2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader
Size 9.2MB
Sample260712-tegdyaew9x
SHA256 5beae8224f716da425ec9fe41d1b494850063f56fa0f2abde3d12c5c802defc9
MD5 d85041261197a72bdd7721a659d12a49
SHA1 8b1fc203b5794feb77902441bb462cd5038dd4e8
SHA512 ee67ceefbe962832e1af6f602265d683e8e1d832b82075aa0b2a993eff409b8ee5a411c82a9a6e7554cf16beca6d4bba337f49f06cdbff2c5c3fc5a3c43b7dcc
SSDEEP 196608:LaZseskDFIE8fGu0zkisj7Dks+Afv8xxKlx:LpesQ8fGuLzws+yvFv
TLSH
T153A6E063B302C1B6D58201F1592A9BFE893CBD381B2154D3F3D43E69A9721D22636F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader

.exe 9.2MB

2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader

IMPHASH b9f7cabde6a2110c9e3f0c432898e112
SHA256 5beae8224f716da425ec9fe41d1b494850063f56fa0f2abde3d12c5c802defc9
MD5 d85041261197a72bdd7721a659d12a49
SHA1 8b1fc203b5794feb77902441bb462cd5038dd4e8
SHA512 ee67ceefbe962832e1af6f602265d683e8e1d832b82075aa0b2a993eff409b8ee5a411c82a9a6e7554cf16beca6d4bba337f49f06cdbff2c5c3fc5a3c43b7dcc
SSDEEP 196608:LaZseskDFIE8fGu0zkisj7Dks+Afv8xxKlx:LpesQ8fGuLzws+yvFv
TLSH
T153A6E063B302C1B6D58201F1592A9BFE893CBD381B2154D3F3D43E69A9721D22636F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:71:f2:94:5a:48:1b:60:dc:65:ab:31:03:b7:5e:6e:93:78:54:cb:1f:cb:e5:d4:d9:1f:42:b5:96:e0:29:19

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1417258-2,CN=PC Helpsoft (7270356 Canada Inc),O=PC Helpsoft (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 6, 2026

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

Serial Number

a1:06:4f:64:0e:bb:2e:45:6a:a1:3a:40:4c:a3:dd:29

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2026

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1973009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\TemporaryBuilds\azure-adaware-pool-build-de-1\19\s\_build\bin\x86\Release\installer.pdb

wininet

InternetCanonicalizeUrlW

shell32

ShellExecuteExW SHGetFolderPathW

kernel32

GetCurrentProcess GetComputerNameW DecodePointer GetSystemInfo GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW SetEvent CreateEventA LocalFree FormatMessageW FormatMessageA LeaveCriticalSection Sleep AllocConsole SleepEx GetEnvironmentVariableA WaitForMultipleObjects EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionEx WaitForSingleObject CloseHandle CreateMutexW LCMapStringA LoadLibraryA GetStringTypeExA HeapQueryInformation TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA DeleteFileA HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize SystemTimeToFileTime GetSystemTime CreateFileMappingW MapViewOfFile WaitForSingleObjectEx IsDBCSLeadByteEx IsValidCodePage GetLocaleInfoA EnumSystemLocalesA FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW ReleaseSemaphore OpenEventA ResetEvent WaitForMultipleObjectsEx GetProcessHeap HeapAlloc HeapFree QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleA CreateWaitableTimerA WriteConsoleW CreateFileW DeleteFileW FindFirstFileW GetUserDefaultLCID GetFileAttributesExW SetFileAttributesW GetTickCount GetFileSizeEx GetFileType GetFileTime ReadFile SetFilePointerEx FileTimeToSystemTime GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW RaiseException InitOnceComplete InitOnceBeginInitialize FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent ReleaseSRWLockShared AcquireSRWLockShared SetLastError LoadLibraryExW GetSystemTimeAsFileTime VerifyVersionInfoW EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount ExitProcess GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers ReadConsoleW HeapReAlloc GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetEndOfFile CreateSemaphoreA DuplicateHandle GetStringTypeExW ProcessIdToSessionId GlobalFree CreateJobObjectW CreateIoCompletionPort SetInformationJobObject AssignProcessToJobObject GetQueuedCompletionStatus GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess GetCommandLineW MoveFileExW OutputDebugStringA OutputDebugStringW SizeofResource LockResource LoadResource FindResourceW SetUnhandledExceptionFilter GetLastError GetCurrentThreadId GetConsoleMode GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetFileAttributesW

user32

PostMessageW LoadStringA SetWindowTextW SendMessageW LoadIconW MessageBoxW LoadStringW

advapi32

QueryServiceStatusEx GetUserNameW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegOpenUserClassesRoot OpenThreadToken RegOpenCurrentUser RegEnumValueW RegQueryInfoKeyW DeleteService OpenServiceW OpenSCManagerW CloseServiceHandle RegDeleteTreeW RegDeleteValueW RegGetValueW LookupAccountSidW ConvertStringSidToSidW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation ImpersonateLoggedOnUser RevertToSelf OpenProcessToken RegQueryValueExW

ole32

CoInitializeSecurity CoCreateInstance CoInitializeEx CoUninitialize CoSetProxyBlanket

oleaut32

VariantCopy VariantClear SysAllocString SysStringLen SysFreeString VariantTimeToSystemTime SysAllocStringLen VariantInit

shlwapi

SHDeleteKeyW

msi

ord190 ord205 ord118 ord141 ord115 ord70 ord281 ord116

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2

ntdll

VerSetConditionMask

ws2_32

freeaddrinfo ioctlsocket recvfrom sendto listen htonl gethostname getaddrinfo WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent select WSASetLastError setsockopt send recv getsockopt getsockname getpeername connect bind accept socket htons closesocket WSAGetLastError __WSAFDIsSet WSACleanup WSAStartup ntohs WSAWaitForMultipleEvents WSAIoctl

crypt32

CertGetCertificateChain CertOpenStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryW PFXImportCertStore

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

151KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_d85041261197a72bdd7721a659d12a49_akira_amadey_blankgrabber_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_smoke-loader

PE Signature issue

wininet

shell32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

msi

winhttp

bcrypt

ntdll

ws2_32

crypt32

iphlpapi

secur32

wtsapi32

generic