2026-07-30_b29c4d48149dc4d9d5448066ddc1c116_amadey_darkgate_elex_luca-stealer_njrat_ransomhub_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_b29c4d48149dc4d9d5448066ddc1c116_amadey_darkgate_elex_luca-stealer_njrat_ransomhub_remcos_smoke-loader
Size 2.8MB
Sample260730-fp1zfatvbz
SHA256 96de45f42364fc67b5ccdb46692da5d347aac249bcdfebc1e497ce694d07e4a4
MD5 b29c4d48149dc4d9d5448066ddc1c116
SHA1 44642ac252d38503ca54e4074079f4c520b85cd7
SHA512 e6c3f31ef3e968c1d0ccd8f2a4f289348133f227c7ce1782e9dec374fcc76ce6c7116df1cfd08217627b4e61ed03204c76bef89f560e07c4aa3b36520e02619e
SSDEEP 49152:M9ibv/s5WFkfNwSiEmzJxP9DBebwe8A5pKijOE20U1kHWvQA0gPq:M9ibXs5bGYmzJ19DBebwS5pKijOE2NSr
TLSH
T14BD5AE123E6063B2C5A386705D48F37AF1ADAD700F3D41C793C4FA2E29F55B14A19A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_b29c4d48149dc4d9d5448066ddc1c116_amadey_darkgate_elex_luca-stealer_njrat_ransomhub_remcos_smoke-loader

.exe 2.8MB

2026-07-30_b29c4d48149dc4d9d5448066ddc1c116_amadey_darkgate_elex_luca-stealer_njrat_ransomhub_remcos_smoke-loader

IMPHASH 1b9922acc98a2ef4ba18c708ccc4906c
SHA256 96de45f42364fc67b5ccdb46692da5d347aac249bcdfebc1e497ce694d07e4a4
MD5 b29c4d48149dc4d9d5448066ddc1c116
SHA1 44642ac252d38503ca54e4074079f4c520b85cd7
SHA512 e6c3f31ef3e968c1d0ccd8f2a4f289348133f227c7ce1782e9dec374fcc76ce6c7116df1cfd08217627b4e61ed03204c76bef89f560e07c4aa3b36520e02619e
SSDEEP 49152:M9ibv/s5WFkfNwSiEmzJxP9DBebwe8A5pKijOE20U1kHWvQA0gPq:M9ibXs5bGYmzJ19DBebwS5pKijOE2NSr
TLSH
T14BD5AE123E6063B2C5A386705D48F37AF1ADAD700F3D41C793C4FA2E29F55B14A19A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

18:f3:01:22:e1:3e:7b:75:0f:ff:90:59:64:55:ca:2c:67:a9:7b:cd:8b:72:3b:80:32:c1:f9:9c:46:48:3d:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Minor OS version

Major OS version

Entry point

1536819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRAppPB.pdb

kernel32

FlsAlloc ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP ExitProcess GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency VirtualQuery VirtualAlloc HeapQueryInformation GetCommandLineW FlsSetValue GetModuleHandleExW FreeLibraryAndExitThread GetTimeZoneInformation MoveFileExW RtlUnwind GetCPInfo LCMapStringEx GetStringTypeW RaiseException FlsGetValue FlsFree LCMapStringW IsValidLocale EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetUserDefaultLCID GetProfileIntW SearchPathW SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode lstrcmpiW DuplicateHandle UnlockFile SetFilePointer SetEndOfFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers GetFileSize GetCurrentDirectoryW lstrcpyW FindResourceExW GlobalFlags GetSystemDefaultUILanguage GetLocaleInfoW GetThreadLocale FileTimeToSystemTime GlobalGetAtomNameW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetTickCount64 CompareStringA lstrcmpA GetCurrentThread VirtualProtect ResumeThread CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA EncodePointer FormatMessageW GlobalSize DecodePointer HeapReAlloc HeapSize InitializeCriticalSectionEx GetLocalTime SetThreadUILanguage GetUserDefaultUILanguage MulDiv GetTickCount lstrcpynW CopyFileW SetCurrentDirectoryW QueryPerformanceCounter GetSystemInfo GetFileAttributesW CreateDirectoryW GetWindowsDirectoryW GetSystemTimeAsFileTime GetVersionExW WTSGetActiveConsoleSessionId GetModuleHandleW GetModuleFileNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetSystemDirectoryW OpenProcess CreateProcessW SetLastError TerminateProcess GetCurrentProcess LocalFree VerifyVersionInfoW VerSetConditionMask DeleteFileW GetTempFileNameW GetTempPathW GlobalFree GlobalUnlock GlobalLock GlobalAlloc OutputDebugStringW FreeLibrary GetProcAddress LoadLibraryW OutputDebugStringA SetNamedPipeHandleState FindClose FindNextFileW FindFirstFileW WideCharToMultiByte InitializeCriticalSectionAndSpinCount WriteFileEx ReadFileEx HeapFree DisconnectNamedPipe GetExitCodeThread ExitThread GetProcessHeap HeapAlloc GetOverlappedResult WaitForMultipleObjectsEx ConnectNamedPipe CreateNamedPipeW ReadFile WriteFile ProcessIdToSessionId ResetEvent WaitNamedPipeW GetLastError CreateFileW FindResourceW LoadResource LockResource SizeofResource CreateEventW SetEvent GetCurrentProcessId MultiByteToWideChar CreateThread Sleep SetThreadPriority TerminateThread CloseHandle WaitForSingleObject GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCommandLineA WriteConsoleW

