eb1fb0b36e54b41dd0e24a0ed52cfa8c5f049844a1ce257
MD5 51a6ed081112c7e3298b8d0e52f5dafb
SHA1 5d7e618ef84a130311bdb76b579f5b77d3b16bbd
SHA512 f2062850f81e56349bfc65d4cecff8641e53679798c94122c0857c3da7ff3af59fad08c2c6e7ed4a4bd8bfcfe28c37091fef475d82e8494f42038b21fd6168af
SSDEEP 49152:DUT+1/kSkLSduCByhELdZh0/qLs29AEN8aJnr01gdbvXuM6uaaQTkM4O8b8ITDnz:A+1EIlZ1N8aRA1glJ
TLSH
T1B626A11226D1DFE5C05F61B0EC29B6F8162B9D20DF220FCB6E407F6935B16916931A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 4.2MB

2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 793d260c3fe240fe40642c90acfa874d
SHA256 72710d3ac19f28bf7eb1fb0b36e54b41dd0e24a0ed52cfa8c5f049844a1ce257
MD5 51a6ed081112c7e3298b8d0e52f5dafb
SHA1 5d7e618ef84a130311bdb76b579f5b77d3b16bbd
SHA512 f2062850f81e56349bfc65d4cecff8641e53679798c94122c0857c3da7ff3af59fad08c2c6e7ed4a4bd8bfcfe28c37091fef475d82e8494f42038b21fd6168af
SSDEEP 49152:DUT+1/kSkLSduCByhELdZh0/qLs29AEN8aJnr01gdbvXuM6uaaQTkM4O8b8ITDnz:A+1EIlZ1N8aRA1glJ
TLSH
T1B626A11226D1DFE5C05F61B0EC29B6F8162B9D20DF220FCB6E407F6935B16916931A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

cb:89:0f:d7:83:5b:79:a0:49:19:a0:18:1b:e0:85:72:f7:0c:87:fe:db:39:41:ac:c7:b6:b5:65:be:d1:e5:7a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 8, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:84:8e:a3:9b:36:d7:bb:53:3c:f4:3d:96:d6:e1:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2026208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\AcroRd32Exe.pdb

kernel32

LoadResource SizeofResource FindResourceW LoadLibraryA SetDllDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW QueryDosDeviceW lstrcmpA lstrcmpW CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetSystemPowerStatus CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA FindResourceExW LockResource SetErrorMode QueryPerformanceCounter HeapSetInformation WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv IsProcessorFeaturePresent LoadLibraryExW UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetExitCodeProcess InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy RaiseException DecodePointer GetLongPathNameW GetCurrentDirectoryW SetCurrentDirectoryW GetTickCount OpenMutexW GetVolumeInformationW CreateThread CreateEventW CreateMutexW ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType GetStartupInfoW lstrlenW GetCurrentProcess GetTempPathW CreateFileW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask MultiByteToWideChar WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwind VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx FormatMessageW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc DebugBreak IsDebuggerPresent GetModuleHandleExW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW GetVersionExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryFullProcessImageNameW GlobalHandle GlobalSize GetComputerNameExW OpenEventW CreateDirectoryExW CompareFileTime GetFileTime GetFullPathNameW GetExitCodeThread GetTempFileNameW GetModuleHandleExA InitializeCriticalSectionAndSpinCount GetStdHandle ExitThread SearchPathW VirtualFree CreateJobObjectW CreateRemoteThread SignalObjectAndWait VirtualProtect VirtualQuery GetProcessId TerminateProcess DuplicateHandle GetProcessTimes ExpandEnvironmentStringsW ProcessIdToSessionId IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryThreadCycleTime GetThreadPriority UnregisterWaitEx RegisterWaitForSingleObject GetUserDefaultLangID GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA SetEnvironmentVariableW GetEnvironmentVariableW GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetProfileStringW ReadProcessMemory CreateIoCompletionPort TerminateJobObject GetQueuedCompletionStatus UnregisterWait PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation SetProcessDEPPolicy AssignProcessToJobObject

user32

CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW PostMessageW LoadIconW SetProcessWindowStation ReleaseDC GetDC MsgWaitForMultipleObjects RegisterClipboardFormatW PeekMessageW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongW ShowWindow SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA KillTimer SetTimer DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA GetThreadDesktop PostThreadMessageW IsWindowEnabled CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows EnableWindow GetRawInputDeviceInfoW SetActiveWindow PtInRect SetCursorPos CreateIconFromResourceEx GetWindowTextLengthW RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction GetProcessWindowStation SendDlgItemMessageW CloseWindow LoadCursorW GetClipboardData OpenClipboard CloseClipboard IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats EmptyClipboard SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer GetWindowDC GetMessageW SystemParametersInfoW BeginPaint EndPaint ScreenToClient GetClientRect MapWindowPoints SetCursor IsChild IsDialogMessageW FillRect LoadBitmapW MapDialogRect SetWindowContextHelpId GetClassInfoExW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen MoveWindow SetCapture ReleaseCapture InvalidateRect InvalidateRgn SetFocus DestroyAcceleratorTable CreateDialogIndirectParamW UpdateWindow SetRect IsRectEmpty PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongW GetWindowTextW GetAncestor FindWindowW GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics keybd_event BringWindowToTop SetWindowPos WaitForInputIdle EnumDesktopWindows GetGUIThreadInfo SetWindowTextW AllowSetForegroundWindow GetForegroundWindow CharNextW EndDialog DialogBoxParamW UnregisterClassW GetWindowThreadProcessId FindWindowExW IsWindow SendMessageTimeoutW GetUserObjectInformationW GetPropA

advapi32

CryptGenKey RegGetValueW RegOpenKeyExA RegQueryValueA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW LookupPrivilegeValueW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CredFree CredReadW RegQueryValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CryptSetKeyParam CryptContextAddRef GetUserNameW ImpersonateAnonymousToken

shlwapi

UrlUnescapeW PathFindFileNameW PathRemoveFileSpecW PathIsURLW UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathFindExtensionA PathCombineW PathIsRelativeW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathIsUNCServerShareW ord219 PathFindExtensionW UrlCanonicalizeW PathCreateFromUrlW PathAddBackslashW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetCredentials WinHttpWriteData

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

624KB

Virtual Size

623KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_51a6ed081112c7e3298b8d0e52f5dafb_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

kernel32

user32

advapi32

shlwapi

version

winhttp

generic