2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader
Size 29.5MB
Sample260805-m2cwpsek51
SHA256 e73fa19e7a45a58b9870834048fee02a518565bf809d60d4058b042fa05a7138
MD5 953c364cd80590844e5320b4431494e5
SHA1 6bda112a18895b54ec265f36816ccf5beabb3848
SHA512 71404f7d9283a84507b8b9fabc4750fc61f9c2d8739f2d9284a5657eee7f56c84cdefcab85dd16e6490cff5b0e189aca338af1bb0cd31dd7741fc200ae585f56
SSDEEP 786432:xy+zYkE+kwz8CIaVOiY5aBBD6m5S7/zgbfs3R/B:xyZbwzklkB5RS7/zCfkR/B
TLSH
T1096702603141C036D526A2F2861A5B79943866384B98D4E7FEECEC7A2D311F36772F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader

File Explorer

2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader

.exe 29.5MB

2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader

IMPHASH 83f075dd3b52d75d3575fc320c8e9245
SHA256 e73fa19e7a45a58b9870834048fee02a518565bf809d60d4058b042fa05a7138
MD5 953c364cd80590844e5320b4431494e5
SHA1 6bda112a18895b54ec265f36816ccf5beabb3848
SHA512 71404f7d9283a84507b8b9fabc4750fc61f9c2d8739f2d9284a5657eee7f56c84cdefcab85dd16e6490cff5b0e189aca338af1bb0cd31dd7741fc200ae585f56
SSDEEP 786432:xy+zYkE+kwz8CIaVOiY5aBBD6m5S7/zgbfs3R/B:xyZbwzklkB5RS7/zCfkR/B
TLSH
T1096702603141C036D526A2F2861A5B79943866384B98D4E7FEECEC7A2D311F36772F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0c:dc:0c:0d:85:1b:e3:c5:b0:77:0a:9a:27:5c:2e:9c:9c:2c:23:f5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ShenZhen Sheers Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ShenZhen Sheers Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 14, 2026

CN=ShenZhen Sheers Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ShenZhen Sheers Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Subject

CN=ShenZhen Sheers Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ShenZhen Sheers Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

04:0a:55:47:1c:d5:61:d1:17:ec:4b:aa:8c:05:6a:df

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 9, 2012 - Jul 9, 2013

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

1013333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalLock GlobalAlloc SuspendThread ReleaseMutex CreateMutexA SetFileTime LocalFileTimeToFileTime GetLocalTime SystemTimeToFileTime UnmapViewOfFile GetFileSize SetFilePointer FileTimeToLocalFileTime FileTimeToSystemTime TerminateThread GetCurrentProcess SetStdHandle GlobalUnlock IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess RaiseException GetSystemTime GetTimeZoneInformation RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile RemoveDirectoryA GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA SetLastError LocalFree InterlockedDecrement InterlockedIncrement GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress CloseHandle MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject

user32

WaitForInputIdle wsprintfA CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetDesktopWindow GetForegroundWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA LoadStringA GetSysColorBrush SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA UnregisterClassA

gdi32

SetROP2 SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart midiStreamRestart

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

Shell_NotifyIconA SHGetSpecialFolderPathA ShellExecuteA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

RegisterTypeLi LoadTypeLi UnRegisterTypeLi SystemTimeToVariantTime

comctl32

ord17 ImageList_Destroy

ws2_32

WSAAsyncSelect closesocket WSACleanup ntohl accept recvfrom ioctlsocket inet_ntoa recv getpeername

comdlg32

GetOpenFileNameA ChooseColorA GetSaveFileNameA GetFileTitleA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_953c364cd80590844e5320b4431494e5_amadey_darkgate_elex_emotet_glassworm_hijackloader_icedid_remcos_smoke-loader

PE Signature issue

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic