2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 5.9MB
Sample260723-ebf7fadn2s
SHA256 be4bf0f3e00525ec1020ce0ad3aed1a1cd8f03c1628717645b23d9a7ba984c28
MD5 3575ac6cc27ac42eb7667139bdb949eb
SHA1 bf0a969c6a264f1a9749983e74765a5a1bee2467
SHA512 71fd8ee625d22a7e40b520e58db5bd6e57c84054dcb0d2768ce09130c67dfb20addcd2d8a4a1d84304d3c602781a5504287f446771a2c8323fef6546970e6632
SSDEEP 49152:FNJQeM0MfGt1NNNRNNNy49NUJ67B/TO98VChBtzysUVap/UU8hoD1/TO98VChBtg:OeXnMbtzysiU8hjbtzysi6XL
TLSH
T19B56BE00AFA16836FD2685750DEA23664038FD31F39205DF9383F61E57619F22A3779A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 5.9MB

2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 6143fc1851d197d7f614c373a32266d5
SHA256 be4bf0f3e00525ec1020ce0ad3aed1a1cd8f03c1628717645b23d9a7ba984c28
MD5 3575ac6cc27ac42eb7667139bdb949eb
SHA1 bf0a969c6a264f1a9749983e74765a5a1bee2467
SHA512 71fd8ee625d22a7e40b520e58db5bd6e57c84054dcb0d2768ce09130c67dfb20addcd2d8a4a1d84304d3c602781a5504287f446771a2c8323fef6546970e6632
SSDEEP 49152:FNJQeM0MfGt1NNNRNNNy49NUJ67B/TO98VChBtzysUVap/UU8hoD1/TO98VChBtg:OeXnMbtzysiU8hjbtzysi6XL
TLSH
T19B56BE00AFA16836FD2685750DEA23664038FD31F39205DF9383F61E57619F22A3779A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CreateDirectoryW CreateFileW CreateProcessW DeleteCriticalSection EnterCriticalSection FindResourceW FormatMessageA GetCurrentProcess GetCurrentProcessId GetFileInformationByHandle GetFileInformationByHandleEx GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempPathW GetTickCount InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadLibraryA LoadResource LocalFree LockResource MultiByteToWideChar ReleaseSRWLockExclusive ReleaseSRWLockShared SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TlsGetValue VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteFile

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _ftelli64 _wfopen fclose fflush fputc fread fwrite setbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __sys_nerr _assert _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

_isctype_l _iswlower_l _strdup mbrlen memset strcmp strlen strncmp tolower toupper wcslen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtof wcrtomb wcrtomb_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

Name

.text

Size

324KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

164KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/66

Size

4KB

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_3575ac6cc27ac42eb7667139bdb949eb_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

winhttp

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic