2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader
Size 1.2MB
Sample260802-epwjaathpf
SHA256 c04db801d488e5166da8758f4ed3cba55a38eb1ed5919b00bf596818286a4c47
MD5 7c3f809b229726c8b42dd109c443f6d2
SHA1 3ab327012fc1c5b770f0a07781cd803a60817860
SHA512 e359421fe720ef889f7e0c3935f6c66ee6ffd5fb04109804c807367dc3ea367745481891960a95b14f3092d559b4d0f5c80fc083081542bed3b038b4e9f8d875
SSDEEP 24576:qFMhqrJrdPQs1KzV8cFSHOgHCzAexPUzhFg7i5MeSuBXI3CarHRQTSsb8rEH7jF:qRRKzVtSdZhe7i5PXGDHRQTVbd
TLSH
T19B458D21F9818172E6E240B2A2BDCF768E6DA574073A50C7E3D42DA859305D37B3DB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader

.exe 1.2MB

2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 949702a4ec364bbd58c950ed402fca0e
SHA256 c04db801d488e5166da8758f4ed3cba55a38eb1ed5919b00bf596818286a4c47
MD5 7c3f809b229726c8b42dd109c443f6d2
SHA1 3ab327012fc1c5b770f0a07781cd803a60817860
SHA512 e359421fe720ef889f7e0c3935f6c66ee6ffd5fb04109804c807367dc3ea367745481891960a95b14f3092d559b4d0f5c80fc083081542bed3b038b4e9f8d875
SSDEEP 24576:qFMhqrJrdPQs1KzV8cFSHOgHCzAexPUzhFg7i5MeSuBXI3CarHRQTSsb8rEH7jF:qRRKzVtSdZhe7i5PXGDHRQTVbd
TLSH
T19B458D21F9818172E6E240B2A2BDCF768E6DA574073A50C7E3D42DA859305D37B3DB4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4a:0b:3e:75:fa:89:3a:79:cc:82:a7:39:42:96:01:8b:38:4f:db:99:9d:d8:dc:02:32:a5:d9:d6:92:d8:2b:74

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Chains

Jun 3, 2026

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Serial Number

05:f0:d8:13:d6:a6:f0:04:57:5a:20:99

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2025 - Oct 9, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

727599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

if_nametoindex

ws2_32

socket htons closesocket WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt ntohs WSAStartup gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup

wldap32

ord45 ord50 ord60 ord211 ord46 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord217 ord301 ord200

crypt32

CertFindCertificateInStore CertCreateCertificateContext CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext PFXImportCertStore CryptStringToBinaryA CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryW CertFreeCertificateChain CertGetCertificateChain CryptQueryObject CertGetNameStringW CertNameToStrW CryptImportPublicKeyInfoEx2 CertFindExtension CertGetCertificateContextProperty CryptDecodeObjectEx

secur32

InitSecurityInterfaceA

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathIsDirectoryW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathFileExistsA

wintrust

WinVerifyTrust

sensapi

IsDestinationReachableW IsNetworkAlive

kernel32

ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode FlushFileBuffers HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle SetEndOfFile GetCurrentDirectoryW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime IsValidCodePage GetACP GetFileInformationByHandle GetDriveTypeW CreateFileW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount ExpandEnvironmentStringsW GetOEMCP GetLocalTime GetWindowsDirectoryW LocalFree FormatMessageW lstrcpyW lstrlenW GetTimeFormatEx GetDateFormatEx MultiByteToWideChar WideCharToMultiByte CompareFileTime GetSystemTimeAsFileTime GetModuleFileNameW LocalAlloc CreateDirectoryW DeleteFileW OutputDebugStringW CloseHandle OpenMutexW Sleep CreateThread GetCurrentThreadId MulDiv lstrcmpW MoveFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SetLastError CreateFileA GetFullPathNameW MoveFileExA GetEnvironmentVariableA GetModuleHandleA GetProcAddress GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW FormatMessageA GetFileSizeEx InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW WakeConditionVariable RtlUnwind RaiseException InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess WakeAllConditionVariable SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleHandleW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize TryAcquireSRWLockExclusive GetExitCodeThread HeapFree GetLastError LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW GetStringTypeW

user32

SendMessageW CreateWindowExW GetDlgItemTextW SetWindowPos SystemParametersInfoW LoadImageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowExW MessageBoxW MessageBoxA GetWindowRect SetWindowTextW ReleaseDC GetDC GetSystemMetrics EnableWindow SendDlgItemMessageW SetDlgItemTextW GetDlgItemInt SetDlgItemInt GetDlgItem EndDialog DialogBoxParamW

gdi32

DeleteObject GetDeviceCaps CreateFontW

advapi32

CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA

shell32

SHCreateDirectoryExW SHFileOperationW SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoUninitialize OleRun

oleaut32

VariantClear SysFreeString SysAllocString SysAllocStringByteLen GetErrorInfo SysStringByteLen

ncrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptVerifySignature BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenRandom

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_7c3f809b229726c8b42dd109c443f6d2_amadey_darkgate_elex_floxif_glassworm_luca-stealer_njrat_smoke-loader

PE Signature issue

iphlpapi

ws2_32

wldap32

crypt32

secur32

comctl32

shlwapi

wintrust

sensapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ncrypt

generic