2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 5.1MB
Sample260716-b8brfaay2m
SHA256 d375c3c77cc650309b9335f845840aa9a2a50fd15b3316f100251ac67d8cdc55
MD5 6f4cdf883f93bde7103aaeb81d8d3eae
SHA1 d632b13c90359d5e5e689c34c93f74d3ff679192
SHA512 8a5e4577034a09a4e04f50ee69f786302d0e76195c784ea82599301925d886cc7313b3b7b959d0ff4655160d51511e8e9c1f6b0e2664ad8fd5ef7037d1aea29d
SSDEEP 98304:KNpLqF7l8AT8j0Vtz58AEpbEv3Fck3fEi2puKKeHn:KNpKij0JJEpbEek3sJ5n
TLSH
T1CE469E127AD08072D5A70634999AE675767DBC301B3582CF73943B2D2E323D25E3AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 5.1MB

2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH dc64e5a19aaec7d77b6871fd1df45315
SHA256 d375c3c77cc650309b9335f845840aa9a2a50fd15b3316f100251ac67d8cdc55
MD5 6f4cdf883f93bde7103aaeb81d8d3eae
SHA1 d632b13c90359d5e5e689c34c93f74d3ff679192
SHA512 8a5e4577034a09a4e04f50ee69f786302d0e76195c784ea82599301925d886cc7313b3b7b959d0ff4655160d51511e8e9c1f6b0e2664ad8fd5ef7037d1aea29d
SSDEEP 98304:KNpLqF7l8AT8j0Vtz58AEpbEv3Fck3fEi2puKKeHn:KNpKij0JJEpbEek3sJ5n
TLSH
T1CE469E127AD08072D5A70634999AE675767DBC301B3582CF73943B2D2E323D25E3AB27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a6:f0:26:4e:44:4c:a2:8c:d1:81:93:27:49:e8:5e:87:99:d8:67:b4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=統睿科技有限公司,O=統睿科技有限公司,L=Zhongzheng District,ST=Taipei City,C=TW

Chains

Oct 26, 2025

CN=統睿科技有限公司,O=統睿科技有限公司,L=Zhongzheng District,ST=Taipei City,C=TW

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=統睿科技有限公司,O=統睿科技有限公司,L=Zhongzheng District,ST=Taipei City,C=TW

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=統睿科技有限公司,O=統睿科技有限公司,L=Zhongzheng District,ST=Taipei City,C=TW

Serial Number

09:c4:48:4f:da:32:0e:cc:43:a6:b0:af:a5:c9:94:6b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 23, 2026

Minor OS version

Major OS version

Entry point

1345892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\phoenix\CPP\udiskClient\Release\udiskClient.pdb

kernel32

WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetACP GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency GetCommandLineW GetCommandLineA HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetTimeZoneInformation RtlUnwind SetThreadContext GetThreadContext FlushInstructionCache InterlockedCompareExchange VirtualAlloc VirtualQuery GetCPInfo LCMapStringW GetStringTypeW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetProfileIntW VerifyVersionInfoW VerSetConditionMask FindResourceExW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime VirtualProtect GlobalFlags GetUserDefaultUILanguage CompareStringW UnlockFile LockFile GetVolumeInformationW FlushFileBuffers GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeResource EncodePointer FileTimeToSystemTime GlobalGetAtomNameW lstrcmpA ResumeThread SuspendThread SetThreadPriority FormatMessageW GlobalSize LocalReAlloc GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalReAlloc GlobalAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetModuleHandleA GetTickCount GlobalMemoryStatusEx ExitProcess SetEvent SetUnhandledExceptionFilter GetCurrentThread GetCurrentThreadId SetErrorMode GetModuleFileNameA WritePrivateProfileStringW ReleaseMutex CreateMutexW QueryPerformanceCounter GetWindowsDirectoryW FindResourceW LoadResource LockResource GetLongPathNameW GetSystemDefaultLCID SizeofResource VirtualFreeEx CreateRemoteThread LocalFree VirtualAllocEx Process32FirstW Process32NextW Sleep OpenProcess DuplicateHandle TerminateProcess SetLastError WriteProcessMemory lstrcatA QueryDosDeviceW LocalAlloc WideCharToMultiByte DeviceIoControl OutputDebugStringA GetTempFileNameW CreateProcessW GetTempPathW CreateDirectoryW GetDriveTypeW CreateToolhelp32Snapshot GetCurrentProcess GetFullPathNameW SearchPathW GetSystemTimeAsFileTime LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection CreateEventW WaitForSingleObject GetFileTime GetFileAttributesExW GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer FindNextFileW FindFirstFileExW GetFileSizeEx GetComputerNameW GetTempFileNameA GetFileSize DeleteFileA CreateFileA GetTempPathA WriteFile ReadFile lstrcmpiW lstrcpyA MultiByteToWideChar lstrlenA lstrlenW GetLocalTime CopyFileW FindClose FindFirstFileW MulDiv GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException LoadLibraryW HeapReAlloc GetPrivateProfileStringW HeapSize InitializeCriticalSectionEx HeapFree MapViewOfFile CreateFileMappingW lstrcpyW GetModuleHandleW GetCurrentProcessId K32EnumProcesses CloseHandle OutputDebugStringW GetLastError UnmapViewOfFile GetSystemDirectoryW GetVersionExW GetModuleFileNameW FreeLibrary GetProcAddress GetSystemInfo

