2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 1.7MB
Sample260809-fdt2ra1ajc
SHA256 d284800d138ae09f4b7923b1a1c624733287d551998ac0997dbd67135a4b87fa
MD5 ed1bea8ac1624059e49c76b473fd9f52
SHA1 1a115ed62fc30f1662563a0c85328e32d300908f
SHA512 b1a150f32405c2f7a6473d2adb8181a277dda2ff61bfef0d701cd0b7a40e03e438f27164171a796fbeda53f49d4037a51b5e6d811606d31232e6dc1b6cb6a175
SSDEEP 49152:F2vmHWdJAKkveZFS30sgb2EVhtf37AdlU:F2+AAtlO22htf3sdlU
TLSH
T16785F122B996817AD5B31630DDBA79285AFDBE350523C64F23C40A0E1DB0591BE3B773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 1.7MB

2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH b18a256babbc930885640d67ef62ac25
SHA256 d284800d138ae09f4b7923b1a1c624733287d551998ac0997dbd67135a4b87fa
MD5 ed1bea8ac1624059e49c76b473fd9f52
SHA1 1a115ed62fc30f1662563a0c85328e32d300908f
SHA512 b1a150f32405c2f7a6473d2adb8181a277dda2ff61bfef0d701cd0b7a40e03e438f27164171a796fbeda53f49d4037a51b5e6d811606d31232e6dc1b6cb6a175
SSDEEP 49152:F2vmHWdJAKkveZFS30sgb2EVhtf37AdlU:F2+AAtlO22htf3sdlU
TLSH
T16785F122B996817AD5B31630DDBA79285AFDBE350523C64F23C40A0E1DB0591BE3B773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

76:bb:73:4e:49:fc:a0:dd:24:df:9f:09:19:ab:ff:31:a6:60:4b:e4:7d:b7:01:d5:3a:34:eb:19:1d:93:93:59

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Dec 8, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

61:51:b5:c6:96:60:00:f4:bb:35:3f:25:d9:ad:a0:8e:1a:a9:5f:25

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Dec 8, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 14, 2015 - Dec 14, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2015 - Dec 16, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

363616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ChromeRecoveryProbe_unsigned.pdb

advapi32

RegDeleteValueW IsTextUnicode SystemFunction036 RegisterEventSourceW DeregisterEventSource ReportEventW ImpersonateLoggedOnUser RegOpenCurrentUser TraceEvent UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle DuplicateTokenEx ImpersonateSelf RevertToSelf ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW CreateProcessAsUserW FreeSid GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW RegQueryValueExW RegOpenKeyExW OpenThreadToken RegDeleteKeyW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW GetSidIdentifierAuthority GetSidSubAuthorityCount AllocateAndInitializeSid CheckTokenMembership

kernel32

SetLastError CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount InterlockedPushEntrySList RtlUnwind FreeLibrary LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP GetCurrentThread LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA TerminateProcess CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW GetFileAttributesExW CopyFileW MoveFileExW lstrlenW GetFileTime SetFilePointer ReadFile GetFileSize CompareFileTime FileTimeToSystemTime LoadLibraryW LocalFree GetFileAttributesW WaitForMultipleObjects DuplicateHandle ReleaseMutex GetEnvironmentVariableW FormatMessageW lstrcmpW GetStringTypeExW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW VirtualQuery GetTempPathW SystemTimeToFileTime VerifyVersionInfoW VerSetConditionMask ResetEvent LocalAlloc OpenProcess DeviceIoControl GlobalMemoryStatusEx SetPriorityClass CreateProcessW ProcessIdToSessionId GetSystemPowerStatus CreatePipe SetHandleInformation CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent GetLongPathNameW WaitForMultipleObjectsEx CreateToolhelp32Snapshot Process32FirstW Process32NextW ReadProcessMemory GetThreadLocale lstrcpynW GetLogicalDriveStringsW QueryDosDeviceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetPrivateProfileSectionNamesW GetComputerNameExW GetSystemDefaultLangID GetUserDefaultLangID lstrcmpA GetStringTypeExA CreateFileMappingW MapViewOfFileEx UnmapViewOfFile GetCurrentProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection EnterCriticalSection OutputDebugStringW WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState GetProcessId VirtualQueryEx RtlCaptureContext ReleaseSemaphore CreateSemaphoreW UnregisterWaitEx QueryPerformanceFrequency QueueUserWorkItem GetFileSizeEx VirtualProtect VirtualAlloc GetSystemInfo IsDebuggerPresent InterlockedPopEntrySList FlushInstructionCache VirtualFree LoadLibraryExA GetModuleHandleW GetProcAddress GetCommandLineW GetExitCodeProcess GetTempFileNameW SetFilePointerEx CloseHandle DeleteFileW CreateFileW WaitForSingleObject RemoveDirectoryW WriteFile CreateDirectoryW lstrcmpiW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize FindClose InitializeCriticalSectionAndSpinCount FindNextFileW HeapFree FindFirstFileW SizeofResource WaitForSingleObjectEx

ole32

CoCreateInstance StringFromGUID2 IIDFromString CoTaskMemFree CoGetObject CoGetCallContext CoImpersonateClient WriteClassStm OleSaveToStream ReadClassStm CoSetProxyBlanket CoRegisterPSClsid CoTaskMemRealloc CoCreateGuid CoTaskMemAlloc CoInitializeEx CoUninitialize CoRevertToSelf

oleaut32

SafeArrayGetUBound SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear SysAllocString LoadTypeLi SafeArrayGetLBound SysStringLen LoadRegTypeLi SysAllocStringLen SysStringByteLen SysAllocStringByteLen SafeArrayDestroy SafeArrayUnlock SafeArrayCreate VariantChangeType VarUI4FromStr SysReAllocStringLen SafeArrayRedim SafeArrayLock VarBstrCmp SysFreeString

shell32

SHGetFolderLocation SHGetDesktopFolder ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

user32

CharLowerBuffW CharUpperW CharLowerW DestroyWindow AllowSetForegroundWindow DispatchMessageW TranslateMessage PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos CreateWindowExW MessageBoxW UnregisterClassW wsprintfW wvsprintfW CharNextA CharLowerBuffA IsWindow LoadStringW CharUpperBuffW CharNextW GetWindowThreadProcessId CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EnumWindows IsWindowVisible KillTimer SetTimer DefWindowProcW RegisterClassExW GetClassInfoExW LoadCursorW SetWindowLongW CallWindowProcW

netapi32

NetWkstaGetInfo NetWkstaUserGetInfo NetApiBufferFree NetGetJoinInformation

shlwapi

PathAddExtensionW PathFindExtensionW UrlIsW StrRetToStrW PathFindFileNameW UrlEscapeW PathCreateFromUrlW PathStripPathW PathCanonicalizeW PathAppendW PathRemoveFileSpecW PathRemoveExtensionW PathCommonPrefixW SHQueryValueExW PathAddBackslashW PathIsRelativeW UrlCombineW

iphlpapi

GetIfTable

msi

ord175 ord238 ord141

psapi

GetModuleFileNameExW EnumProcesses EnumProcessModules

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

userenv

ExpandEnvironmentStringsForUserW CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

crypt32

CryptQueryObject CertDuplicateCertificateContext CryptHashCertificate CertGetNameStringW CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CryptUnprotectData CryptProtectData

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_ed1bea8ac1624059e49c76b473fd9f52_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

advapi32

kernel32

ole32

oleaut32

shell32

user32

netapi32

shlwapi

iphlpapi

msi

psapi

version

userenv

wtsapi32

crypt32

wintrust

generic