2026-07-28_4018f68b3f88a1eb985f42c4b35cb2ca_amadey_darkgate_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_4018f68b3f88a1eb985f42c4b35cb2ca_amadey_darkgate_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader
Size 457KB
Sample260729-bspclattav
SHA256 d6d8e916b2a14427a5d1f11d45f2ffaece84f28502e5d3f028a53a4f998d7db7
MD5 4018f68b3f88a1eb985f42c4b35cb2ca
SHA1 68c13e7d73b2e2d41f21f09867b79ff35ec91136
SHA512 3e53ba503f452cc41cb560948bc1ca2888bd3873dbe1a6841a7aa816886d9c171efa6e55c38e838bf0b14b49f306e7090aefc7cf17f864d0d655c2be40043e4e
SSDEEP 12288:6jItwI/T1YIR3Q7jM9/T9mmu/vVC/kMofN5kAi1NfXE2XERKVW1ro+kYV28fX2dg:6ARYIR3KjMJThZs2yyzAWLN3pqsakuWY
TLSH
T1E3A49FC1B6D58021D8369B720466B7B2003D7DE07B1077CF93D5AABEED255C30A37A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-28_4018f68b3f88a1eb985f42c4b35cb2ca_amadey_darkgate_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

.exe 457KB

2026-07-28_4018f68b3f88a1eb985f42c4b35cb2ca_amadey_darkgate_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 4a9105c8d84e08f06228bd853cc568c7
SHA256 d6d8e916b2a14427a5d1f11d45f2ffaece84f28502e5d3f028a53a4f998d7db7
MD5 4018f68b3f88a1eb985f42c4b35cb2ca
SHA1 68c13e7d73b2e2d41f21f09867b79ff35ec91136
SHA512 3e53ba503f452cc41cb560948bc1ca2888bd3873dbe1a6841a7aa816886d9c171efa6e55c38e838bf0b14b49f306e7090aefc7cf17f864d0d655c2be40043e4e
SSDEEP 12288:6jItwI/T1YIR3Q7jM9/T9mmu/vVC/kMofN5kAi1NfXE2XERKVW1ro+kYV28fX2dg:6ARYIR3KjMJThZs2yyzAWLN3pqsakuWY
TLSH
T1E3A49FC1B6D58021D8369B720466B7B2003D7DE07B1077CF93D5AABEED255C30A37A6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

45:91:f7:9b:75:49:ad:8c:03:44:c4:a5:b3:e7:2d:a6:93:0e:27:3f:30:29:f2:81:60:49:4c:9b:ed:db:91:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Jul 24, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

14:23:d3:78:09:be:fc:4d:98:71:61:be:0e:f0:49:0e:7b:eb:bf:84

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Jul 24, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

07:8f:d1:48:0a:d2:92:72:fb:1f:57:61:4e:67:02:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2017 - Oct 1, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

34:cb:7f:a7:1d:10:18:43:27:bd:00:97:c4:b3:0a:c0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2017 - Oct 1, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

61516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\svn\NewKuaiZip\bin\Release\x86\wizard.pdb

kernel32

LoadLibraryExW GetProcAddress FreeLibrary InitializeCriticalSectionAndSpinCount SetLastError GetCommandLineA GetModuleFileNameW RaiseException DecodePointer DeleteCriticalSection GetModuleHandleW MultiByteToWideChar WideCharToMultiByte IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapFree HeapAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode GetStringTypeW CloseHandle ReadFile SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize HeapReAlloc WriteConsoleW CreateFileW SetEndOfFile GetLastError IsBadReadPtr LoadLibraryA

ole32

CoUninitialize CoInitialize

shlwapi

PathRemoveFileSpecW PathAppendW

advapi32

CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_4018f68b3f88a1eb985f42c4b35cb2ca_amadey_darkgate_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

kernel32

ole32

shlwapi

advapi32

generic