2026-07-23_e2cd19116cd4962aa7453fc2ba1e3436_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_e2cd19116cd4962aa7453fc2ba1e3436_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
Size 2.6MB
Sample260723-fbcppawvbv
SHA256 fd15e3d693ea97bae72a838c896564129962410d89d1be6ed4bfbe4fb26543fa
MD5 e2cd19116cd4962aa7453fc2ba1e3436
SHA1 4aa7ca5eca2a762f1520c7adc2fd7195104591c2
SHA512 f55a3dc523a65ca6dc191cd25dcb673147430baf18ed240863d4c30113ce0fe92b67c83e8e1b651f8462aac0dbd96a3fe7c5d6de171e744ef8506caac5cc375c
SSDEEP 49152:ITbdUV71YXOsWr0TXrkfR0kze8TlfNYNPxuaEhl96MFxaB0zj0yjoB2:V7AQWrk2k/Y7ucB2Yyjl
TLSH
T131D5C012B980D072F8E2107AD3FE4BBAAD3DAB20133C91E35BD558D55E605D2773A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_e2cd19116cd4962aa7453fc2ba1e3436_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-23_e2cd19116cd4962aa7453fc2ba1e3436_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

.exe 2.6MB

2026-07-23_e2cd19116cd4962aa7453fc2ba1e3436_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader

IMPHASH f165b8b9b312b1634f7419348746ba89
SHA256 fd15e3d693ea97bae72a838c896564129962410d89d1be6ed4bfbe4fb26543fa
MD5 e2cd19116cd4962aa7453fc2ba1e3436
SHA1 4aa7ca5eca2a762f1520c7adc2fd7195104591c2
SHA512 f55a3dc523a65ca6dc191cd25dcb673147430baf18ed240863d4c30113ce0fe92b67c83e8e1b651f8462aac0dbd96a3fe7c5d6de171e744ef8506caac5cc375c
SSDEEP 49152:ITbdUV71YXOsWr0TXrkfR0kze8TlfNYNPxuaEhl96MFxaB0zj0yjoB2:V7AQWrk2k/Y7ucB2Yyjl
TLSH
T131D5C012B980D072F8E2107AD3FE4BBAAD3DAB20133C91E35BD558D55E605D2773A386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1441587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dagor2\launcher_builds\scilauncher2\war_thunder\bpreport.pdb

user32

GetUserObjectInformationW MessageBoxW GetSysColor GetKeyboardLayout RegisterWindowMessageW TranslateMessage DispatchMessageW PeekMessageA PeekMessageW SendMessageA GetProcessWindowStation DefWindowProcA DefWindowProcW RegisterClassExA RegisterClassExW CreateWindowExA CreateWindowExW IsWindow DestroyWindow ShowWindow OpenIcon GetForegroundWindow PostMessageA LoadCursorA SetWindowPos IsIconic BringWindowToTop OpenClipboard CloseClipboard GetClipboardOwner SetClipboardViewer ChangeClipboardChain SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable SetFocus GetKeyState GetAsyncKeyState SetCapture ReleaseCapture MsgWaitForMultipleObjects SetTimer SetActiveWindow MessageBeep SetRect SetWindowRgn WindowFromPoint SetForegroundWindow FillRect PostThreadMessageA MessageBoxA SystemParametersInfoA CopyIcon CreateIconIndirect DestroyIcon LoadIconA GetWindow GetParent SetWindowLongA GetWindowLongA MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRectEx GetWindowRect SetWindowTextW ValidateRgn InvalidateRect GetUpdateRgn ReleaseDC GetDC GetSystemMetrics KillTimer

ole32

ReleaseStgMedium DoDragDrop RegisterDragDrop OleUninitialize OleInitialize

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW WaitForSingleObjectEx ResetEvent SetEvent GetStartupInfoW InitializeSListHead EncodePointer DecodePointer CompareStringW CreateProcessW GetCommandLineW WideCharToMultiByte GetLastError SetLastError FormatMessageA GetTickCount InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep SleepEx WaitForSingleObject CloseHandle ExpandEnvironmentStringsA VerSetConditionMask VerifyVersionInfoA MultiByteToWideChar CreateFileW DeleteFileW MoveFileExW LocalFree GetFileType GetFileSizeEx WriteFile ReadFile SetFilePointerEx GetFileTime LCMapStringW GetProcAddress GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId IsDebuggerPresent GetModuleHandleA GetEnvironmentVariableW InterlockedExchangeAdd InterlockedCompareExchange TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetModuleHandleW CreateFiber DeleteFiber SwitchToFiber GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetSystemTimeAsFileTime GetModuleHandleExW ConvertThreadToFiber ConvertFiberToThread GlobalMemoryStatus QueryPerformanceCounter FreeLibrary LoadLibraryA LoadLibraryW GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA GetACP GetComputerNameA GetFileAttributesA GetLocaleInfoW GetStringTypeW GetCPInfo GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetFullPathNameW SetEnvironmentVariableA RtlUnwind SetEnvironmentVariableW GetCurrentDirectoryW ExitProcess GetFileAttributesExW SetFileAttributesW CreateDirectoryW RemoveDirectoryW GetModuleFileNameW RaiseException HeapAlloc HeapFree HeapReAlloc LoadLibraryExW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle GetTimeZoneInformation ReadConsoleW HeapSize SetEndOfFile GetExitCodeProcess FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW InitializeCriticalSectionAndSpinCount

gdi32

Arc ExtCreatePen ExtCreateRegion TextOutW GetTextMetricsA SetTextColor GetCharacterPlacementW GetTextExtentPoint32W GetGlyphOutlineW CreateFontA GetDIBits Polygon DPtoLP MoveToEx SelectClipRgn RectInRegion LineTo GetRgnBox EqualRgn SetPixel ModifyWorldTransform Pie GetWorldTransform CreateCompatibleDC BitBlt SelectPalette SelectObject RealizePalette GetStockObject CreateSolidBrush CreatePen CreatePalette CreateDCA GdiFlush LPtoDP CreatePolygonRgn PlayEnhMetaFile GetEnhMetaFileHeader UpdateColors SetTextAlign SetDIBitsToDevice SetBkMode SaveDC RestoreDC GetDeviceCaps DeleteObject DeleteDC CreateRectRgn CreateCompatibleBitmap CreateBitmap CombineRgn CreateDIBSection PolyPolygon Polyline StretchDIBits SetWorldTransform

ws2_32

getsockopt htons WSAStartup WSACleanup recv getsockname WSAGetLastError __WSAFDIsSet select WSASetLastError bind getpeername connect send closesocket sendto htonl gethostname ioctlsocket freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs

shell32

CommandLineToArgvW DragQueryFileW

advapi32

GetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW RegCloseKey RegQueryValueExW RegOpenKeyW

comctl32

_TrackMouseEvent

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

437KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

640KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=199, version=41118,

count=28, id=241, version=40116,

count=199, id=243, version=40116,

count=35, id=242, version=40116,

count=27, id=259, version=24123,

count=59, id=261, version=24123,

count=36, id=260, version=24123,

count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=339, id=1, productName=Unmarked objects,

count=62, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=7, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, productName=Unmarked objects (old),

count=22, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=674, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,