2026-07-15_1fe0500e997c5dc98270e924cf242e5a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_1fe0500e997c5dc98270e924cf242e5a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
Size 12.6MB
Sample260715-j98fssaz3x
SHA256 c4e056917a4d8de7126f8b7e82f77c6676a1427e20efb8472096d5b17bc7941c
MD5 1fe0500e997c5dc98270e924cf242e5a
SHA1 0c289c6208a8fe25369636d628abad9edd37c144
SHA512 eebb998a9254410f8031429a8ad1094426e9880dd351a601fcd56cf6e35ad5850fab29d2e43ca594b6a6621c1d3710a68a7213fbe8a6823669229a2cfa3fc1c4
SSDEEP 196608:M3lC5YMt/ozSq6+HJwCgd1bV0n6RA7/IPwZX:MUesdD0VLAk
TLSH
T114D68C20A600D131E9A10170DEED5AB6873A7D1917F782E371863CEDEA71BD1BDB1287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_1fe0500e997c5dc98270e924cf242e5a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-15_1fe0500e997c5dc98270e924cf242e5a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

.exe 12.6MB

2026-07-15_1fe0500e997c5dc98270e924cf242e5a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 3b38ec2308cdca1fb52edb564ef2e38a
SHA256 c4e056917a4d8de7126f8b7e82f77c6676a1427e20efb8472096d5b17bc7941c
MD5 1fe0500e997c5dc98270e924cf242e5a
SHA1 0c289c6208a8fe25369636d628abad9edd37c144
SHA512 eebb998a9254410f8031429a8ad1094426e9880dd351a601fcd56cf6e35ad5850fab29d2e43ca594b6a6621c1d3710a68a7213fbe8a6823669229a2cfa3fc1c4
SSDEEP 196608:M3lC5YMt/ozSq6+HJwCgd1bV0n6RA7/IPwZX:MUesdD0VLAk
TLSH
T114D68C20A600D131E9A10170DEED5AB6873A7D1917F782E371863CEDEA71BD1BDB1287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3759344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ener6\Desktop\backup mondial 07.02.2026\Mondial2 255\Mondial2 255\client\Mondial2_x86_Release.pdb

kernel32

QueryPerformanceCounter Sleep OpenProcess WaitForSingleObject InitializeCriticalSection LeaveCriticalSection SetThreadPriority EnterCriticalSection GetCurrentProcessId ReadProcessMemory GetLastError CreateToolhelp32Snapshot Module32First Module32Next GetCurrentProcess GetTickCount GetCurrentDirectoryW WideCharToMultiByte WriteConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW GetTimeZoneInformation UnlockFileEx LockFileEx HeapCompact lstrlenW FlushFileBuffers VirtualQuery FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetStdHandle ExitProcess GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ReleaseSemaphore LoadLibraryExW InitializeCriticalSectionAndSpinCount RaiseException InterlockedPushEntrySList RtlUnwind GlobalLock GlobalUnlock GetVersionExA GetSystemDirectoryA GetModuleHandleA SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetDynamicTimeZoneInformation GetCurrentThreadId GetFileAttributesA GetStdHandle GetSystemTimeAsFileTime SetFilePointerEx GetFileSizeEx CreateFileW WriteFile SetFilePointer ReadFile MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryA GetProcessHeap HeapAlloc HeapFree GetThreadLocale IsBadReadPtr lstrlenA VirtualFree VirtualProtect VirtualAlloc CreateSemaphoreW FlushViewOfFile ExpandEnvironmentStringsW ResetEvent SetConsoleCtrlHandler GetACP GetExitCodeProcess GenerateConsoleCtrlEvent GetProcessTimes MoveFileW GetSystemTime GetFileType CreateProcessA SystemTimeToFileTime SetEnvironmentVariableA DeleteFileW SetCurrentDirectoryA GetVersion DuplicateHandle GetCurrentDirectoryA CreatePipe GetLocaleInfoA ExitThread CompareStringA OutputDebugStringA CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize GetModuleFileNameA RemoveDirectoryA DeleteFileA GlobalFree CreateProcessW SetEnvironmentVariableW RemoveDirectoryW GetFileAttributesExA MoveFileA LoadLibraryExA SetEndOfFile GetFullPathNameA IsDBCSLeadByte OutputDebugStringW GetConsoleCP GetConsoleOutputCP SetLastError ResumeThread GetModuleHandleExA SetErrorMode GetProcessAffinityMask GetCurrentThread lstrcmpA GetEnvironmentVariableA TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameW WaitNamedPipeW PeekNamedPipe TerminateProcess GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent HeapValidate GetCPInfo GetStringTypeW GetTickCount64 LCMapStringEx CreateThread CreateDirectoryA AddVectoredExceptionHandler LoadLibraryW RemoveVectoredExceptionHandler GetLocalTime FindClose FindNextFileA FindFirstFileA SetFileAttributesA CreateEventA DeleteCriticalSection GetSystemInfo GlobalAlloc DecodePointer EncodePointer InitializeCriticalSectionEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency GetModuleHandleW GetTempPathW SetFileTime SetFileAttributesW GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW SetCurrentDirectoryW LocalFree TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx FormatMessageA CloseHandle CreateFileA SetEvent DeviceIoControl