user32

GetMenuItemInfoW DestroyMenu GetWindowDC TabbedTextOutW GrayStringW DrawTextW RealChildWindowFromPoint GetDesktopWindow ClientToScreen CharUpperW DestroyIcon IsDialogMessageW CheckDlgButton MoveWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetWindow GetTopWindow GetClassNameW GetClassLongW PtInRect EqualRect CopyRect MapWindowPoints ScreenToClient AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow GetForegroundWindow SetActiveWindow SetMenu GetMenu GetCapture GetDlgCtrlID IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos CopyImage SendDlgItemMessageA wsprintfW EndPaint SetWindowPlacement GetWindowPlacement IsChild IsMenu IsWindow GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW GetMessageTime GetMessagePos LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps SetRectEmpty CheckMenuItem GetFocus GetWindowTextLengthW GetWindowTextW GetSysColorBrush GetSysColor ReleaseDC GetDC GetSystemMetrics CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW RemoveMenu InflateRect InsertMenuW GetMenuItemCount GetMenuItemID GetMenuState GetMenuStringW OffsetRect CreateDialogIndirectParamW GetNextDlgTabItem GetAsyncKeyState MapDialogRect IntersectRect TrackMouseEvent LoadImageW ShowOwnedPopups SetCursor DeleteMenu GetNextDlgGroupItem SetCapture ReleaseCapture WindowFromPoint DrawFocusRect IsRectEmpty BeginPaint InvalidateRect UpdateWindow KillTimer GetClientRect SetWindowLongW LoadCursorW SetLayeredWindowAttributes DrawTextExW SetTimer ShowWindow RegisterClassExW CreateWindowExW FillRect EnumDisplayMonitors SetWindowPos DestroyWindow GetWindowRect DefWindowProcW DialogBoxParamW GetDlgItem SetFocus GetDlgItemTextW SetDlgItemTextW SetWindowTextW EndDialog GetCursorPos SetForegroundWindow RegisterWindowMessageW PostQuitMessage FindWindowW LoadIconW TranslateMessage DispatchMessageW GetSubMenu TrackPopupMenu SendMessageW PostMessageW LoadMenuW GetMessageW SetDlgItemTextA EmptyClipboard CloseClipboard GetDlgItemTextA OpenClipboard MessageBoxW UnhookWindowsHookEx EnableWindow IsWindowEnabled GetWindowLongW GetParent DrawIconEx GetIconInfo MessageBeep EnableScrollBar HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetWindowThreadProcessId GetLastActivePopup GetMenuDefaultItem MapVirtualKeyW GetKeyNameTextW SetClassLongW SetWindowRgn SetParent SetClipboardData DrawStateW DrawEdge AppendMenuW SystemParametersInfoW DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect DrawIcon UnionRect UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect DestroyCursor GetWindowRgn CreateMenu EnableMenuItem

gdi32

SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectW GetTextExtentPoint32W CombineRgn CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries ExtSelectClipRgn RealizePalette GetBkColor CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox Escape DeleteDC CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush GetObjectW SetBkColor CreateBitmap CreateDCW CopyMetaFileW BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetDeviceCaps SetTextColor DeleteObject GetSystemPaletteEntries ExcludeClipRect CreateSolidBrush

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyExW RegDeleteKeyW LookupPrivilegeValueW AdjustTokenPrivileges SetSecurityInfo RegQueryValueExA RegOpenKeyExA GetSecurityDescriptorSacl SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW CopySid SetSecurityDescriptorSacl IsValidSid OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW GetLengthSid AddAccessAllowedAce GetTokenInformation GetUserNameW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

shell32

SHGetFolderPathW Shell_NotifyIconW ShellExecuteW SHAppBarMessage SHBrowseForFolderW DragFinish DragQueryFileW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFileInfoW

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitialize CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize RevokeDragDrop

oleaut32

VariantChangeType VariantCopy VarBstrFromDate VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen LoadTypeLi VariantInit SysFreeString SysAllocString VariantClear

msimg32

TransparentBlt AlphaBlend

shlwapi

PathStripToRootW PathFindExtensionW PathRemoveFileSpecW StrFormatKBSizeW PathFindFileNameW PathIsUNCW

uxtheme

GetThemeSysColor IsAppThemed GetWindowTheme GetCurrentThemeName GetThemePartSize DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsThemeBackgroundPartiallyTransparent

ws2_32

gethostname WSAStartup gethostbyname WSACleanup inet_ntoa

secur32

GetUserNameExW

setupapi

CM_Get_Device_IDW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW CM_Get_Parent

iphlpapi

GetAdaptersInfo

psapi

EnumProcesses GetModuleFileNameExW EnumProcessModules

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetReadFile InternetQueryOptionW HttpOpenRequestA InternetOpenW InternetSetOptionW InternetConnectA InternetCloseHandle HttpSendRequestW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDrawImageRectI GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipGetImageWidth GdipBitmapUnlockBits GdipSetInterpolationMode GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCreateBitmapFromStream

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=28, id=241, version=40116,

count=194, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=261, version=23013,

count=1, id=207, version=65501,

count=7, id=199, version=41118,

count=25, id=259, version=24123,

count=34, id=260, version=24123,

count=1, id=205, version=65501,

count=12, id=206, version=65501,

count=3, id=208, version=65501,

count=49, id=203, version=65501,

count=888, id=1, productName=Unmarked objects,

count=372, id=261, version=24123,

count=53, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,