2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 5.5MB
Sample260804-gvkebasemf
SHA256 19a20920378362661d3647061a429ce8ad01ea287f5395f3a8c043c8cd2b00d5
MD5 9d0c9f6c69ba37ece74433f49ac1eebc
SHA1 1cabcdf1ba62b755b9624404581a1880673aa761
SHA512 e86bbde48e8498fffc54e3217bb066fce317f40204c162a46d809868b5d6fdba4f4d48db4934d41925d5c5f6628a8fdd0ed15f0fb7fc1ac746de5e55a77089be
SSDEEP 49152:mtqiKYHrJg1NNNRNNNTONZ/TO98VChBtzysUVap/UkKYHrJg1NNNRNNNTONZ/TOk:JqybtzysiQybtzysi
TLSH
T10246BE00EFA16836FC3645364DAA23764438ED31F74205DFA293FA1E57649F2293729B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 5.5MB

2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 8856c16e2feac2fb8bf44af20c72cce6
SHA256 19a20920378362661d3647061a429ce8ad01ea287f5395f3a8c043c8cd2b00d5
MD5 9d0c9f6c69ba37ece74433f49ac1eebc
SHA1 1cabcdf1ba62b755b9624404581a1880673aa761
SHA512 e86bbde48e8498fffc54e3217bb066fce317f40204c162a46d809868b5d6fdba4f4d48db4934d41925d5c5f6628a8fdd0ed15f0fb7fc1ac746de5e55a77089be
SSDEEP 49152:mtqiKYHrJg1NNNRNNNTONZ/TO98VChBtzysUVap/UkKYHrJg1NNNRNNNTONZ/TOk:JqybtzysiQybtzysi
TLSH
T10246BE00EFA16836FC3645364DAA23764438ED31F74205DFA293FA1E57649F2293729B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CreateDirectoryW CreateFileW CreateProcessW DeleteCriticalSection EnterCriticalSection FindResourceW FormatMessageA GetCurrentProcess GetCurrentProcessId GetFileInformationByHandle GetFileInformationByHandleEx GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempPathW GetTickCount InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadLibraryA LoadResource LocalFree LockResource MultiByteToWideChar ReleaseSRWLockExclusive ReleaseSRWLockShared SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TlsGetValue VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteFile

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _ftelli64 _wfopen fclose fflush fputc fread fseek fwrite setbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __sys_nerr _assert _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

_isctype_l _iswlower_l _strdup mbrlen memset strcmp strlen strncmp tolower toupper wcslen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtof wcrtomb wcrtomb_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

Name

.text

Size

323KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

1024B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/66

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

winhttp

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic