2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 1.7MB
Sample260723-byb98aeh64
SHA256 b17e2be3ea7f2e1d755a7f8d6b9e91f795efecd645c655994d021120fefa9b22
MD5 da20f5adf74dba01e3e7133ecb23a2e4
SHA1 187dc77c12f79f8654082790e68ca21a7f92c9a5
SHA512 bd37c6b699ebea90f77f624c85f7586eb0d1a303196e5718097246ec21ca8e2f4ebc804857424497080d95d8505e6d76b8bd548a1572bd1b2aa5d78f1d006b8a
SSDEEP 49152:wLBmL+h9wf8FfgDkLSpTu+MGF1qrCGqKc:AmLKrFIDkedf
TLSH
T1C0855C22B781C637E59201709A6C9F5B505879302B6658C7F3C80F2E79F0DD36A36E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 1.7MB

2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 80583306c4f6ec9e0ad3ea37c7a609a0
SHA256 b17e2be3ea7f2e1d755a7f8d6b9e91f795efecd645c655994d021120fefa9b22
MD5 da20f5adf74dba01e3e7133ecb23a2e4
SHA1 187dc77c12f79f8654082790e68ca21a7f92c9a5
SHA512 bd37c6b699ebea90f77f624c85f7586eb0d1a303196e5718097246ec21ca8e2f4ebc804857424497080d95d8505e6d76b8bd548a1572bd1b2aa5d78f1d006b8a
SSDEEP 49152:wLBmL+h9wf8FfgDkLSpTu+MGF1qrCGqKc:AmLKrFIDkedf
TLSH
T1C0855C22B781C637E59201709A6C9F5B505879302B6658C7F3C80F2E79F0DD36A36E6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

951366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build@2\RhinoProtect\Publish\OutPut\bin\Win32\release\pdb\2345SafeCenterInstaller.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetExitCodeProcess QueryDosDeviceW GetModuleFileNameW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery GetPrivateProfileStringW DeleteFileW GetTickCount MoveFileW WriteFile CreateFileW GetModuleHandleExW ReleaseMutex lstrcmpiW lstrlenW SetFileAttributesW ReadFile SetFilePointer SetEndOfFile GetFileSize GetACP GlobalMemoryStatusEx SetEvent InterlockedExchange SetLastError InterlockedExchangeAdd ExpandEnvironmentStringsW GetVersionExW GetFileAttributesW VirtualFree VirtualProtect CreateProcessW GetProcessHeap LocalFree HeapAlloc OpenProcess WaitForSingleObject WaitForMultipleObjects HeapFree IsBadStringPtrW InitializeCriticalSectionAndSpinCount MoveFileExW SetErrorMode GetCurrentProcess OpenMutexW GetCurrentProcessId CloseHandle Sleep GetModuleHandleW VirtualAlloc GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue DuplicateHandle MapViewOfFile CreateFileMappingW GetDriveTypeW SearchPathW FindFirstFileW GetLongPathNameW GetFileAttributesExW GetVolumeInformationW GetDiskFreeSpaceW MultiByteToWideChar WideCharToMultiByte TerminateProcess LockResource GetSystemInfo LoadResource FindResourceW LoadLibraryExW GetCurrentThreadId GetComputerNameExW CreateMutexW SetFileTime GetFileTime TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateEventW ResetEvent FindNextFileW FindClose FileTimeToSystemTime ResumeThread RaiseException DecodePointer CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW GetCurrentDirectoryW GetWindowsDirectoryW CopyFileW GetTempFileNameW GetFileSizeEx FormatMessageW DeviceIoControl EncodePointer GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetLocalTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW GetStdHandle GetFileType RtlUnwind InterlockedPushEntrySList InterlockedFlushSList CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetCurrentThread HeapReAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WaitForSingleObjectEx SetStdHandle HeapSize WriteConsoleW InterlockedDecrement InterlockedIncrement PeekNamedPipe GetExitCodeThread GetOverlappedResult WaitNamedPipeW UnmapViewOfFile OpenFileMappingW GetLastError FreeLibrary GetProcAddress LoadLibraryW ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx

user32

wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

SHGetPathFromIDListW SHGetSpecialFolderPathW SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoUninitialize

shlwapi

PathFileExistsW StrStrIW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_da20f5adf74dba01e3e7133ecb23a2e4_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

version

kernel32

user32

advapi32

shell32

ole32

shlwapi

generic