2026-08-06_6030098f2d828f4af42a88a98cb94498_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_6030098f2d828f4af42a88a98cb94498_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 920KB
Sample260806-bzag1sfb64
SHA256 e66fde0279829a9541a40003a86825d32b790af7b0cc34abbe6bc5e8df65323f
MD5 6030098f2d828f4af42a88a98cb94498
SHA1 eec8e3d66fe6d77bcee17d4a5a7cf8a164f1a1a3
SHA512 ff7e72d6db6e15f31f54364ec6c017d02f592c54bb6b07b93bd38d19991b3d6dae7bbf8442ff4a105f71ebbdad4586198b52e9b4fe4ba5753a50c717c89d2635
SSDEEP 24576:JI3kF4Y5jaij3Hv5A2n/WkzSdWrzW494KdsRUcV:JIa4Y5jamP5A2/WgSdGzW0secV
TLSH
T1A1159E32B681807AC27241315C287764A5EFBC329879D64F27A9366D1FB84F21D2D6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-06_6030098f2d828f4af42a88a98cb94498_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 920KB

2026-08-06_6030098f2d828f4af42a88a98cb94498_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 244dc009321764323b84edc92685343e
SHA256 e66fde0279829a9541a40003a86825d32b790af7b0cc34abbe6bc5e8df65323f
MD5 6030098f2d828f4af42a88a98cb94498
SHA1 eec8e3d66fe6d77bcee17d4a5a7cf8a164f1a1a3
SHA512 ff7e72d6db6e15f31f54364ec6c017d02f592c54bb6b07b93bd38d19991b3d6dae7bbf8442ff4a105f71ebbdad4586198b52e9b4fe4ba5753a50c717c89d2635
SSDEEP 24576:JI3kF4Y5jaij3Hv5A2n/WkzSdWrzW494KdsRUcV:JIa4Y5jamP5A2/WgSdGzW0secV
TLSH
T1A1159E32B681807AC27241315C287764A5EFBC329879D64F27A9366D1FB84F21D2D6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

53:16:a7:48:ff:12:4f:53:17:5a:38:8d:03:80:55:83:70:fd:3b:21:48:e7:4a:48:9c:45:8c:2d:25:c6:67:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 18, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

340118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\sysoptasst_build_2022\product\win32\dbginfo\clawmgr.pdb

kernel32

SetLastError GetCurrentProcess GetFileAttributesExW GetTickCount SetFilePointerEx GetSystemTimeAsFileTime LoadLibraryW CreateProcessW FreeResource GetWindowsDirectoryW InterlockedExchange InterlockedDecrement InterlockedIncrement lstrlenW GlobalFree GlobalUnlock GlobalLock GlobalAlloc CreateMutexW OpenMutexW OutputDebugStringA Sleep lstrcmpiW LoadLibraryExW GetExitCodeThread GetDiskFreeSpaceExW CreatePipe GetExitCodeProcess K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW TerminateProcess GetFullPathNameW OutputDebugStringW GetLocalTime FlushFileBuffers WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP GetConsoleMode GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetStdHandle ExitProcess GetFileType SetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent LocalFree LocalAlloc SetFilePointer GetSystemDirectoryW GetVersionExW GetPrivateProfileStringW GetPrivateProfileIntW WriteFile WideCharToMultiByte MultiByteToWideChar ReadFile GetFileSize CreateFileW FindClose FindNextFileW FindFirstFileW CreateDirectoryW DeleteFileW GetFileAttributesW GetModuleFileNameW FreeLibrary LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW DeleteCriticalSection GetProcAddress DecodePointer ResetEvent RaiseException CloseHandle SetEvent GetLastError CreateEventW GetCurrentThreadId WaitForSingleObject InitializeCriticalSectionAndSpinCount

