2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 5.8MB
Sample260809-xd9wmstepc
SHA256 2d0a5953395bcb2e592d89fe301b5028c94376f62f4f85a5468037d69909a968
MD5 219fbf35e019f3850c505b2caa759f43
SHA1 9a579aa0ca338812e58ab71640ceba57361d2e06
SHA512 e3e103ed91304a6c6ae843c486da45cdbbd23f8e0ff796edcd50405ec7d87392662971f88e9040cc3c6fc8060c1f00d7ee67c7efee426d3361c692f60983102c
SSDEEP 98304:Fm95TeruiEFhCy0hNXvKz//rW63DxJNmobllUgfqPXppEIe8+aLm:Fm95TeAkCz/rbrUTPbre8+aL
TLSH
T1B356E131BB46C072F9A201B056ACABBA446C7A341B3909CBF2D01F9D59719D37A36F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 5.8MB

2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH d6d16ba00d6c313df7cfd64034a9b3b4
SHA256 2d0a5953395bcb2e592d89fe301b5028c94376f62f4f85a5468037d69909a968
MD5 219fbf35e019f3850c505b2caa759f43
SHA1 9a579aa0ca338812e58ab71640ceba57361d2e06
SHA512 e3e103ed91304a6c6ae843c486da45cdbbd23f8e0ff796edcd50405ec7d87392662971f88e9040cc3c6fc8060c1f00d7ee67c7efee426d3361c692f60983102c
SSDEEP 98304:Fm95TeruiEFhCy0hNXvKz//rW63DxJNmobllUgfqPXppEIe8+aLm:Fm95TeAkCz/rbrUTPbre8+aL
TLSH
T1B356E131BB46C072F9A201B056ACABBA446C7A341B3909CBF2D01F9D59719D37A36F53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2390352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Surfright\Producten\Alert\branch-2xxx\bin\Release\hmpalert.pdb

kernel32

CloseHandle InterlockedIncrement QueueUserWorkItem GetSystemTimeAsFileTime CreateDirectoryW DeleteCriticalSection CompareFileTime InitializeCriticalSection EnterCriticalSection GetWindowsDirectoryW TryEnterCriticalSection LeaveCriticalSection InterlockedDecrement MultiByteToWideChar WideCharToMultiByte InterlockedExchange InterlockedCompareExchange CreateEventW CreateThread SignalObjectAndWait TerminateThread WaitForSingleObject FindResourceW SizeofResource LoadResource LockResource FreeResource GetLastError Sleep GetCurrentProcess GetModuleHandleA GetProcAddress WTSGetActiveConsoleSessionId LocalAlloc GetDriveTypeW GetVolumeInformationW FileTimeToSystemTime GetDateFormatW SetEvent ResetEvent SetThreadPriority GetCurrentThread GetTickCount OpenProcess DuplicateHandle GetModuleHandleExW GetLogicalDriveStringsW QueryDosDeviceW GetLongPathNameW GlobalAlloc GlobalLock GlobalUnlock FileTimeToLocalFileTime GetComputerNameW GetCurrentProcessId WaitForMultipleObjects WaitForSingleObjectEx GetOverlappedResult CancelIo CreateWaitableTimerW SetWaitableTimer CreateFileA GetFileSize CreateTimerQueue DeleteTimerQueueEx CopyFileW DeleteFileW DeleteTimerQueueTimer CreateTimerQueueTimer ReadDirectoryChangesW FreeLibrary ReadFile GetFileInformationByHandle IsWow64Process LoadLibraryW ReadProcessMemory QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA ProcessIdToSessionId WriteFile FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryA LoadLibraryExA VirtualProtect LoadLibraryExW GetFileSizeEx GetSystemTime SetLastError CreateHardLinkW MoveFileExW OpenEventW GetCurrentThreadId SetFilePointer GetComputerNameA GetLocalTime GlobalFree GetModuleFileNameW GetExitCodeProcess TerminateProcess GetTimeZoneInformation GetVersionExW CreateProcessW CreateEventA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile CreateFileW HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW CreateIoCompletionPort DisconnectNamedPipe GetQueuedCompletionStatus CreateNamedPipeW ConnectNamedPipe PeekNamedPipe WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetFileType GetACP ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer SwitchToThread GetStringTypeW TransactNamedPipe CancelWaitableTimer ResumeThread InitializeCriticalSectionAndSpinCount GetCalendarInfoA MulDiv ConvertDefaultLocale VerifyVersionInfoW VerSetConditionMask GetSystemWow64DirectoryW OpenMutexW GetNativeSystemInfo GetModuleHandleExA GetConsoleMode VirtualAlloc GetStdHandle VirtualFree SetNamedPipeHandleState WaitNamedPipeW GetModuleHandleW VirtualQuery RaiseException DeviceIoControl GetSystemDirectoryW LocalFree HeapValidate SystemTimeToFileTime

user32

GetUserObjectInformationW GetAsyncKeyState TrackPopupMenu ModifyMenuW EnumDesktopWindows ChildWindowFromPointEx ScrollDC CreateIconIndirect LoadImageW EnableMenuItem SetMenuDefaultItem AppendMenuW CreatePopupMenu RegisterWindowMessageA ChangeDisplaySettingsW EnumDisplaySettingsW PostQuitMessage GetMessageW WindowFromPoint SetWindowTextW SetWindowLongW EnableWindow SetFocus SetCursor TrackMouseEvent GetPropW SetPropW MoveWindow SetParent UpdateWindow SetCursorPos ClientToScreen MapWindowPoints GetClassNameW EnumWindows MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetMonitorInfoW MonitorFromWindow GetWindowRect GetCursorPos GetWindow GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowRgn EqualRect IsZoomed ShowWindow GetParent CallNextHookEx IsWindowVisible RealGetWindowClassA IsRectEmpty IsIconic SetLayeredWindowAttributes EndPaint BeginPaint UnhookWinEvent UnhookWindowsHookEx DispatchMessageW TranslateMessage PeekMessageW SetWindowsHookExW SetWinEventHook GetForegroundWindow SystemParametersInfoW GetSystemMetrics GetClientRect CallWindowProcW GetWindowTextLengthW SendMessageW RegisterClassW GetClassInfoW GetIconInfo DestroyIcon ReleaseCapture SetCapture ScreenToClient DrawFocusRect InflateRect InvalidateRect PtInRect SetRectEmpty OffsetRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CharUpperW ReleaseDC GetDC MessageBoxExW GetDesktopWindow RedrawWindow SetWindowPos DrawIconEx SetRect PostMessageW KillTimer SetTimer MessageBoxW DrawTextW CopyRect FillRect AllowSetForegroundWindow FindWindowExW CharUpperBuffW CharLowerW CharLowerBuffW ExitWindowsEx RegisterWindowMessageW GetThreadDesktop IsDialogMessageW SwitchDesktop OpenInputDesktop GetUserObjectInformationA CloseDesktop AttachThreadInput SetForegroundWindow BringWindowToTop IsWindowEnabled GetClipboardData DefWindowProcW IsClipboardFormatAvailable MsgWaitForMultipleObjectsEx

fltlib

FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceFindClose FilterGetDosName

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

491KB

Virtual Size

490KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

696KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

fltlib

mpr

netapi32

generic