2026-07-16_00f5f1108c09204e3104e45b2101f779_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_00f5f1108c09204e3104e45b2101f779_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat_remcos
Size 1.1MB
Sample260716-2e9pgsft4j
SHA256 7ee6de343ae8f3b2503bfbab3e3629421f444441b9aa78d429c467fdbde77b78
MD5 00f5f1108c09204e3104e45b2101f779
SHA1 cb9076f1cbcf17a48cb44c7de27fb3a373d6668f
SHA512 7be3b11a682962e32d22137d7990a5a1c44ea40d4eb14cb41b7eb9bc82dffc8509ee032e9974eafbe365a7c5ade4be06bf05b54e1d9fe194013d3aa6998dfe96
SSDEEP 24576:Moz43PXdQd7Yp8cSL+GZ7u16yBUnpP9PJp8L18slfSd:RPcMX7u1lGplPJp8L18sRSd
TLSH
T105358D203B92903ADEB1417009B8DF6B557DFA614F7258CB53C8076D5E609C21E3BAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-16_00f5f1108c09204e3104e45b2101f779_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat_remcos

.exe 1.1MB

2026-07-16_00f5f1108c09204e3104e45b2101f779_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat_remcos

IMPHASH 2009c34243c6cde4bb4364e7da98fb83
SHA256 7ee6de343ae8f3b2503bfbab3e3629421f444441b9aa78d429c467fdbde77b78
MD5 00f5f1108c09204e3104e45b2101f779
SHA1 cb9076f1cbcf17a48cb44c7de27fb3a373d6668f
SHA512 7be3b11a682962e32d22137d7990a5a1c44ea40d4eb14cb41b7eb9bc82dffc8509ee032e9974eafbe365a7c5ade4be06bf05b54e1d9fe194013d3aa6998dfe96
SSDEEP 24576:Moz43PXdQd7Yp8cSL+GZ7u16yBUnpP9PJp8L18slfSd:RPcMX7u1lGplPJp8L18sRSd
TLSH
T105358D203B92903ADEB1417009B8DF6B557DFA614F7258CB53C8076D5E609C21E3BAAF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

09:37:e7:af:67:a6:47:a9:18:69:0c:e6:34:73:84:f6:c3:a6:11:78:34:78:0c:51:58:f6:8c:3c:b4:ae:4a:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 13, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

09:37:e7:af:67:a6:47:a9:18:69:0c:e6:34:73:84:f6:c3:a6:11:78:34:78:0c:51:58:f6:8c:3c:b4:ae:4a:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=453 587 420,CN=SteelSeries France SASU,O=SteelSeries France SASU,L=Villeneuve-d'Ascq,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054c696c6c65,1.3.6.1.4.1.311.60.2.1.2=#130f48617574732d64652d4672616e6365,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Jun 14, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:00:b7:03:ba:6f:78:72:c1:5a:cb:a8:31:7e:2e:be

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2023 - Sep 25, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:25:f3:1c:b5:55:76:73:40:d6:00:00:00:00:01:25

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 20, 2025 - Feb 18, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:02:79:50:74:21:14:7d:b8:a1:00:01:00:00:02:02

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

226935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\fac0970a3d49f93d\Out\Release\Win32\NahimicSvc32.pdb

shlwapi

PathIsRelativeW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoActivateInstance

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CertFreeCertificateContext CryptQueryObject CryptMsgClose

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCurrentDirectoryW GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableA GetCommandLineW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleExW GetModuleHandleW FreeLibraryAndExitThread LoadLibraryExW GetModuleFileNameA FreeLibrary GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW OpenMutexW TryEnterCriticalSection OpenSemaphoreW InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx CreateMutexW WaitForSingleObject EnterCriticalSection CreateEventW WaitForSingleObjectEx ResetEvent ReleaseMutex CreateMutexExW DeleteCriticalSection ReleaseSemaphore SetEvent LeaveCriticalSection OpenEventW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException SetLastError GetLastError UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