user32

MapVirtualKeyW GetKeyNameTextW MapDialogRect GetAsyncKeyState TranslateMessage GetMessageW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW WindowFromPoint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW MapWindowPoints MessageBoxW GetWindowTextLengthW RemovePropW GetPropW SetPropW GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgItem EndDeferWindowPos InflateRect BeginDeferWindowPos SetWindowPos DestroyWindow IsChild IsMenu CreateWindowExW EmptyClipboard DrawStateW CharUpperW PostMessageW EnableWindow LoadBitmapW GetClassInfoExW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime PeekMessageW GetSystemMenu RegisterWindowMessageW LoadMenuW RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW UnregisterClassW GetClassInfoW GetKeyboardLayout GetGUIThreadInfo OffsetRect SetRectEmpty IsRectEmpty GetFocus FindWindowW BringWindowToTop DrawIcon IsIconic GetWindowLongW SetWindowLongW GetMessageExtraInfo LoadIconW IsWindow SetLayeredWindowAttributes EqualRect CopyRect TrackMouseEvent EnumDisplayMonitors GetMonitorInfoW EnumDisplayDevicesW SystemParametersInfoW SetForegroundWindow SetWindowPlacement IntersectRect SendDlgItemMessageA PostQuitMessage IsZoomed MessageBeep SetWindowContextHelpId RegisterClipboardFormatW ShowOwnedPopups GetSysColorBrush DestroyMenu GetMenuItemInfoW CopyImage RealChildWindowFromPoint DestroyIcon DeleteMenu LoadAcceleratorsW GetWindowPlacement GetForegroundWindow TranslateAcceleratorW CreatePopupMenu InsertMenuItemW UnpackDDElParam ReuseDDElParam SetParent MonitorFromPoint OpenClipboard CloseClipboard DeferWindowPos GetClientRect FillRect SendMessageW GetWindowRect GetParent InvalidateRect RedrawWindow ShowScrollBar GetSystemMetrics PtInRect KillTimer SetTimer SetCapture ReleaseCapture GetDC ReleaseDC DrawFocusRect GetCursorPos ScreenToClient SetCursor LoadCursorW SubtractRect GetMessagePos SetWindowRgn GetSysColor LoadImageW WindowFromDC SetRect BeginPaint EndPaint ClientToScreen AdjustWindowRectEx MoveWindow GetWindow GetDlgCtrlID GetWindowThreadProcessId GetDesktopWindow GetWindowTextW IsWindowVisible GetClassNameW ShowWindow NotifyWinEvent ModifyMenuW PostThreadMessageW WaitMessage ToUnicodeEx GetKeyboardState CreateAcceleratorTableW SetClipboardData DestroyAcceleratorTable CopyAcceleratorTableW EnumChildWindows LockWindowUpdate SetClassLongW CharNextW InvalidateRgn GetNextDlgGroupItem GetMenuDefaultItem DrawIconEx GetIconInfo EnableScrollBar HideCaret InvertRect DrawEdge DrawFrameControl SetCursorPos CopyIcon FrameRect UnionRect CharUpperBuffW UpdateLayeredWindow SetMenuDefaultItem IsClipboardFormatAvailable DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsCharLowerW MapVirtualKeyExW GetWindowRgn DestroyCursor CreateMenu GetDoubleClickTime GetComboBoxInfo GetUpdateRect DispatchMessageW

