2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 866KB
Sample260703-rnalmsay4v
SHA256 2f02df8a4a23c9b009facd6d54a7fdae0cf02ad553b9f0c08c3aab785852252a
MD5 4c5c3504f4e49c6f826c3ee62ac1614c
SHA1 96fa1c9fedaa99fb7b2d8e02b67fbb1fbe80657a
SHA512 b0318f72ef975ae8b10fbad9ed5178dc502648ea51efbd025a3f726ea4a9e192e958e8a9b70f9d4c67ae136f3434c5455bb4714565ce3fc90dea553574eaffab
SSDEEP 24576:7XA97tivrR4KtGrE+FBgEOk1ZktDORCi9L9d7v:7XA9W7tG7FdOC0DOHLv
TLSH
T1CE159E32BB81C432E1A200359578677A5BBCB930072656D7E3E5067D2FB82C27E3576B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 866KB

2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 6954ef7a4d6945ffb9e11146d404ffa3
SHA256 2f02df8a4a23c9b009facd6d54a7fdae0cf02ad553b9f0c08c3aab785852252a
MD5 4c5c3504f4e49c6f826c3ee62ac1614c
SHA1 96fa1c9fedaa99fb7b2d8e02b67fbb1fbe80657a
SHA512 b0318f72ef975ae8b10fbad9ed5178dc502648ea51efbd025a3f726ea4a9e192e958e8a9b70f9d4c67ae136f3434c5455bb4714565ce3fc90dea553574eaffab
SSDEEP 24576:7XA97tivrR4KtGrE+FBgEOk1ZktDORCi9L9d7v:7XA9W7tG7FdOC0DOHLv
TLSH
T1CE159E32BB81C432E1A200359578677A5BBCB930072656D7E3E5067D2FB82C27E3576B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\svn\YaSuo\ChengXu\Tags\pdtag_1.4.8.20515\Bundles\PuddingZip\Temp\Release\SvcHost.pdb

kernel32

GetFullPathNameW GetCurrentDirectoryW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError ReleaseMutex CreateMutexW DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount GetFileSize ReadFile FormatMessageW CreateFileW MultiByteToWideChar WideCharToMultiByte FileTimeToSystemTime GetSystemDirectoryW GetVolumeInformationW GetSystemInfo GetVersionExW FindClose GetTempPathW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW GlobalAlloc GlobalFree OpenProcess GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW lstrcpyW GetTickCount WriteFile GetFileAttributesW CopyFileW GetWindowsDirectoryW VirtualProtect LoadLibraryW GetLocalTime GetCommandLineW DeviceIoControl OutputDebugStringA SetPriorityClass OutputDebugStringW VirtualAlloc VirtualFree SetLastError GetNativeSystemInfo LoadLibraryA IsBadReadPtr GetTempFileNameW RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WaitForSingleObjectEx SetStdHandle GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation FlushFileBuffers WriteConsoleW SetEndOfFile SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread ExpandEnvironmentStringsW PeekNamedPipe WaitForMultipleObjects GetSystemDirectoryA SleepEx GetProcAddress FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW CreateEventW CloseHandle Sleep WaitForSingleObject SetEvent GetExitCodeThread TerminateThread CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent SetErrorMode InitializeCriticalSection

shell32

SHGetSpecialFolderPathW SHGetFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

user32

wsprintfW

advapi32

RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyW RegCreateKeyExW RegCloseKey DuplicateTokenEx OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor ImpersonateLoggedOnUser RevertToSelf

ole32

CoCreateInstance CoUninitialize CoInitialize

iphlpapi

GetAdaptersInfo

wininet

InternetSetOptionW HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetReadFile InternetOpenW

urlmon

URLDownloadToFileW

ws2_32

gethostname ioctlsocket listen accept sendto recvfrom WSAStartup WSACleanup closesocket socket WSAGetLastError recv send bind connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError htonl inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname __WSAFDIsSet select

Name

.text

Size

583KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

25KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

99KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=261, version=23013,

count=17, id=241, version=40116,

count=191, id=243, version=40116,

count=30, id=242, version=40116,

count=8, id=265, version=24210,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=79, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=199, version=41118,

count=25, id=259, version=24123,

count=62, id=261, version=24123,

count=36, id=260, version=24123,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=249, id=1, productName=Unmarked objects,

count=49, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,