2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

General

Target
2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader
Size 19.6MB
Sample260720-ddh85sc19p
SHA256 5b54ff45af259c36df84503104a265a668143ed53fb85979977e03fe5903df23
MD5 88541977d237248930c3832c9d476572
SHA1 fa9519176d243d7c74b0844e7d6c8f6bd856a7b3
SHA512 30f9d2d18d40b0384296148d7fb5eec679cd457e15d9ca07cad5cb483bdb4568947d05195b821af279677892ba706da88a05b0b5a708cdd12195c667c82fc55b
SSDEEP 393216:EO1nCiPCOAUD3P/ouwT3fTQW6OKEIrqNp/8a9EhI1O:EONPPCOl7CvMOKEaa9EhI1
TLSH
T19527CF02FAC240F9C45B01B2652EF37FDB397E244728C6E3DBE42F15A9B139059AA157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

File Explorer

2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

.exe 19.6MB

2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

SHA256 5b54ff45af259c36df84503104a265a668143ed53fb85979977e03fe5903df23
MD5 88541977d237248930c3832c9d476572
SHA1 fa9519176d243d7c74b0844e7d6c8f6bd856a7b3
SHA512 30f9d2d18d40b0384296148d7fb5eec679cd457e15d9ca07cad5cb483bdb4568947d05195b821af279677892ba706da88a05b0b5a708cdd12195c667c82fc55b
SSDEEP 393216:EO1nCiPCOAUD3P/ouwT3fTQW6OKEIrqNp/8a9EhI1O:EONPPCOl7CvMOKEaa9EhI1
TLSH
T19527CF02FAC240F9C45B01B2652EF37FDB397E244728C6E3DBE42F15A9B139059AA157
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8777245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.5MB

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

441KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_88541977d237248930c3832c9d476572_akira_amadey_darkgate_elex_glassworm_helldown_icedid_luca-stealer_njrat_plugx_remcos_smoke-loader

generic