2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 1.7MB
Sample260808-wra4ssbm9w
SHA256 32738df5861de2f15b8f82aff7322fd8b4d8ef0e17d19922562c88652d14b39f
MD5 253e84d6eedd2aa5b87a9c967d04ee71
SHA1 1e40b742b98104b877bf25d7eaa6bda332d98eab
SHA512 91496ae22855f88e67ccaec3af61f28638ef83baa0af7a2fe212fa98167a6c7e68dcaad5fa3e888aeffcb2015560eac437db3219fc4e5c5520a7a22829a6e86b
SSDEEP 49152:6e0vXr6DBZ7EJkZCgUxbrjogTq72MbMKjUm:6ewWDB+PTY2MbMLm
TLSH
T17885F122B6D6817AE5B316309DBABA145AFDBE350523C65F23C40A4D1DB0491BF3A373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 1.7MB

2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH b29655bf03e9c65bc67cff56c588ae44
SHA256 32738df5861de2f15b8f82aff7322fd8b4d8ef0e17d19922562c88652d14b39f
MD5 253e84d6eedd2aa5b87a9c967d04ee71
SHA1 1e40b742b98104b877bf25d7eaa6bda332d98eab
SHA512 91496ae22855f88e67ccaec3af61f28638ef83baa0af7a2fe212fa98167a6c7e68dcaad5fa3e888aeffcb2015560eac437db3219fc4e5c5520a7a22829a6e86b
SSDEEP 49152:6e0vXr6DBZ7EJkZCgUxbrjogTq72MbMKjUm:6ewWDB+PTY2MbMLm
TLSH
T17885F122B6D6817AE5B316309DBABA145AFDBE350523C65F23C40A4D1DB0491BF3A373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

68:71:1d:74:27:d5:c0:ed:ee:85:e4:b8:46:a9:d6:50:aa:90:81:01:24:7d:41:07:38:fc:bd:c0:f9:35:83:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Aug 13, 2018

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b1:31:65:82:7d:4c:b0:33:78:76:ff:0e:0a:b1:fa:08:98:d0:ba:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Aug 13, 2018

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

14:f8:fd:d1:67:f9:24:02:b1:57:0b:5d:c4:95:c8:15

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 29, 2016 - Nov 21, 2019

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2015 - Dec 16, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

363855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ChromeRecoveryProbe_unsigned.pdb

advapi32

RegDeleteValueW IsTextUnicode SystemFunction036 RegisterEventSourceW DeregisterEventSource ReportEventW ImpersonateLoggedOnUser RegOpenCurrentUser TraceEvent UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle DuplicateTokenEx ImpersonateSelf RevertToSelf ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW CreateProcessAsUserW FreeSid GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW RegQueryValueExW RegOpenKeyExW OpenThreadToken RegDeleteKeyW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW GetSidIdentifierAuthority GetSidSubAuthorityCount AllocateAndInitializeSid CheckTokenMembership

