2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 5.3MB
Sample260804-m94z6aaa99
SHA256 cbc08df98b863c5c8ad04e8f236158dfcf38d109c0dbc2c91780df654234b8af
MD5 7ca94ffc8538ab51a42a81ad62d49430
SHA1 86d2c213e857466aa9a041544aaf077825ebe351
SHA512 feac996efbe2bb68465a2130bff5a088e4084280584f6b4156e3ab8b421df34f810dacb5916753fd1fd8be76c880b38b924b78907d86ec1ec6956f8692a21612
SSDEEP 98304:Hk30qkPAFugGqqdGTmnxgDv4DJxTuUygn80XVobXaE/TXVe6Z8b:E30DEGnGTXSuqn80XebXaE/TXVeI8b
TLSH
T1F946E030BB498171E8A201B06A7DABBA447DB635277508CBFAD01F6D58709C37A36F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 5.3MB

2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH 8903159676c2883ac9268ebd2f8db820
SHA256 cbc08df98b863c5c8ad04e8f236158dfcf38d109c0dbc2c91780df654234b8af
MD5 7ca94ffc8538ab51a42a81ad62d49430
SHA1 86d2c213e857466aa9a041544aaf077825ebe351
SHA512 feac996efbe2bb68465a2130bff5a088e4084280584f6b4156e3ab8b421df34f810dacb5916753fd1fd8be76c880b38b924b78907d86ec1ec6956f8692a21612
SSDEEP 98304:Hk30qkPAFugGqqdGTmnxgDv4DJxTuUygn80XVobXaE/TXVe6Z8b:E30DEGnGTXSuqn80XebXaE/TXVeI8b
TLSH
T1F946E030BB498171E8A201B06A7DABBA447DB635277508CBFAD01F6D58709C37A36F17
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2395040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Surfright\Producten\Alert\branch-2xxx\bin\Release\hmpalert.pdb

kernel32

CloseHandle InterlockedIncrement QueueUserWorkItem GetSystemTimeAsFileTime CreateDirectoryW DeleteCriticalSection CompareFileTime InitializeCriticalSection EnterCriticalSection GetWindowsDirectoryW TryEnterCriticalSection LeaveCriticalSection InterlockedDecrement MultiByteToWideChar WideCharToMultiByte InterlockedExchange InterlockedCompareExchange CreateEventW CreateThread SignalObjectAndWait TerminateThread WaitForSingleObject FindResourceW SizeofResource LoadResource LockResource FreeResource GetLastError Sleep GetCurrentProcess GetModuleHandleA GetProcAddress WTSGetActiveConsoleSessionId LocalAlloc GetDriveTypeW GetVolumeInformationW FileTimeToSystemTime GetDateFormatW SetEvent ResetEvent SetThreadPriority GetCurrentThread GetTickCount OpenProcess DuplicateHandle GetModuleHandleExW GetLogicalDriveStringsW QueryDosDeviceW GetLongPathNameW GlobalAlloc GlobalLock GlobalUnlock FileTimeToLocalFileTime GetComputerNameW GetCurrentProcessId WaitForMultipleObjects WaitForSingleObjectEx GetOverlappedResult CancelIo CreateWaitableTimerW SetWaitableTimer CreateFileA GetFileSize CreateTimerQueue DeleteTimerQueueEx CopyFileW DeleteFileW DeleteTimerQueueTimer CreateTimerQueueTimer ReadDirectoryChangesW FreeLibrary ReadFile GetFileInformationByHandle IsWow64Process LoadLibraryW ReadProcessMemory QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA ProcessIdToSessionId WriteFile FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryA LoadLibraryExA VirtualProtect LoadLibraryExW GetFileSizeEx GetSystemTime SetLastError CreateHardLinkW MoveFileExW OpenEventW GetCurrentThreadId SetFilePointer GetComputerNameA GetLocalTime GlobalFree GetModuleFileNameW GetExitCodeProcess TerminateProcess GetTimeZoneInformation GetVersionExW CreateProcessW CreateEventA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate CreateFileW GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW CreateIoCompletionPort DisconnectNamedPipe GetQueuedCompletionStatus CreateNamedPipeW ConnectNamedPipe PeekNamedPipe GetProcessTimes WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetFileType GetACP ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer SwitchToThread GetStringTypeW TransactNamedPipe CancelWaitableTimer ResumeThread InitializeCriticalSectionAndSpinCount GetCalendarInfoA MulDiv ConvertDefaultLocale VerifyVersionInfoW VerSetConditionMask GetSystemWow64DirectoryW OpenMutexW GetNativeSystemInfo GetModuleHandleExA GetConsoleMode VirtualAlloc GetStdHandle VirtualFree SetNamedPipeHandleState WaitNamedPipeW GetModuleHandleW VirtualQuery RaiseException DeviceIoControl GetSystemDirectoryW LocalFree HeapSize SystemTimeToFileTime

user32

GetUserObjectInformationW GetAsyncKeyState TrackPopupMenu ModifyMenuW EnumDesktopWindows ChildWindowFromPointEx ScrollDC CreateIconIndirect LoadImageW EnableMenuItem SetMenuDefaultItem AppendMenuW CreatePopupMenu RegisterWindowMessageA ChangeDisplaySettingsW EnumDisplaySettingsW PostQuitMessage GetMessageW WindowFromPoint SetWindowTextW SetWindowLongW EnableWindow SetFocus SetCursor TrackMouseEvent GetPropW SetPropW MoveWindow SetParent UpdateWindow SetCursorPos ClientToScreen MapWindowPoints GetClassNameW EnumWindows MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetMonitorInfoW MonitorFromWindow GetWindowRect GetCursorPos GetWindow GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowRgn EqualRect IsZoomed ShowWindow GetParent CallNextHookEx IsWindowVisible RealGetWindowClassA IsRectEmpty IsIconic SetLayeredWindowAttributes EndPaint BeginPaint UnhookWinEvent UnhookWindowsHookEx MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageW SetWindowsHookExW SetWinEventHook GetForegroundWindow SystemParametersInfoW GetSystemMetrics GetClientRect CallWindowProcW GetWindowTextLengthW SendMessageW RegisterClassW GetClassInfoW GetIconInfo DestroyIcon ReleaseCapture SetCapture ScreenToClient DrawFocusRect InflateRect InvalidateRect PtInRect SetRectEmpty OffsetRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CharUpperW ReleaseDC GetDC MessageBoxExW GetDesktopWindow RedrawWindow SetWindowPos DrawIconEx SetRect PostMessageW KillTimer SetTimer MessageBoxW DrawTextW CopyRect FillRect AllowSetForegroundWindow FindWindowExW CharUpperBuffW CharLowerW CharLowerBuffW ExitWindowsEx RegisterWindowMessageW GetThreadDesktop IsDialogMessageW SwitchDesktop OpenInputDesktop GetUserObjectInformationA CloseDesktop AttachThreadInput SetForegroundWindow BringWindowToTop IsWindowEnabled GetClipboardData DefWindowProcW IsClipboardFormatAvailable DispatchMessageW

fltlib

FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceFindClose FilterGetDosName

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

500KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_7ca94ffc8538ab51a42a81ad62d49430_amadey_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

fltlib

mpr

netapi32

generic