2026-08-03_17bc8a2e04af1137dded67ad95825d5e_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_17bc8a2e04af1137dded67ad95825d5e_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 1.6MB
Sample260804-dwrm8scb96
SHA256 1c1b973f4f62069ab6486becf9f2ab2b578a09ea8f0e714712da27cf3c9a7aec
MD5 17bc8a2e04af1137dded67ad95825d5e
SHA1 2ce4f73c284c7736b2d92089e7ee79d9601e0aa2
SHA512 21415a44a689b1c482decfb8e6b9752c6dcf3dfd334fed1cfe245882cd7e78a05b45ed9d11daeea9c6b49daf1c0378ede039aa23f5b46e1f17d769d2ebdfcec3
SSDEEP 24576:RG1zuL0O+FZ1dT1juWwBz8Q5izdWxJSeIMzylPCglKy7:cW0Z1d1SiQUgxENqylnlKy7
TLSH
T125759E213A82C032D96211B1953DABBA94ADE9312F7145C7E3D81F7A5E305D36E31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_17bc8a2e04af1137dded67ad95825d5e_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 1.6MB

2026-08-03_17bc8a2e04af1137dded67ad95825d5e_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 8b3d4aa1b56dd5d1b60810c000142262
SHA256 1c1b973f4f62069ab6486becf9f2ab2b578a09ea8f0e714712da27cf3c9a7aec
MD5 17bc8a2e04af1137dded67ad95825d5e
SHA1 2ce4f73c284c7736b2d92089e7ee79d9601e0aa2
SHA512 21415a44a689b1c482decfb8e6b9752c6dcf3dfd334fed1cfe245882cd7e78a05b45ed9d11daeea9c6b49daf1c0378ede039aa23f5b46e1f17d769d2ebdfcec3
SSDEEP 24576:RG1zuL0O+FZ1dT1juWwBz8Q5izdWxJSeIMzylPCglKy7:cW0Z1d1SiQUgxENqylnlKy7
TLSH
T125759E213A82C032D96211B1953DABBA94ADE9312F7145C7E3D81F7A5E305D36E31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

18:77:92:c9:6c:1b:b0:c9:9f:15:f3:d0:51:0d:1c:9c:b9:2a:c2:4d:88:7b:d2:bd:9e:c1:5a:17:4c:c7:55:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100394487762T,CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:07:8e:70:ea:ee:48:ff:eb:95:76:bd:d4:00:be:98

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - May 20, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

408948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\hardware_info\ComputerZService\computerz_service\ComputerZService\Release\ComputerZService.pdb

kernel32

CloseHandle WaitForSingleObject GetCurrentThreadId GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx GetCurrentProcess GetExitCodeProcess FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceW WideCharToMultiByte DecodePointer RaiseException SetUnhandledExceptionFilter AddVectoredExceptionHandler InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentProcessId TerminateProcess VirtualProtect LoadLibraryExW lstrcmpiW IsBadReadPtr MultiByteToWideChar WerSetFlags CreateFileW DeleteFileW GetFileAttributesW GetFileSizeEx ReadFile SetFileAttributesW WriteFile WritePrivateProfileStringW GetCommandLineW GetLongPathNameW GetShortPathNameW CreateMutexW OpenProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep GetTickCount64 FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW GetNamedPipeInfo GetNamedPipeHandleStateW SetEvent ResetEvent CreateEventW WaitForMultipleObjects PeekNamedPipe GetOverlappedResult CancelIo GetTimeZoneInformation GetVersionExW GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange WaitForSingleObjectEx OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA ReadConsoleW SetEndOfFile SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW WriteConsoleW GetACP GetStdHandle GetModuleFileNameA ExitProcess GetConsoleMode GetSystemInfo VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree FormatMessageW GetStringTypeW InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReleaseMutex LocalFree CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetFilePointer UnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter FindClose GetSystemDirectoryW GetWindowsDirectoryW FindFirstFileW FindNextFileW GetCurrentThread OpenThread SetThreadPriority GetThreadPriority GetThreadContext SuspendThread ResumeThread GetThreadSelectorEntry InterlockedExchangeAdd DeviceIoControl lstrcmpA lstrcmpiA CreateFileA CopyFileW FindFirstFileA FindNextFileA GetTempPathW GetFileSize RtlUnwind InterlockedFlushSList CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW SetConsoleCtrlHandler GetFileType SetFilePointerEx GetConsoleCP

user32

SetWindowLongW GetWindowLongW KillTimer SetTimer CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW LoadCursorW GetWindowThreadProcessId FindWindowExW IsWindow SendMessageTimeoutW CharNextW DestroyWindow UnregisterClassW PeekMessageW DispatchMessageW TranslateMessage GetMessageW PostQuitMessage wsprintfW UnregisterClassA PostMessageW

oleaut32

SysAllocString VarUI4FromStr VariantInit SysFreeString VariantClear

generic

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=1, id=208, version=65501,

count=17, id=241, version=40116,

count=168, id=243, version=40116,

count=30, id=242, version=40116,

count=3, id=261, version=27032,

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=260, version=27031,

count=8, id=261, version=27031,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=75, id=261, version=26706,

count=1, id=206, version=65501,

count=7, id=203, version=65501,

count=280, id=1, productName=Unmarked objects,

count=47, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,