kernel32

SetLastError CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount InterlockedPushEntrySList RtlUnwind FreeLibrary LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP GetCurrentThread LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA TerminateProcess CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW GetFileAttributesExW CopyFileW MoveFileExW lstrlenW GetFileTime SetFilePointer ReadFile GetFileSize CompareFileTime FileTimeToSystemTime LoadLibraryW LocalFree GetFileAttributesW WaitForMultipleObjects DuplicateHandle ReleaseMutex GetEnvironmentVariableW FormatMessageW lstrcmpW GetStringTypeExW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW VirtualQuery GetTempPathW SystemTimeToFileTime VerifyVersionInfoW VerSetConditionMask ResetEvent LocalAlloc OpenProcess DeviceIoControl GlobalMemoryStatusEx SetPriorityClass CreateProcessW ProcessIdToSessionId GetSystemPowerStatus CreatePipe SetHandleInformation CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent GetLongPathNameW WaitForMultipleObjectsEx CreateToolhelp32Snapshot Process32FirstW Process32NextW ReadProcessMemory GetThreadLocale lstrcpynW GetLogicalDriveStringsW QueryDosDeviceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetPrivateProfileSectionNamesW GetComputerNameExW GetSystemDefaultLangID GetUserDefaultLangID lstrcmpA GetStringTypeExA CreateFileMappingW MapViewOfFileEx UnmapViewOfFile GetCurrentProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection EnterCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState GetProcessId VirtualQueryEx RtlCaptureContext ReleaseSemaphore CreateSemaphoreW UnregisterWaitEx QueryPerformanceFrequency QueueUserWorkItem GetFileSizeEx VirtualProtect VirtualAlloc GetSystemInfo OutputDebugStringW IsDebuggerPresent InterlockedPopEntrySList FlushInstructionCache VirtualFree LoadLibraryExA GetModuleHandleW GetProcAddress GetCommandLineW GetExitCodeProcess GetTempFileNameW SetFilePointerEx CloseHandle DeleteFileW CreateFileW WaitForSingleObject RemoveDirectoryW WriteFile CreateDirectoryW lstrcmpiW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize FindClose InitializeCriticalSectionAndSpinCount FindNextFileW HeapFree FindFirstFileW SizeofResource WaitForSingleObjectEx

ole32

CoCreateInstance CoCreateGuid IIDFromString CoTaskMemFree CoGetObject CoGetCallContext CoImpersonateClient WriteClassStm OleSaveToStream CoSetProxyBlanket CoRegisterPSClsid CoTaskMemAlloc CoTaskMemRealloc ReadClassStm StringFromGUID2 CoInitializeEx CoUninitialize CoRevertToSelf

oleaut32

SafeArrayGetUBound SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear SysAllocString LoadTypeLi SafeArrayGetLBound SysStringLen LoadRegTypeLi SysAllocStringLen SysStringByteLen SafeArrayDestroy SafeArrayUnlock SysAllocStringByteLen VariantChangeType SafeArrayCreate SafeArrayRedim VarUI4FromStr SysReAllocStringLen SafeArrayLock VarBstrCmp SysFreeString

shell32

SHGetFolderLocation SHGetDesktopFolder ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

user32

MessageBoxW CharLowerBuffW CharUpperW CharLowerW DestroyWindow AllowSetForegroundWindow DispatchMessageW TranslateMessage PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos CreateWindowExW UnregisterClassW wsprintfW wvsprintfW CharNextA CharLowerBuffA IsWindow LoadStringW CharUpperBuffW CharNextW GetWindowThreadProcessId CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EnumWindows IsWindowVisible KillTimer SetTimer DefWindowProcW RegisterClassExW GetClassInfoExW LoadCursorW SetWindowLongW CallWindowProcW

netapi32

NetWkstaUserGetInfo NetWkstaGetInfo NetGetJoinInformation NetApiBufferFree

shlwapi

UrlCombineW PathAddExtensionW PathFindExtensionW StrRetToStrW PathFindFileNameW PathStripPathW PathCreateFromUrlW PathRemoveFileSpecW PathRemoveExtensionW PathCanonicalizeW PathAppendW PathCommonPrefixW SHQueryValueExW PathAddBackslashW PathIsRelativeW UrlIsW UrlEscapeW

iphlpapi

GetIfTable

msi

ord175 ord238 ord141

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

userenv

UnloadUserProfile ExpandEnvironmentStringsForUserW CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

crypt32

CryptQueryObject CertDuplicateCertificateContext CryptHashCertificate CryptUnprotectData CertGetNameStringW CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CryptProtectData

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_253e84d6eedd2aa5b87a9c967d04ee71_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

advapi32

kernel32

ole32

oleaut32

shell32

user32

netapi32

shlwapi

iphlpapi

msi

psapi

version

userenv

wtsapi32

crypt32

wintrust

generic