gdi32

SetLayout GetLayout SetPolyFillMode SetROP2 SetStretchBltMode SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt GetMapMode SetRectRgn DPtoLP GetTextExtentPoint32W GetTextMetricsW EnumFontFamiliesExW CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits SetMapMode SetPixel CreateDIBSection SetDIBColorTable GetRgnBox OffsetRgn CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline LPtoDP Rectangle RoundRect ExtFloodFill SetPaletteEntries GetViewportOrgEx GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV SetBkMode SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap SetTextColor SetBkColor CreateDCW CopyMetaFileW GetBkColor GetTextColor CreateRoundRectRgn CreateFontW GetTextExtentPointA GetTextMetricsA GetStockObject DeleteObject CombineRgn CreateRectRgn DeleteDC GetDeviceCaps SelectObject StretchBlt GetObjectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW RealizePalette IntersectClipRect

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

EqualSid RevertToSelf InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueW FreeSid AllocateAndInitializeSid CreateProcessAsUserW OpenProcessToken DuplicateTokenEx GetTokenInformation ImpersonateLoggedOnUser RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryValueExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegCloseKey RegOpenCurrentUser

shell32

ShellExecuteW SHCreateDirectoryExW DragQueryFileW DragFinish SHAppBarMessage SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHGetDesktopFolder SHBrowseForFolderW SHGetFolderPathW

comctl32

ImageList_GetImageInfo InitCommonControlsEx ImageList_ReplaceIcon

shlwapi

PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName IsThemeBackgroundPartiallyTransparent GetThemePartSize IsAppThemed GetWindowTheme GetThemeSysColor

ole32

OleLockRunning CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleGetClipboard DoDragDrop CoInitializeEx CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CoInitialize CoFreeUnusedLibraries CLSIDFromProgID CLSIDFromString CoCreateGuid CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc OleUninitialize CoCreateInstance OleInitialize CreateStreamOnHGlobal

oleaut32

SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantInit VariantCopy VarBstrFromDate OleCreateFontIndirect LoadTypeLi SysAllocString VariantChangeType SysFreeString SysAllocStringLen VariantClear

oledlg

OleUIBusyW

gdiplus

GdipBitmapLockBits GdipSetInterpolationMode GdipBitmapUnlockBits GdipDrawImageI GdipLoadImageFromStream GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteFontFamily GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateFontFamilyFromName GdipDeleteRegion GdipCreateRegion GdipSetStringFormatMeasurableCharacterRanges GdipMeasureCharacterRanges GdipGetRegionBounds GdipCreateFromHDC GdipDeleteGraphics GdipGetStringFormatLineAlign GdipCreateFont GdipDeleteFont GdipCloneStringFormat GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreatePen2 GdipDeletePen GdipDrawString GdipGetFontHeight GdipSetSolidFillColor GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectRectI GdipMeasureString GdipSetStringFormatTrimming GdipBitmapGetPixel GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateHICONFromBitmap GdipDrawImagePointRect GdipDrawImageRectRect GdipSetCompositingMode GdipFillRectangleI GdipCreatePen1 GdipDrawLineI GdipCreateRegionHrgn GdipFillRegion GdipCreatePath GdipDeletePath GdipStartPathFigure GdipCreateBitmapFromScan0 GdipClosePathFigure GdipSetPenMode GdipDrawPath GdipGetStringFormatFlags GdiplusStartup GdiplusShutdown GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipAddPathArcI

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSUnRegisterSessionNotification WTSRegisterSessionNotification

d3d9

Direct3DCreate9

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

390KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

480KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_b29c4d48149dc4d9d5448066ddc1c116_amadey_darkgate_elex_luca-stealer_njrat_ransomhub_remcos_smoke-loader

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

userenv

wtsapi32

d3d9

oleacc

imm32

winmm

generic