user32

IsChild PeekMessageW PostThreadMessageW UnregisterClassW GetMessageW RegisterWindowMessageW GetFocus IntersectRect ClientToScreen GetSystemMetrics SetWindowRgn EnumDisplayDevicesW EnumDisplaySettingsW IsDialogMessageW UpdateLayeredWindow BeginPaint EndPaint ScreenToClient GetMonitorInfoW MonitorFromWindow GetNextDlgTabItem SetFocus GetCursorPos DispatchMessageW IsRectEmpty ReleaseCapture SetCapture CharNextW SetActiveWindow UnionRect TranslateMessage PostMessageW SetTimer KillTimer EqualRect ReleaseDC GetDC SetRectEmpty SetWindowPos SetWindowLongW GetWindowLongW CopyRect GetDesktopWindow CreateWindowExW RegisterClassExW LoadCursorW DefWindowProcW FindWindowW DrawTextW SendMessageW GetParent GetDlgCtrlID PtInRect SetCursor InflateRect LoadImageW InvalidateRect IsWindow DestroyWindow LoadIconW DestroyIcon ShowWindow IsWindowVisible GetDlgItem SetRect CallWindowProcW DrawIconEx OffsetRect GetClassInfoExW GetClientRect GetWindowRect IsWindowEnabled MoveWindow SystemParametersInfoW IsIconic MapWindowPoints GetWindow LoadBitmapW BringWindowToTop GetLastActivePopup SwitchToThisWindow GetActiveWindow EnableWindow GetWindowThreadProcessId GetForegroundWindow AttachThreadInput SetForegroundWindow

gdi32

LineTo MoveToEx CreatePen GetStockObject GetDeviceCaps CreateFontIndirectW SetBkMode SetBkColor BitBlt SetTextColor GetObjectW CreateDIBSection GetTextColor CreateCompatibleDC SelectObject DeleteObject CreateCompatibleBitmap SetStretchBltMode GetStretchBltMode CombineRgn CreateRoundRectRgn ExtSelectClipRgn OffsetRgn GetViewportOrgEx SetViewportOrgEx GetCurrentObject Rectangle CreateRectRgnIndirect ExtTextOutW RectInRegion SelectClipRgn RestoreDC TextOutW GetTextExtentPoint32W SaveDC GetClipRgn RoundRect StretchBlt DeleteDC CreateRectRgn CreateBitmap

advapi32

RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegOpenKeyW RegSetValueExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteExW ShellExecuteW SHCreateDirectoryExW ord680

ole32

OleRun CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString

shlwapi

StrToIntA StrToIntW PathFindFileNameW PathAppendW PathRemoveBackslashW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW PathFileExistsW PathIsRelativeW

comctl32

InitCommonControlsEx DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipDrawLinesI GdipDeletePen GdipCreatePen1 GdipScaleWorldTransform GdipCreateLineBrushFromRectWithAngleI GdipDrawPath GdipFillPath GdipAddPathRectangle GdipAddPathArcI GdipDrawLine GdipDrawImagePointsRectI GdipSetPenEndCap GdipSetPenStartCap GdipFillRectangle GdipDrawRectangleI GdipSetPenMode GdipDrawImageI GdipGetFontSize GdipAddPathStringI GdipGetFamily GdipSetPixelOffsetMode GdipSetCompositingQuality GdipAddPathLineI GdipStartPathFigure GdipGetImagePixelFormat GdipGraphicsClear GdipDrawImageRectI GdipCloneBitmapArea GdipSetPenDashStyle GdipImageRotateFlip GdipLoadImageFromStream GdipAddPathPieI GdipAddPathRectangleI GdipClosePathFigure GdipSetSmoothingMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRect GdipTranslateWorldTransform GdipRotateWorldTransform GdipResetWorldTransform GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipSetStringFormatAlign GdipMeasureString GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectRectI GdipSetClipPath GdipAddPathEllipseI GdipDeletePath GdipCreatePath GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipFree GdipLoadImageFromFile GdipSetInterpolationMode

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

483KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_6030098f2d828f4af42a88a98cb94498_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

generic