2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos
Size 5.4MB
Sample260728-sdbavsbm3y
SHA256 3fe0ef9038a4f4a832bcb1083e591b6ac08fdf8a0c696510673686d9ad2c4648
MD5 fd70568b77bdcf7330f3d2e209333fd0
SHA1 5bc68f9615155580ddaa997f594402fb5d29ec1a
SHA512 490c45d7b53a2d5841b554586d624e5d7812601f66e1bd5bc1262504702596fe7c046367a7c3bc4ea61f293ff12fb7f49120c3ff0f826a37251b0670304ca941
SSDEEP 98304:brQX6ul1G6yjMiYfkHRL3NssqoUBPoM40iF6HYp4UVGk30eVkbJPJ7:HQXd1nkH9MriF64mUVv0eeJPN
TLSH
T1F046E030BB4A8171E8A201B0666DABBB546DBA38177900CBF2941F9D59706D37E37F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

.exe 5.4MB

2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

IMPHASH d6d16ba00d6c313df7cfd64034a9b3b4
SHA256 3fe0ef9038a4f4a832bcb1083e591b6ac08fdf8a0c696510673686d9ad2c4648
MD5 fd70568b77bdcf7330f3d2e209333fd0
SHA1 5bc68f9615155580ddaa997f594402fb5d29ec1a
SHA512 490c45d7b53a2d5841b554586d624e5d7812601f66e1bd5bc1262504702596fe7c046367a7c3bc4ea61f293ff12fb7f49120c3ff0f826a37251b0670304ca941
SSDEEP 98304:brQX6ul1G6yjMiYfkHRL3NssqoUBPoM40iF6HYp4UVGk30eVkbJPJ7:HQXd1nkH9MriF64mUVv0eeJPN
TLSH
T1F046E030BB4A8171E8A201B0666DABBB546DBA38177900CBF2941F9D59706D37E37F13
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ee:bc:75:3a:ca:87:95:f6:cf:c8:f9:96:39:8d:25:57:03:1b:1a:d1:dc:84:8d:50:5d:7e:78:bb:e5:df:b0:77

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

Chains

Feb 12, 2025

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Sophos Ltd,O=Sophos Ltd,L=Abingdon,C=GB

Serial Number

0a:61:6d:1b:c8:88:0f:4c:a2:7c:20:bc:d6:02:59:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 28, 2024 - Jul 26, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2386352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Surfright\Producten\Alert\branch-2xxx\bin\Release\hmpalert.pdb

kernel32

CloseHandle InterlockedIncrement QueueUserWorkItem GetSystemTimeAsFileTime CreateDirectoryW DeleteCriticalSection CompareFileTime InitializeCriticalSection EnterCriticalSection GetWindowsDirectoryW TryEnterCriticalSection LeaveCriticalSection InterlockedDecrement MultiByteToWideChar WideCharToMultiByte InterlockedExchange InterlockedCompareExchange CreateEventW CreateThread SignalObjectAndWait TerminateThread WaitForSingleObject FindResourceW SizeofResource LoadResource LockResource FreeResource GetLastError Sleep GetCurrentProcess GetModuleHandleA GetProcAddress WTSGetActiveConsoleSessionId LocalAlloc GetDriveTypeW GetVolumeInformationW FileTimeToSystemTime GetDateFormatW SetEvent ResetEvent SetThreadPriority GetCurrentThread GetTickCount OpenProcess DuplicateHandle GetModuleHandleExW GetLogicalDriveStringsW QueryDosDeviceW GetLongPathNameW GlobalAlloc GlobalLock GlobalUnlock FileTimeToLocalFileTime GetComputerNameW GetCurrentProcessId WaitForMultipleObjects WaitForSingleObjectEx GetOverlappedResult CancelIo CreateWaitableTimerW SetWaitableTimer CreateFileA GetFileSize CreateTimerQueue DeleteTimerQueueEx CopyFileW DeleteFileW DeleteTimerQueueTimer CreateTimerQueueTimer ReadDirectoryChangesW FreeLibrary ReadFile GetFileInformationByHandle IsWow64Process LoadLibraryW ReadProcessMemory QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA ProcessIdToSessionId WriteFile FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryA LoadLibraryExA VirtualProtect LoadLibraryExW GetFileSizeEx GetSystemTime SetLastError CreateHardLinkW MoveFileExW OpenEventW GetCurrentThreadId SetFilePointer GetComputerNameA GetLocalTime GlobalFree GetModuleFileNameW GetExitCodeProcess TerminateProcess GetTimeZoneInformation GetVersionExW CreateProcessW CreateEventA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile CreateFileW HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW CreateIoCompletionPort DisconnectNamedPipe GetQueuedCompletionStatus CreateNamedPipeW ConnectNamedPipe PeekNamedPipe WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetFileType GetACP ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer SwitchToThread GetStringTypeW TransactNamedPipe CancelWaitableTimer ResumeThread InitializeCriticalSectionAndSpinCount GetCalendarInfoA MulDiv ConvertDefaultLocale VerifyVersionInfoW VerSetConditionMask GetSystemWow64DirectoryW OpenMutexW GetNativeSystemInfo GetModuleHandleExA GetConsoleMode VirtualAlloc GetStdHandle VirtualFree SetNamedPipeHandleState WaitNamedPipeW GetModuleHandleW VirtualQuery RaiseException DeviceIoControl GetSystemDirectoryW LocalFree HeapValidate SystemTimeToFileTime

