2026-08-06_2ed3e19573b94b00aa4e5acf914de5fb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_2ed3e19573b94b00aa4e5acf914de5fb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader
Size 9.7MB
Sample260806-3b2edack9v
SHA256 5ede60ad0268f34e60135d54e20210e389487306b06b467083e5c53e3b58e9ee
MD5 2ed3e19573b94b00aa4e5acf914de5fb
SHA1 925cfbebf4155221aa44d19c33f4faf1e258958d
SHA512 e424d27fa954c1dc6fa06145793f9122ccf969aaf9ee72e773cdf62a94d7e1c6ebf997df90d0fd8211536d10908235115a74cab7dbbc82a730c021274d35da68
SSDEEP 196608:1SD/6NJOtNUg3Oa5KrkSsW1QHtmECZ3q2AJSB4/JL/PsBZwxZrD:MGYXUTaUrrQc93TAsB2PsBSX
TLSH
T1F5A60221BA81843AC1230231483CB7BAD5BEBD602A71C1DFF799361D9B74CD1A57B297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-06_2ed3e19573b94b00aa4e5acf914de5fb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

.exe 9.7MB

2026-08-06_2ed3e19573b94b00aa4e5acf914de5fb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

IMPHASH 291c4fde75c78e08f4aad2217b8dbe88
SHA256 5ede60ad0268f34e60135d54e20210e389487306b06b467083e5c53e3b58e9ee
MD5 2ed3e19573b94b00aa4e5acf914de5fb
SHA1 925cfbebf4155221aa44d19c33f4faf1e258958d
SHA512 e424d27fa954c1dc6fa06145793f9122ccf969aaf9ee72e773cdf62a94d7e1c6ebf997df90d0fd8211536d10908235115a74cab7dbbc82a730c021274d35da68
SSDEEP 196608:1SD/6NJOtNUg3Oa5KrkSsW1QHtmECZ3q2AJSB4/JL/PsBZwxZrD:MGYXUTaUrrQc93TAsB2PsBSX
TLSH
T1F5A60221BA81843AC1230231483CB7BAD5BEBD602A71C1DFF799361D9B74CD1A57B297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

0b:2b:39:f0:76:70:66:69:19:3b:f5:91:52:4c:02:45:1e:12:99:96:19:8c:b9:43:fb:1b:71:17:5b:57:f9:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Chains

Apr 27, 2020

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4a:88:77:04:45:a0:23:68:21:4e:4f:d9:7a:9c:b4:e0:b3:47:65:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Chains

Apr 27, 2020

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Serial Number

01:bc:40:60:04:8d:7a:68:63:4c:89:bb:68:b8:99:63

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 20, 2019 - Dec 23, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Serial Number

05:29:eb:a4:d9:8a:b8:39:3a:22:78:29:ba:46:50:81

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 20, 2019 - Dec 23, 2022

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

160441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibraryAndExitThread GetCurrentDirectoryW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW ExpandEnvironmentStringsW PeekNamedPipe WaitForMultipleObjects GetSystemDirectoryA SleepEx ResetEvent SetEvent lstrlenA CreateFileMappingW UnmapViewOfFile MapViewOfFile GetFileInformationByHandle InterlockedCompareExchange CreateEventW WideCharToMultiByte OutputDebugStringA GlobalUnlock GlobalLock DeleteFileW GetTempPathW FindResourceW WriteFile SizeofResource LoadResource LockResource SetCurrentDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleHandleW GetLastError GetCurrentProcessId VirtualFree VirtualAlloc LocalFree LocalAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection InterlockedDecrement InterlockedIncrement CreateFileW WritePrivateProfileStringW GetModuleFileNameW ReadFile GetFileSize CreateThread Sleep GetCurrentProcess GlobalFree GlobalAlloc QueryDosDeviceW GetWindowsDirectoryW LoadLibraryW GetLogicalDriveStringsW lstrlenW lstrcmpiW CloseHandle OpenProcess GetProcAddress FreeLibrary MulDiv MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObject CreateProcessW MoveFileExW DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount GetSystemInfo FormatMessageW GetVersionExW GetPrivateProfileIntW GetPrivateProfileStringW FindClose CreateDirectoryW RemoveDirectoryW FindFirstFileW FindNextFileW ReleaseMutex CreateMutexW GetFileSizeEx GetTickCount AreFileApisANSI SetErrorMode GetLocalTime FlushInstructionCache HeapCreate FreeResource SetLastError GetFullPathNameW GetVersionExA LoadLibraryA GetModuleHandleA EncodePointer RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType GetStringTypeW CompareStringW LCMapStringW GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA OutputDebugStringW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetTimeZoneInformation FlushFileBuffers WriteConsoleW SetEndOfFile

