2026-07-21_a850f09fdd73b75734bf263aa42fac52_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_a850f09fdd73b75734bf263aa42fac52_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.9MB
Sample260721-xplcessgrd
SHA256 fbed62a0417b342e6488375ad9e127c19ecd5967bdb5c72130b3b5317147f296
MD5 a850f09fdd73b75734bf263aa42fac52
SHA1 290631d30fd169c0bb4139ac0eb4dc7b2ac552f4
SHA512 a3f94a160229c9123b88163264dbbea1f49c1f36ef6b558b492bf3fc385cba6551822ede6a7be9b61fcf09e8385a827508d82e4ad56de7dc1bdec1a3d433082b
SSDEEP 24576:4cccmWUK78HqtKybF5UkjKU1eWSFub/GJd89YmWzUbLGEqpdhnK9E5tFlMvm:RzlL1iAOAFWdfpdhnvtFCm
TLSH
T1F3959F31FA02C136E5A241718ABCFBAA94ADB7214B7414CB63D80E2D5D345D32E3677B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-21_a850f09fdd73b75734bf263aa42fac52_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-21_a850f09fdd73b75734bf263aa42fac52_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.9MB

2026-07-21_a850f09fdd73b75734bf263aa42fac52_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 046600f96d628e6bcae370469c083d02
SHA256 fbed62a0417b342e6488375ad9e127c19ecd5967bdb5c72130b3b5317147f296
MD5 a850f09fdd73b75734bf263aa42fac52
SHA1 290631d30fd169c0bb4139ac0eb4dc7b2ac552f4
SHA512 a3f94a160229c9123b88163264dbbea1f49c1f36ef6b558b492bf3fc385cba6551822ede6a7be9b61fcf09e8385a827508d82e4ad56de7dc1bdec1a3d433082b
SSDEEP 24576:4cccmWUK78HqtKybF5UkjKU1eWSFub/GJd89YmWzUbLGEqpdhnK9E5tFlMvm:RzlL1iAOAFWdfpdhnvtFCm
TLSH
T1F3959F31FA02C136E5A241718ABCFBAA94ADB7214B7414CB63D80E2D5D345D32E3677B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d5:e5:84:61:54:af:67:62:0c:3a:17:24:90:a0:c4:ad:ae:b3:38:a5:e9:81:2e:46:6c:3b:6a:7c:aa:05:2b:ae

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 19, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1027529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\871505\out\Release\LoginServer.pdb

kernel32

GetCurrentProcess lstrcmpiW GetVersionExW LocalFree GetComputerNameW SetFilePointerEx GlobalAlloc GlobalFree SetEndOfFile FindClose FindNextFileW OpenThread GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA InterlockedIncrement InterlockedDecrement MulDiv LocalAlloc GetBinaryTypeW GetCommandLineW GetCurrentThreadId InterlockedExchange MapViewOfFile MapViewOfFileEx GetPrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW LoadLibraryW CreateFileMappingW lstrlenA UnmapViewOfFile SetFilePointer GetFileSize InterlockedCompareExchange FindResourceExW FindResourceW SizeofResource LoadResource LockResource MoveFileExW DeleteFileW SetFileAttributesW lstrlenW ReadFile WriteFile GetFileSizeEx WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetStdHandle GetFileType ExitProcess ExitThread RtlUnwind PostQueuedCompletionStatus UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject GetProcessHeap HeapSize HeapDestroy CreateProcessW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent OpenProcess DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetQueuedCompletionStatus CreateIoCompletionPort GetExitCodeThread TerminateThread CreateFileW

user32

DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW PostMessageW FindWindowExW GetWindowThreadProcessId SendMessageTimeoutW AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow GetDesktopWindow SetWindowRgn FindWindowW wsprintfW DrawTextW GetSysColor EmptyClipboard SetClipboardData EqualRect UnionRect SetCursor IsRectEmpty OffsetRect ScreenToClient InvalidateRect ClientToScreen GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetFocus SetFocus IsZoomed UpdateLayeredWindow RegisterClassW MonitorFromPoint ReleaseDC GetDC SetWindowPos IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable SendMessageW PostQuitMessage CallWindowProcW UnregisterClassW MoveWindow SetTimer KillTimer GetAsyncKeyState GetMessagePos PtInRect IntersectRect GetSystemMetrics GetCursorPos LoadCursorW GetClassInfoExW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW GetMonitorInfoW MonitorFromWindow LoadImageW LoadIconW GetWindow GetParent CopyRect MapWindowPoints GetWindowRect GetClientRect SetWindowTextW

advapi32

OpenProcessToken RegSetValueExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegOpenCurrentUser RegEnumKeyExW RegQueryInfoKeyW DuplicateTokenEx LookupPrivilegeValueW GetSidSubAuthorityCount GetSidSubAuthority AdjustTokenPrivileges GetTokenInformation

shell32

ord680 SHGetSpecialFolderPathW ord165 SHGetFolderPathW CommandLineToArgvW ShellExecuteW ExtractAssociatedIconW

ole32

CoInitializeEx CoCreateInstance CoUninitialize PropVariantClear CoTaskMemRealloc CreateStreamOnHGlobal CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

LoadRegTypeLi LoadTypeLi SysStringLen VariantInit SysFreeString VarUI4FromStr SysAllocString SysAllocStringLen

shlwapi

PathIsRelativeW PathAddBackslashW SHSetValueW SHStrDupW StrStrIW StrCmpNIW ord176 SHGetValueW PathRemoveFileSpecW PathFindFileNameW PathCombineW PathAppendW PathFileExistsW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetProcessImageFileNameW GetModuleFileNameExW

gdiplus

GdipFree GdiplusStartup GdipAlloc GdipDrawImageRect GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipResetClip GdipSetClipPath GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdiplusShutdown GdipGetPropertyItem GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipDrawArc GdipGetPropertyItemSize GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

crypt32

CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CryptMsgClose

gdi32

GetStockObject GetObjectW GetDeviceCaps BitBlt DeleteObject CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx CreateFontIndirectW CreateRoundRectRgn

msimg32

AlphaBlend

generic

count=30, id=241, version=40116,

count=194, id=243, version=40116,

count=39, id=242, version=40116,

count=4, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=670, id=1, productName=Unmarked objects,

count=6, id=264, version=27048,

count=1, id=261, version=28106,

count=1, id=260, version=27048,

count=45, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,