user32

GetUserObjectInformationW GetAsyncKeyState TrackPopupMenu ModifyMenuW EnumDesktopWindows ChildWindowFromPointEx ScrollDC CreateIconIndirect LoadImageW EnableMenuItem SetMenuDefaultItem AppendMenuW CreatePopupMenu RegisterWindowMessageA ChangeDisplaySettingsW EnumDisplaySettingsW PostQuitMessage GetMessageW WindowFromPoint SetWindowTextW SetWindowLongW EnableWindow SetFocus SetCursor TrackMouseEvent GetPropW SetPropW MoveWindow SetParent UpdateWindow SetCursorPos ClientToScreen MapWindowPoints GetClassNameW EnumWindows MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetMonitorInfoW MonitorFromWindow GetWindowRect GetCursorPos GetWindow GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowRgn EqualRect IsZoomed ShowWindow GetParent CallNextHookEx IsWindowVisible RealGetWindowClassA IsRectEmpty IsIconic SetLayeredWindowAttributes EndPaint BeginPaint UnhookWinEvent UnhookWindowsHookEx DispatchMessageW TranslateMessage PeekMessageW SetWindowsHookExW SetWinEventHook GetForegroundWindow SystemParametersInfoW GetSystemMetrics GetClientRect CallWindowProcW GetWindowTextLengthW SendMessageW RegisterClassW GetClassInfoW GetIconInfo DestroyIcon ReleaseCapture SetCapture ScreenToClient DrawFocusRect InflateRect InvalidateRect PtInRect SetRectEmpty OffsetRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CharUpperW ReleaseDC GetDC MessageBoxExW GetDesktopWindow RedrawWindow SetWindowPos DrawIconEx SetRect PostMessageW KillTimer SetTimer MessageBoxW DrawTextW CopyRect FillRect AllowSetForegroundWindow FindWindowExW CharUpperBuffW CharLowerW CharLowerBuffW ExitWindowsEx RegisterWindowMessageW GetThreadDesktop IsDialogMessageW SwitchDesktop OpenInputDesktop GetUserObjectInformationA CloseDesktop AttachThreadInput SetForegroundWindow BringWindowToTop IsWindowEnabled GetClipboardData DefWindowProcW IsClipboardFormatAvailable MsgWaitForMultipleObjectsEx

fltlib

FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceFindClose FilterGetDosName

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

488KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

1004B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_fd70568b77bdcf7330f3d2e209333fd0_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

PE Signature issue

kernel32

user32

fltlib

mpr

netapi32

generic