user32

MonitorFromWindow GetMonitorInfoW TrackMouseEvent PostMessageW PostQuitMessage AnimateWindow SetLayeredWindowAttributes IsIconic IsZoomed GetCapture SetCapture ReleaseCapture UpdateWindow BeginPaint EndPaint InvalidateRect CreateCaret GetCaretBlinkTime HideCaret SetCaretPos ScreenToClient GetClassNameW DestroyIcon LoadBitmapW CreateIconFromResource LoadImageW CharNextW GetMessageW TranslateMessage DispatchMessageW PeekMessageW ClientToScreen EnableMenuItem GetSysColor IsWindowVisible DrawTextW SystemParametersInfoA CharLowerBuffW GetWindowRect UpdateLayeredWindow IsMenu IsWindowEnabled CreatePopupMenu DestroyMenu GetMenuItemCount GetWindow AppendMenuW TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetMenuContextHelpId MsgWaitForMultipleObjects GetForegroundWindow GetClientRect GetDlgItem CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetKeyState GetFocus SendMessageW IsWindow GetActiveWindow GetSystemMetrics GetCursorPos OffsetRect GetWindowLongW GetDC SystemParametersInfoW ShowWindow SetWindowPos SetWindowTextW SetForegroundWindow FindWindowW SetFocus PtInRect EqualRect IsRectEmpty UnionRect CopyRect SetRect SetCursor KillTimer GetParent SetWindowLongW MapWindowPoints SetTimer DestroyWindow DestroyCursor LoadCursorW IntersectRect UnregisterClassW GetIconInfo DrawIconEx InflateRect ReleaseDC MapVirtualKeyA

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW ImpersonateLoggedOnUser RevertToSelf RegOpenKeyW RegEnumKeyW DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor SetTokenInformation GetTokenInformation OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoCreateGuid OleLockRunning CLSIDFromString CLSIDFromProgID CoCreateInstance OleInitialize OleUninitialize CreateStreamOnHGlobal CoInitialize CoUninitialize CreateBindCtx

shlwapi

PathFileExistsW StrToIntExW

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses GetProcessImageFileNameW

crypt32

CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgClose

gdiplus

GdipImageGetFrameCount GdipGetImageEncoders GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipSaveImageToFile GdipGraphicsClear GdipGetImageEncodersSize GdipDrawImageRectI

imm32

ImmAssociateContext ImmReleaseContext ImmGetContext

gdi32

SetBkMode StretchBlt Rectangle EnumFontsW BitBlt GetViewportOrgEx GetCurrentObject SetViewportOrgEx GetStockObject CreateSolidBrush CreateFontIndirectW SetGraphicsMode GetDeviceCaps CreateRoundRectRgn GetObjectW CreateDIBSection SelectObject SelectClipRgn IntersectClipRect GetRegionData ExtCreateRegion DeleteObject DeleteDC GdiFlush GetTextFaceW ExtTextOutW SetWorldTransform GetTextMetricsW SetTextAlign SetTextColor RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPointI GetGlyphIndicesW GetFontUnicodeRanges GetOutlineTextMetricsW GetGlyphOutlineW GetFontData GetCharABCWidthsW EnumFontFamiliesExW CreateCompatibleDC CreateBitmap

oleaut32

SysAllocString SysFreeString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ws2_32

getsockopt htons ntohs setsockopt WSASetLastError htonl inet_addr inet_ntoa gethostbyaddr gethostbyname getsockname getservbyname __WSAFDIsSet select recvfrom sendto accept listen ioctlsocket gethostname getpeername connect bind send recv WSAGetLastError socket closesocket WSACleanup getservbyport WSAStartup

usp10

ScriptFreeCache ScriptItemize ScriptShape

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

57KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=23013,

count=37, id=241, version=40116,

count=200, id=243, version=40116,

count=39, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=199, version=41118,

count=27, id=259, version=24123,

count=87, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=65, id=261, version=24123,

count=39, id=260, version=24123,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=478, id=1, productName=Unmarked objects,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=477, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,