2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader
Size 1.5MB
Sample260810-bdj5bsstcw
SHA256 19496a377862e3c0e347a03f5a6faef138bef656f688fea1808791e97522a2f7
MD5 231c7745bdd716490f10e89e4a781aac
SHA1 9c441fedc4bdb0dc63fd5b036bc2c2b78bb2f6c1
SHA512 617f8199dfa145bfc7e36ac9a5a3fc1b2bd07c7e7a959763d54f7365cc9719178c64d0b693e53276125ca4204e68b8be86d0290642339950c23318550c912654
SSDEEP 24576:3QqVDvkDgA/mXtAQKbINneaHpdtRORo0xhTx23amgGJtx0Eqi6BrEH7Kq:32Lb5aH3tRORoL3amgGJtB76i
TLSH
T1D5757D30B543C1F2E4A212F099AC6FA895A9E9B01B3B56CB13D41F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 1.5MB

2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 9686f59e7add86005b38da8ebfa18dde
SHA256 19496a377862e3c0e347a03f5a6faef138bef656f688fea1808791e97522a2f7
MD5 231c7745bdd716490f10e89e4a781aac
SHA1 9c441fedc4bdb0dc63fd5b036bc2c2b78bb2f6c1
SHA512 617f8199dfa145bfc7e36ac9a5a3fc1b2bd07c7e7a959763d54f7365cc9719178c64d0b693e53276125ca4204e68b8be86d0290642339950c23318550c912654
SSDEEP 24576:3QqVDvkDgA/mXtAQKbINneaHpdtRORo0xhTx23amgGJtx0Eqi6BrEH7Kq:32Lb5aH3tRORoL3amgGJtB76i
TLSH
T1D5757D30B543C1F2E4A212F099AC6FA895A9E9B01B3B56CB13D41F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a8:f0:79:d4:1d:fc:96:82:3f:fd:0f:87:56:59:74:90:70:13:59:88:b4:cf:c4:91:1c:f5:a2:07:84:37:2b:5c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,C=VG

Chains

Sep 2, 2025

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,C=VG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,C=VG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,C=VG

Serial Number

03:66:72:13:08:65:81:e3:ff:ef:3e:8f:c6:3a:f2:cc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 11, 2023 - Apr 12, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

826444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvControlSvc.pdb

kernel32

SetEndOfFile SetFilePointer CreateProcessW GetSystemDirectoryW LoadLibraryW GetVersionExW GetNativeSystemInfo LoadLibraryA GetConsoleOutputCP GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW CreatePipe ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSection CreateThread SetUnhandledExceptionFilter RtlCaptureContext GetSystemTimeAsFileTime GetSystemTime QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetCurrentProcessId WaitNamedPipeW CreateFileW WaitForMultipleObjects ResumeThread TerminateThread SetThreadPriority GetCurrentThreadId CancelIoEx GetOverlappedResult SetHandleInformation WriteFile ReadFile ResetEvent GetOEMCP GetACP WideCharToMultiByte ExpandEnvironmentStringsW GetLocaleInfoW GetComputerNameW VerifyVersionInfoW VerSetConditionMask OpenProcess GetExitCodeProcess SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler CloseHandle MoveFileExW LocalFree GetModuleHandleW GetFileSize SetPriorityClass GetCurrentProcess CreateDirectoryW GetCommandLineW GetStdHandle MulDiv GetProcAddress GetTempPathW LeaveCriticalSection EnterCriticalSection MultiByteToWideChar SystemTimeToFileTime CreateSemaphoreW OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore SetEvent SetLastError lstrcmpiW lstrcmpW DeviceIoControl GetLastError WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer FileTimeToSystemTime Sleep GetLocalTime InitializeCriticalSectionEx

advapi32

RegSetValueExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetKeySecurity RegOpenKeyExW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyExW FreeSid AllocateAndInitializeSid AddAccessDeniedAce EventUnregister EventRegister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW EventWriteTransfer RegQueryValueExW RegOpenKeyW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce EqualSid AddAccessAllowedAce

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize

oleaut32

VariantInit SafeArrayUnlock SafeArrayDestroy VariantClear SysAllocString SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysFreeString

ws2_32

getsockopt closesocket getnameinfo WSACleanup ntohl htons htonl shutdown socket ntohs

iphlpapi

ConvertInterfaceGuidToLuid GetAdaptersAddresses

wininet

InternetConnectW InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetOpenW InternetCrackUrlW

msi

ord205

fwpuclnt

FwpmFilterUnsubscribeChanges0 FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerSubscribeChanges0 FwpmSubLayerUnsubscribeChanges0 FwpmFilterAdd0 FwpmFilterSubscribeChanges0 FwpmFilterDeleteById0 FwpmFilterGetByKey0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_231c7745bdd716490f10e89e4a781aac_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

msi

fwpuclnt

rpcrt4

generic