2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

General

Target
2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos
Size 6.8MB
Sample260730-1bv69azzds
SHA256 c5c59c4fb4f4ec2ff4af01f0164736a98fdb7fa33ebcd613bad91875ecfc234b
MD5 240ba2c41343fcd301213d16adb6d9dc
SHA1 0e150b3964a51dd8a4e7d3e046e08d09f1e97b70
SHA512 4ebf7ae9b5577564d4ec7e39a20092380208a99881a65fbe77921195cba4a1925e4085db87b3528c2fc3866a98251dcc2234e9fa7ae627bbb69d1a0720264dfa
SSDEEP 98304:KxzMrBj1TcZ5MlbXChzXDYxZWh2jYGU3iEFg/6XvqL0aZe8lVQxaJBz:iMrBjiZWlbXChzXDYx73UOuvYe8zL
TLSH
T166668C217A41C13BF88212B1DDBDAB7B849CEA15072811D7B3E81F5D6E715C32E36A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

.exe 6.8MB

2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

IMPHASH 11f80f014b396260b736036246b7b2ae
SHA256 c5c59c4fb4f4ec2ff4af01f0164736a98fdb7fa33ebcd613bad91875ecfc234b
MD5 240ba2c41343fcd301213d16adb6d9dc
SHA1 0e150b3964a51dd8a4e7d3e046e08d09f1e97b70
SHA512 4ebf7ae9b5577564d4ec7e39a20092380208a99881a65fbe77921195cba4a1925e4085db87b3528c2fc3866a98251dcc2234e9fa7ae627bbb69d1a0720264dfa
SSDEEP 98304:KxzMrBj1TcZ5MlbXChzXDYxZWh2jYGU3iEFg/6XvqL0aZe8lVQxaJBz:iMrBjiZWlbXChzXDYx73UOuvYe8zL
TLSH
T166668C217A41C13BF88212B1DDBDAB7B849CEA15072811D7B3E81F5D6E715C32E36A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4019067

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\projects\lua_updater\testing\drweb-updater\msvc\Win32\Release\drwupsrv.pdb

kernel32

SetLastError GetLastError GetProcAddress GetModuleHandleW GetFileSize CreateProcessA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW CreateDirectoryW ReadFile WriteFile RemoveDirectoryW CreateFileW GetFileAttributesW GetCurrentThreadId GetFileAttributesExW DeleteFileW CloseHandle SetFilePointerEx LocalFree GetCurrentProcessId FormatMessageA MoveFileW RestoreLastError MultiByteToWideChar FormatMessageW GetSystemInfo WideCharToMultiByte SetDllDirectoryW HeapFree GetModuleFileNameW InitializeCriticalSectionAndSpinCount GetSystemDirectoryW GetComputerNameExW HeapSize GetVersion GetDiskFreeSpaceExW HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap LoadLibraryW FreeLibrary GetSystemDefaultLCID GetCurrentProcess LocalAlloc InterlockedExchange EnterCriticalSection GetCommandLineW InterlockedDecrement WaitForMultipleObjects LeaveCriticalSection SetErrorMode WaitForSingleObject PostQueuedCompletionStatus SetEvent TerminateThread TlsAlloc InterlockedExchangeAdd FreeConsole QueueUserAPC InterlockedIncrement TlsFree SetFileApisToANSI CreateEventA CreateMutexW OpenMutexW SetWaitableTimer InitializeCriticalSection TlsSetValue ReleaseSemaphore InterlockedCompareExchange GetQueuedCompletionStatus CreateEventW SleepEx VerifyVersionInfoW TlsGetValue CreateSemaphoreA CreateIoCompletionPort OpenEventW FindFirstFileW TerminateProcess FindClose OpenProcess CreateProcessW GetExitCodeProcess DeviceIoControl Sleep GetTickCount ExpandEnvironmentStringsW GetDriveTypeW QueryPerformanceCounter EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency GetCurrentDirectoryW FindNextFileW GetFileInformationByHandle GetFullPathNameW SetFileAttributesW GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW GetStringTypeW GetSystemTimeAsFileTime GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW ResetEvent InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW OutputDebugStringW WaitForMultipleObjectsEx OpenEventA ResumeThread GetModuleHandleA CreateWaitableTimerA CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx SetStdHandle GetFileType ExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle GetCommandLineA GetACP GetTimeZoneInformation GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW SetEndOfFile VirtualQuery LoadLibraryExA PeekNamedPipe CreateFileA GetSystemDirectoryA GlobalAlloc GlobalFree GetComputerNameA CreateWaitableTimerW LoadLibraryA GetOverlappedResult GetFullPathNameA GetFileSizeEx ReleaseMutex UnmapViewOfFile CreateFileMappingA MapViewOfFile CreateFileMappingW SetHandleInformation CreatePipe SetThreadExecutionState GetEnvironmentVariableW GetWindowsDirectoryW GetEnvironmentVariableA

ntdll

RtlUnwind VerSetConditionMask

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_240ba2c41343fcd301213d16adb6d9dc_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_njrat_remcos

kernel32

ntdll

generic