2026-08-04_8bd9223233edc3b1d55946f835202cd4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_8bd9223233edc3b1d55946f835202cd4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 27.1MB
Sample260804-x3hhpaybpc
SHA256 942a4b71d056129de8dc972933c4104d43de1d91f2e1e38023687bb021cbb68d
MD5 8bd9223233edc3b1d55946f835202cd4
SHA1 7814dd547b17f06d4f43ca4e5692077955b1688f
SHA512 944943c773550dfa7d24adbfe6ee9f551c754ecea64c78371b930816075b611eaa2b2b9779920d4b40609e88d3d37e55273c6e71f76d90edfa49edb197a68423
SSDEEP 393216:YADBU5DjBeilSXUcxNaEV3du54MucrKXH49Qrm+H/EHHXxhjk4eFcEZDGwcVJ1q:YkBSe8cxNtVc9QC+H/ixuZF90wcQ
TLSH
T16B5733213D45C03AD97111718A7DEAAAC4AEAE350FA144C7A3D84FBE5DB01C36E3562F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_8bd9223233edc3b1d55946f835202cd4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 27.1MB

2026-08-04_8bd9223233edc3b1d55946f835202cd4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 3f1354bfc3f47ba80e349285164d3ffa
SHA256 942a4b71d056129de8dc972933c4104d43de1d91f2e1e38023687bb021cbb68d
MD5 8bd9223233edc3b1d55946f835202cd4
SHA1 7814dd547b17f06d4f43ca4e5692077955b1688f
SHA512 944943c773550dfa7d24adbfe6ee9f551c754ecea64c78371b930816075b611eaa2b2b9779920d4b40609e88d3d37e55273c6e71f76d90edfa49edb197a68423
SSDEEP 393216:YADBU5DjBeilSXUcxNaEV3du54MucrKXH49Qrm+H/EHHXxhjk4eFcEZDGwcVJ1q:YkBSe8cxNtVc9QC+H/ixuZF90wcQ
TLSH
T16B5733213D45C03AD97111718A7DEAAAC4AEAE350FA144C7A3D84FBE5DB01C36E3562F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d7:22:2a:6d:96:0d:ac:5b:2c:35:5a:d0:f7:1e:c5:ee:47:1b:74:d9:4c:35:8d:aa:f9:13:59:47:f1:aa:2f:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100394487762T,CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 6, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:07:8e:70:ea:ee:48:ff:eb:95:76:bd:d4:00:be:98

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - May 20, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

596226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\cclean_proj\install_uninstall\install_uninstall\Release\Install.pdb

kernel32

CreateFileW GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError MoveFileExW MoveFileW FindResourceW lstrlenW SizeofResource LockResource LoadResource FindResourceExW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW UnlockFile WaitForSingleObject GetCurrentProcess CreateProcessW WriteConsoleW GetStartupInfoW GetModuleHandleW GetProcAddress LoadLibraryW WideCharToMultiByte VerSetConditionMask RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId VerifyVersionInfoW DecodePointer Sleep FreeLibrary LoadLibraryExW lstrcmpiW GetFileSize FindNextFileW FindFirstFileW FindClose LockFile GetTempFileNameA GetTempPathA CloseHandle WriteFile DeleteFileA GetTickCount64 ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlushFileBuffers GetCurrentThread GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread InitializeCriticalSectionEx GetDriveTypeW CreateEventW ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind lstrcmpiA lstrcmpA DeviceIoControl GetVersionExW GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange GetStdHandle SetEndOfFile GetFileInformationByHandle DeleteFileW ReadFile CompareFileTime FindFirstChangeNotificationW SetEvent MultiByteToWideChar FindCloseChangeNotification SetFileTime CreateDirectoryW GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW GetCurrentProcessId TerminateProcess GetExitCodeProcess OpenProcess OutputDebugStringA OutputDebugStringW GetFileSizeEx GetLocalTime ResetEvent GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile GetTempFileNameW LocalFree FormatMessageW CopyFileW GetDiskFreeSpaceExW GetSystemDirectoryW GetFileAttributesExW SetFilePointer GetTickCount WaitForMultipleObjects LocalAlloc GetPrivateProfileStringW WritePrivateProfileStringW GetShortPathNameW IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GlobalAlloc GlobalLock GlobalUnlock GlobalFree FindFirstFileA FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter OpenFileMappingW ReleaseMutex GetCurrentDirectoryW SearchPathW CreateFileA

user32

OffsetRect UnionRect EqualRect PtInRect SetCursor DrawFocusRect DestroyCursor MoveWindow DefWindowProcW GetShellWindow UnregisterClassA IsDialogMessageW GetActiveWindow EndDialog CopyRect GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow MapWindowPoints SetForegroundWindow GetSystemMetrics IsIconic IsWindowVisible PostQuitMessage CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW FillRect ScreenToClient GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DrawTextW KillTimer SetTimer ReleaseCapture SetCapture GetAsyncKeyState GetFocus SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow FindWindowW SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW wsprintfW IsWindow CallWindowProcW UnregisterClassW SendMessageW CreateWindowExW GetClassInfoExW GetWindowThreadProcessId FindWindowExW RegisterClassExW DialogBoxParamW PostMessageW WaitForInputIdle

gdi32

SelectObject SelectClipRgn SaveDC CreateDIBSection GetObjectW SetViewportOrgEx SetTextColor SetBkMode RestoreDC GetStockObject DeleteObject DeleteDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontW EnumFontFamiliesW RectVisible OffsetViewportOrgEx

advapi32

CryptContextAddRef RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW CreateWellKnownSid DuplicateTokenEx GetLengthSid GetTokenInformation SetTokenInformation RegGetValueW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService LockServiceDatabase OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceConfig2W QueryServiceLockStatusW QueryServiceStatus QueryServiceStatusEx StartServiceW UnlockServiceDatabase RegEnumValueW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHChangeNotify CommandLineToArgvW ord165 ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW

ole32

CoInitializeSecurity CreateStreamOnHGlobal OleRun CoTaskMemFree CoTaskMemRealloc CoInitializeEx CoInitialize CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid CoSetProxyBlanket

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo VariantClear VariantInit SysAllocString SysAllocStringByteLen VariantCopy CreateErrorInfo VarUI4FromStr SysFreeString

shlwapi

PathFileExistsW PathCombineW PathAppendW PathRenameExtensionA PathFindFileNameA wnsprintfW AssocQueryStringW PathFindFileNameW PathIsRootW SHSetValueA SHGetValueA StrToIntExW StrCmpIW StrTrimA StrCmpNIW StrStrIW PathFindExtensionW SHGetValueW PathRemoveFileSpecW PathIsDirectoryW PathIsRelativeW StrStrIA SHSetValueW PathIsPrefixW PathAppendA

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateBitmapFromFileICM GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

setupapi

SetupIterateCabinetW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

secur32

GetUserNameExW

crypt32

CryptStringToBinaryA CertGetNameStringW CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

generic

count=17, id=241, version=40116,

count=166, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=208, version=65501,

count=3, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=16, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=6, id=261, version=27032,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=3, id=206, version=65501,

count=39, id=203, version=65501,

count=457, id=1, productName=Unmarked objects,

count=78, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,