ExitThread GetStartupInfoW GetCurrentThreadId TerminateThread CreateProcessW GetExitCodeProcess TerminateProcess ExitProcess GetPriorityClass SetPriorityClass GetCurrentProcessId GetExitCodeThread SwitchToThread GetCurrentThread ProcessIdToSessionId GetCurrentProcess SetThreadPriority GetThreadPriority OpenProcessToken TlsFree TlsSetValue TlsGetValue TlsAlloc

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetVersionExW GetLogicalProcessorInformation GetTickCount

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList InterlockedFlushSList InterlockedPushEntrySList InitializeSListHead QueryDepthSList

api-ms-win-core-com-l1-1-0

PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoInitializeSecurity

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap

api-ms-win-core-localization-l1-2-0

IsValidCodePage GetOEMCP LCMapStringW GetCPInfo EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP FormatMessageW GetLocaleInfoW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l1-1-0

LockFileEx UnlockFileEx GetDriveTypeW FindFirstFileExA CreateDirectoryW FindFirstFileExW FindFirstFileW CreateFileW FindNextFileA GetFileAttributesExW FindNextFileW FlushFileBuffers FindClose DeleteFileW GetFileInformationByHandle GetFullPathNameW WriteFile ReadFile SetEndOfFile SetFilePointerEx GetFileType

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

CheckTokenMembership GetTokenInformation CreateWellKnownSid FreeSid AllocateAndInitializeSid DuplicateToken IsValidSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait WTSGetActiveConsoleSessionId

oleaut32

SysAllocString SafeArrayLock SafeArrayCreate VariantClear SafeArrayUnlock SafeArrayGetVartype SafeArrayCopy SysFreeString SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetLBound

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleCP ReadConsoleW GetConsoleMode

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoA GetFileVersionInfoSizeA

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

kernel32

SleepConditionVariableCS WakeConditionVariable InitializeConditionVariable CreateThread QueryPerformanceFrequency LoadLibraryA RemoveDirectoryW Module32NextW Module32FirstW VirtualQuery InitOnceExecuteOnce GetThreadId SystemTimeToFileTime GetSystemTime GetModuleHandleA GetTickCount64 InitializeCriticalSection

user32

DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW AllowSetForegroundWindow RegisterDeviceNotificationW MessageBoxW PostMessageW GetMessageW UnregisterPowerSettingNotification TranslateMessage RegisterPowerSettingNotification UnregisterDeviceNotification UnregisterClassW PeekMessageW DispatchMessageW

shell32

CommandLineToArgvW ShellExecuteExW

ole32

CoInitialize

dbghelp

SymGetOptions SymFromAddr SymInitialize SymSetOptions

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpQueryHeaders WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpOpenRequest

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer QueueUserWorkItem UnregisterWaitEx CreateTimerQueue ChangeTimerQueueTimer CreateTimerQueueTimer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-memory-l1-1-0

VirtualFree UnmapViewOfFile VirtualProtect CreateFileMappingW MapViewOfFile VirtualAlloc

api-ms-win-core-console-l2-1-0

ReadConsoleOutputW SetConsoleCursorPosition AttachConsole GetConsoleScreenBufferInfo

api-ms-win-service-management-l1-1-0

DeleteService OpenServiceW OpenSCManagerW CreateServiceW CloseServiceHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-winsvc-l1-1-0

ControlService QueryServiceStatus

api-ms-win-core-registry-l1-1-0

RegSetKeySecurity RegCreateKeyExW RegCloseKey RegSetValueExW RegEnumKeyExW RegEnumValueW RegNotifyChangeKeyValue RegOpenKeyExW RegDeleteTreeW RegGetValueW RegOpenCurrentUser

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask GetProcessAffinityMask

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW RegSetKeyValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_00f5f1108c09204e3104e45b2101f779_amadey_darkgate_elex_hijackloader_luca-stealer_medusalocker_njrat_remcos

shlwapi

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

wintrust

crypt32

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

oleaut32

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-versionansi-l1-1-1

api-ms-win-core-versionansi-l1-1-0

kernel32

user32

shell32

ole32

dbghelp

winhttp

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-1

generic