user32

LoadIconA SystemParametersInfoA PostQuitMessage FindWindowA GetCursorPos GetDC SendMessageA ReleaseDC InvalidateRect SetRect PeekMessageA GetClientRect ClientToScreen GetAsyncKeyState ScreenToClient CharPrevExA SetWindowPos CharPrevA GetKeyState ShowCursor SetCursor DestroyCursor LoadImageA SetCursorPos ReleaseCapture SetCapture ChangeDisplaySettingsA GetCapture ShowWindow FlashWindowEx GetSystemMetrics IsIconic DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA IsWindow DestroyWindow MoveWindow CharNextExA CharNextW GetClipboardData CloseClipboard SetFocus UpdateWindow GetWindowLongA SetWindowLongA MessageBoxA RegisterClassA GetMenu GetWindowRect AdjustWindowRectEx LoadCursorA GetMessageA TranslateMessage DispatchMessageA GetKeyboardLayoutNameA GetKeyboardLayout OpenClipboard

gdi32

CreateDIBSection DeleteObject GetStockObject EnumFontFamiliesExA CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode SetTextColor TextOutW GetTextExtentPoint32W GetCharABCWidthsFloatW CreateFontIndirectA TextOutA GetTextExtentPoint32A

advapi32

RegCloseKey RegSetValueA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegOpenKeyExA RegFlushKey RegOpenKeyExW RegQueryValueExW RegOpenKeyA RegSetValueExW RegCreateKeyExW CryptReleaseContext RegEnumKeyExA RegSaveKeyA RegConnectRegistryA RegDeleteValueA RegEnumValueA RegQueryInfoKeyA RegLoadKeyA RegQueryValueA RegCreateKeyA

shell32

SHGetSpecialFolderPathA ShellExecuteW ShellExecuteA

ole32

CoGetClassObject CoInitialize OleUninitialize OleSetContainedObject CoInitializeEx OleInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

winmm

timeEndPeriod timeGetDevCaps timeGetTime timeBeginPeriod

d3d8

Direct3DCreate8

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

imm32

ImmIsIME ImmGetContext ImmReleaseContext ImmAssociateContext ImmGetCompositionStringW ImmGetIMEFileNameA ImmGetCandidateListW ImmGetConversionStatus ImmSetConversionStatus ImmGetOpenStatus ImmNotifyIME ImmSetCompositionStringW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

granny2

_GrannySetControlEaseOutCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyGetControlLocalDuration@4 _GrannySetControlSpeed@8 _GrannyGetControlSpeed@4 _GrannySetControlLoopCount@8 _GrannyGetControlLoopCount@4 _GrannyPlayControlledAnimation@12 _GrannyControlIsComplete@4 _GrannyCompleteControlAt@8 _GrannyFreeControlOnceUnused@4 _GrannyFreeControl@4 _GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetControlRawLocalClock@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannySetControlRawLocalClock@8 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyFreeMeshDeformer@4 _GrannyFreeControlIfComplete@4

devil

ilInit ilSave ilSetPixels ilTexImage ilGenImages ilLoad ilCopyPixels ilGetInteger ilBindImage ilShutDown ilOriginFunc ilConvertImage ilDeleteImages ilEnable

mss32

_AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_shutdown@0 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_set_redist_directory@4 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_close_digital_driver@4 _AIL_open_stream@12 _AIL_open_digital_driver@16 _AIL_file_type@8 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_file_read@8 _AIL_mem_free_lock@4 _AIL_release_sample_handle@4 _AIL_resume_3D_sample@4 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_auto_update_3D_position@8 _AIL_3D_sample_volume@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_set_file_callbacks@16 _AIL_allocate_sample_handle@4

speedtreert

?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z

dinput8

DirectInput8Create

ws2_32

WSAGetLastError select recv ioctlsocket __WSAFDIsSet WSACleanup WSAStartup inet_addr setsockopt send socket connect htons gethostbyname closesocket

libconfig++

?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ ??0Config@libconfig@@QAE@XZ ?getPath@SettingException@libconfig@@QBEPBDXZ ?getLength@Setting@libconfig@@QBEHXZ ?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z ?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z ?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z ?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??ASetting@libconfig@@QBEAAV01@PBD@Z ??ASetting@libconfig@@QBEAAV01@H@Z ??4Setting@libconfig@@QAEAAV01@AB_J@Z ??4Setting@libconfig@@QAEAAV01@PBD@Z ??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?writeFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?readFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?add@Setting@libconfig@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Type@12@@Z ??1Config@libconfig@@UAE@XZ

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6.4MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=34435,

count=25, id=260, version=34435,

count=65, id=259, version=30795,

count=253, id=261, version=30795,

count=6, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=261, version=35219,

count=1, id=260, version=35219,

count=2, id=257, version=31329,

count=2, id=262, version=30795,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=50, id=260, version=31329,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=37, id=261, version=31329,

count=1, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=17, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=21, id=253, version=34321,

count=38, id=259, version=34321,

count=21, id=260, version=34321,

count=1, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=52, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=101, id=261, version=34321,

count=50, id=260, version=30795,

count=29, id=257, version=30795,

count=569, id=1, productName=Unmarked objects,

count=214, id=261, version=34809,

count=1, id=260, version=34809,

count=281, id=265, version=34809,

count=1, id=256, version=34809,

count=1, id=255, version=34809,

count=1, id=151,

count=1, id=258, version=34809,