2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat
Size 675KB
Sample260714-dnswbsft4v
SHA256 b7ce2762b0a63356465439781c4751f0ee0f87405a027acacf337c0ce2f63644
MD5 bbdc5e13fd8a2096820e843b506c5a0d
SHA1 89a2f6aa45503af2d678fc70cb498285c609206c
SHA512 868f3b485611f42ec222001d2ff6f23e53374ee71a3ce8a001cdd521b653d992c52633d52fe9557514021d8dd4f77c9e83d73bb951467bdf0ab17a9bd03546b9
SSDEEP 12288:4L464Xb+zNs+dxTz4v/MRjjeJvF/piQx5T3VDX0zB27/mwiKpW5tOTp9B64gLJVU:4LoANsNF/p5lDXRiV5ti4JVU
TLSH
T1F1E4AE617642807ED63311B044E987B65A3FBCB10B617EC3ABD43E6948301E17F76A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat

File Explorer

2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat

.exe 675KB

2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat

IMPHASH e0b0c8b210473e8ef036e46b9921c3e7
SHA256 b7ce2762b0a63356465439781c4751f0ee0f87405a027acacf337c0ce2f63644
MD5 bbdc5e13fd8a2096820e843b506c5a0d
SHA1 89a2f6aa45503af2d678fc70cb498285c609206c
SHA512 868f3b485611f42ec222001d2ff6f23e53374ee71a3ce8a001cdd521b653d992c52633d52fe9557514021d8dd4f77c9e83d73bb951467bdf0ab17a9bd03546b9
SSDEEP 12288:4L464Xb+zNs+dxTz4v/MRjjeJvF/piQx5T3VDX0zB27/mwiKpW5tOTp9B64gLJVU:4LoANsNF/p5lDXRiV5ti4JVU
TLSH
T1F1E4AE617642807ED63311B044E987B65A3FBCB10B617EC3ABD43E6948301E17F76A6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7c:d7:86:7c:68:8d:d5:5e:d4:81:21:f3:44:a4:cf:ba:71:a5:b0:5f:64:ba:c7:ff:60:07:ac:0c:31:ff:52:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=16325089,CN=Changing Information Technology Inc.,O=Changing Information Technology Inc.,STREET=2 F.\, No. 48\, Yuanqu 2nd Rd.\, Baoshan Township,L=Hsinchu,ST=Taiwan,C=TW,1.2.840.113549.1.9.1=#0c13677577406368616e67696e677465632e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 10, 2026

PE Signature issue

Digest

e6:43:6c:c1:9e:20:7a:15:0d:d1:3e:b1:05:96:80:4d:7b:c6:c8:58

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

Chains

Jun 10, 2026

Subject

Serial Number

68:6b:02:93:27:86:2d:c4:9c:0c:40:4f

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 18, 2024 - Sep 2, 2027

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

303152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Git\Product\ServiSign\CGServiSign\Release\OriginalServiSign.pdb

ws2_32

shutdown closesocket WSAGetLastError ntohs htonl recv send setsockopt WSAPoll getsockname WSAStartup listen select bind accept __WSAFDIsSet WSACleanup WSASend ioctlsocket connect socket WSASocketW WSASetLastError htons

libgnutls-30

ord170 ord77 ord598 ord655 ord204 ord72 ord94 ord188 ord726 ord308 ord126 ord723 ord649 ord718 ord150 ord861 ord758 ord113 ord258 ord829 ord69 ord125 ord54 ord593 ord714 ord259 ord114 ord767 ord133 ord195 ord661 ord201 ord272 ord322 ord93 ord652 ord589

kernel32

GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ReadConsoleW GetConsoleMode GetStdHandle ExitProcess GetFileType SetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RtlUnwind GetStringTypeW GetCPInfo CompareStringEx GetCurrentProcess WaitForSingleObject CreateFileW GetCurrentThreadId MultiByteToWideChar GetLastError GetProcAddress GetCurrentProcessId FreeLibrary IsWow64Process LoadLibraryExW QueryPerformanceFrequency LoadLibraryW QueryPerformanceCounter Sleep ReadFile EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection CloseHandle SetHandleInformation VirtualFree VirtualAlloc GetSystemInfo GetTickCount64 RaiseException GetStartupInfoW TerminateProcess GetModuleFileNameW GetTempPathW CreateMutexW LocalAlloc GetFileAttributesW GetCommandLineA UnmapViewOfFile CreateToolhelp32Snapshot Process32NextW DeleteFileW Process32FirstW GetWindowsDirectoryW LocalFree CreateProcessW GetModuleHandleW WideCharToMultiByte GetExitCodeProcess OpenEventW GetVersionExW GetSystemDirectoryW GetNativeSystemInfo WriteFile GetFileInformationByHandle CreateDirectoryW ExpandEnvironmentStringsA CreateMutexA OpenMutexA GetWindowsDirectoryA GetSystemTime InitializeCriticalSectionEx LCMapStringEx GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle DecodePointer GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW EncodePointer FindClose GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive SetEndOfFile ReleaseMutex WriteConsoleW ReleaseSRWLockExclusive

user32

DestroyWindow CreateWindowExW SendMessageW UnregisterClassW IsWindow DispatchMessageW SetTimer GetMessageW TranslateMessage FindWindowW KillTimer GetWindowThreadProcessId IsWindowVisible SetWindowPos EnumWindows GetWindowTextW wsprintfW GetSystemMetrics RegisterClassW DefWindowProcW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid SetEntriesInAclW AllocateAndInitializeSid GetUserNameW

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

oleaut32

SysAllocString SysStringLen SysAllocStringLen SysFreeString SysAllocStringByteLen

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

476KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_bbdc5e13fd8a2096820e843b506c5a0d_amadey_cobalt-strike_darkgate_elex_glassworm_helldown_luca-stealer_njrat

PE Signature issue

PE Signature issue

ws2_32

libgnutls-30

kernel32

user32

advapi32

shell32

ole32

oleaut32

wtsapi32

version

generic