2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat
Size 1.9MB
Sample260809-an5cksfl4s
SHA256 ac0085acc086344ff05f658e7b810cf926ed24c5c2b327123c45459e5e6671cd
MD5 18fbd40af5119e3947aab1c97fa1c511
SHA1 eab744eacfb5bf369725d1c3856365f8dd137fb2
SHA512 4a8a4a706ecf2e7cb712a040960ca56d5a859bcd53cce58be331548c7526a881ff65f85a0c6bb9a6f94a458887ad78c86eedf188fd5c894723db8b3b1daf5b9d
SSDEEP 24576:fs3XC9XcAinxgpC8JIwYy4CwXtXIg926N8mBwlXa8agN/ZPkpOgMpX96rEH7hE:fZ8ya9XC6CywBa8aI/ZPkpOgMp93E
TLSH
T138958D217642C23BDAD201B0AC6DAF6E956CAA354B7604D7B3C41F7E5C741C32B35A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat

File Explorer

2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat

.exe 1.9MB

2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat

IMPHASH 637b6afdb1b76a739274540d014a4bbe
SHA256 ac0085acc086344ff05f658e7b810cf926ed24c5c2b327123c45459e5e6671cd
MD5 18fbd40af5119e3947aab1c97fa1c511
SHA1 eab744eacfb5bf369725d1c3856365f8dd137fb2
SHA512 4a8a4a706ecf2e7cb712a040960ca56d5a859bcd53cce58be331548c7526a881ff65f85a0c6bb9a6f94a458887ad78c86eedf188fd5c894723db8b3b1daf5b9d
SSDEEP 24576:fs3XC9XcAinxgpC8JIwYy4CwXtXIg926N8mBwlXa8agN/ZPkpOgMpX96rEH7hE:fZ8ya9XC6CywBa8aI/ZPkpOgMp93E
TLSH
T138958D217642C23BDAD201B0AC6DAF6E956CAA354B7604D7B3C41F7E5C741C32B35A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1e:e6:62:9c:0a:1f:68:b3:08:dc:33:4f:a5:f0:1a:9b:f0:8e:da:1b:ea:c9:66:43:29:ea:21:4a:8d:8e:e9:a3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=OP BG-MB BU-SYS SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Nov 11, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:e1:d6:69:bc:6c:5b:ca:5d:9c:d2:64:47:77:6b:07

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2024 - Sep 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1242877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsusFanControlService\Release\AsusFanControlService.pdb

wtsapi32

WTSSendMessageW

dbghelp

SymFromAddr SymInitialize SymGetLineFromAddr64

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgGetParam

shlwapi

PathIsDirectoryW ord217 PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFileExistsW

ntdll

RtlCaptureStackBackTrace RtlUnwind

kernel32

GetCommandLineW WriteFile DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent CreateEventW GetCurrentProcessId CreateThread GetCurrentThreadId SetProcessMitigationPolicy GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW LocalSize FormatMessageW lstrcmpiW lstrlenW GetDynamicTimeZoneInformation WTSGetActiveConsoleSessionId GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW DuplicateHandle ReleaseMutex CreateMutexW OpenMutexW OpenEventW OpenProcess QueryFullProcessImageNameW Thread32First Thread32Next EnterCriticalSection LeaveCriticalSection CreateFileW ReadFile IsDebuggerPresent SetThreadPriority K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW CreateFileA DeleteFileA SetFileAttributesA GetSystemInfo VirtualQuery GetCurrentDirectoryW InitializeCriticalSection WriteConsoleW ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime EncodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW OutputDebugStringW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW VirtualProtect VirtualAlloc FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess HeapSize TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetDateFormatW GetStdHandle AcquireSRWLockExclusive GetTimeFormatW CompareStringW SetLastError CloseHandle GetFileAttributesW GetModuleFileNameA DeleteFileW CreateDirectoryW GetModuleFileNameW OutputDebugStringA WideCharToMultiByte MultiByteToWideChar GetModuleHandleA FreeLibrary GetSystemDirectoryW GetLastError GetTickCount lstrcmpW LocalFree LocalAlloc LoadLibraryW GetProcAddress Sleep FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetStdHandle ReadConsoleW GetConsoleOutputCP GetProcessHeap HeapFree HeapAlloc FlsAlloc GetVersionExW GetCurrentProcess WaitForSingleObject ResumeThread GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile FlsGetValue FlsSetValue FlsFree GetFirmwareEnvironmentVariableW InitializeSListHead GetFullPathNameW MoveFileExW GetTimeZoneInformation HeapReAlloc GetFileSizeEx SetFilePointerEx FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

PostQuitMessage DefWindowProcW PostThreadMessageW LoadCursorW DispatchMessageW TranslateMessage RegisterClassExW RegisterWindowMessageW LoadStringW ExitWindowsEx MessageBoxW wsprintfW MessageBoxA CreateWindowExW ShowWindow CharUpperW CharNextW UpdateWindow GetMessageW PostMessageW FindWindowW LoadIconW GetUserObjectSecurity

advapi32

QueryServiceStatus BuildTrusteeWithSidW SetNamedSecurityInfoW GetNamedSecurityInfoW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid RegNotifyChangeKeyValue SetSecurityInfo ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorDacl StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExA RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegCreateKeyExA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoRegisterClassObject CoInitialize CLSIDFromProgID CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

shell32

SHGetFolderPathA SHGetFolderPathAndSubDirW SHFileOperationW

oleaut32

LoadRegTypeLi VariantCopy VariantInit SysAllocStringByteLen SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VariantClear SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SysStringByteLen

hid

HidD_GetHidGuid HidD_GetAttributes

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

296KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_18fbd40af5119e3947aab1c97fa1c511_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat

PE Signature issue

wtsapi32

dbghelp

wintrust

crypt32

shlwapi

ntdll

kernel32

user32

advapi32

ole32

shell32

oleaut32

hid

setupapi

generic