2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos
Size 1.1MB
Sample260818-b34v2atdnf
SHA256 055bf380f476f9a016c524738637b51d0d3c7140540d2b182ad788b98d45a3bd
MD5 fbf635461447a24c23c4848d561e3c96
SHA1 972d47de7489cd969ab4bd75025601f22528be6e
SHA512 9592c58cdbb5cb10f613e42978dacf73df3d58be8f7826ab94626390540d2d1523c61c5e541c15161ef3e3fa873177b96d512f7f8930b2f625d349524f388ad9
SSDEEP 24576:8oz43PXdQD7Yp8cSL+GZ7u16yBUnpP9PJp8L18slfSorEH7I:hdcMX7u1lGplPJp8L18sRSQ
TLSH
T1A5459E203B92D17ADEB1017019B8DF6B547DFD650F7248CB93C8066D5E609C21A3BAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos

.exe 1.1MB

2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos

IMPHASH 2009c34243c6cde4bb4364e7da98fb83
SHA256 055bf380f476f9a016c524738637b51d0d3c7140540d2b182ad788b98d45a3bd
MD5 fbf635461447a24c23c4848d561e3c96
SHA1 972d47de7489cd969ab4bd75025601f22528be6e
SHA512 9592c58cdbb5cb10f613e42978dacf73df3d58be8f7826ab94626390540d2d1523c61c5e541c15161ef3e3fa873177b96d512f7f8930b2f625d349524f388ad9
SSDEEP 24576:8oz43PXdQD7Yp8cSL+GZ7u16yBUnpP9PJp8L18slfSorEH7I:hdcMX7u1lGplPJp8L18sRSQ
TLSH
T1A5459E203B92D17ADEB1017019B8DF6B547DFD650F7248CB93C8066D5E609C21A3BAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

42:32:e3:f9:4f:a0:58:b7:c8:79:fa:b5:55:fb:f2:f6:1b:92:60:c4:22:13:9d:84:bc:e1:b2:95:a0:91:6c:c8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 3, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

42:32:e3:f9:4f:a0:58:b7:c8:79:fa:b5:55:fb:f2:f6:1b:92:60:c4:22:13:9d:84:bc:e1:b2:95:a0:91:6c:c8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=453 587 420,CN=SteelSeries France SASU,O=SteelSeries France SASU,L=Villeneuve-d'Ascq,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054c696c6c65,1.3.6.1.4.1.311.60.2.1.2=#130f48617574732d64652d4672616e6365,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Jun 14, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:00:b7:03:ba:6f:78:72:c1:5a:cb:a8:31:7e:2e:be

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2023 - Sep 25, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:10:bb:da:19:09:b3:f8:38:97:00:00:00:00:01:10

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 16, 2024 - May 14, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:06:d7:bc:51:38:98:23:ec:2c:00:01:00:00:02:06

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

226935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\fac0970a3d49f93d\Out\Release\Win32\NahimicSvc32.pdb

shlwapi

PathIsRelativeW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoActivateInstance

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CertFreeCertificateContext CryptQueryObject CryptMsgClose

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCurrentDirectoryW GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableA GetCommandLineW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleExW GetModuleHandleW FreeLibraryAndExitThread LoadLibraryExW GetModuleFileNameA FreeLibrary GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW OpenMutexW TryEnterCriticalSection OpenSemaphoreW InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx CreateMutexW WaitForSingleObject EnterCriticalSection CreateEventW WaitForSingleObjectEx ResetEvent ReleaseMutex CreateMutexExW DeleteCriticalSection ReleaseSemaphore SetEvent LeaveCriticalSection OpenEventW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException SetLastError GetLastError UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

ExitThread GetStartupInfoW GetCurrentThreadId TerminateThread CreateProcessW GetExitCodeProcess TerminateProcess ExitProcess GetPriorityClass SetPriorityClass GetCurrentProcessId GetExitCodeThread SwitchToThread GetCurrentThread ProcessIdToSessionId GetCurrentProcess SetThreadPriority GetThreadPriority OpenProcessToken TlsFree TlsSetValue TlsGetValue TlsAlloc

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetVersionExW GetLogicalProcessorInformation GetTickCount

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList InterlockedFlushSList InterlockedPushEntrySList InitializeSListHead QueryDepthSList

api-ms-win-core-com-l1-1-0

PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoInitializeSecurity

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap

api-ms-win-core-localization-l1-2-0

IsValidCodePage GetOEMCP LCMapStringW GetCPInfo EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP FormatMessageW GetLocaleInfoW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l1-1-0

LockFileEx UnlockFileEx GetDriveTypeW FindFirstFileExA CreateDirectoryW FindFirstFileExW FindFirstFileW CreateFileW FindNextFileA GetFileAttributesExW FindNextFileW FlushFileBuffers FindClose DeleteFileW GetFileInformationByHandle GetFullPathNameW WriteFile ReadFile SetEndOfFile SetFilePointerEx GetFileType

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

CheckTokenMembership GetTokenInformation CreateWellKnownSid FreeSid AllocateAndInitializeSid DuplicateToken IsValidSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait WTSGetActiveConsoleSessionId

oleaut32

SysAllocString SafeArrayLock SafeArrayCreate VariantClear SafeArrayUnlock SafeArrayGetVartype SafeArrayCopy SysFreeString SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetLBound

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleCP ReadConsoleW GetConsoleMode

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoA GetFileVersionInfoSizeA

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

kernel32

SleepConditionVariableCS WakeConditionVariable InitializeConditionVariable CreateThread QueryPerformanceFrequency LoadLibraryA RemoveDirectoryW Module32NextW Module32FirstW VirtualQuery InitOnceExecuteOnce GetThreadId SystemTimeToFileTime GetSystemTime GetModuleHandleA GetTickCount64 InitializeCriticalSection

user32

DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW AllowSetForegroundWindow RegisterDeviceNotificationW MessageBoxW PostMessageW GetMessageW UnregisterPowerSettingNotification TranslateMessage RegisterPowerSettingNotification UnregisterDeviceNotification UnregisterClassW PeekMessageW DispatchMessageW

shell32

CommandLineToArgvW ShellExecuteExW

ole32

CoInitialize

dbghelp

SymGetOptions SymFromAddr SymInitialize SymSetOptions

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpQueryHeaders WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpOpenRequest

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer QueueUserWorkItem UnregisterWaitEx CreateTimerQueue ChangeTimerQueueTimer CreateTimerQueueTimer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-memory-l1-1-0

VirtualFree UnmapViewOfFile VirtualProtect CreateFileMappingW MapViewOfFile VirtualAlloc

api-ms-win-core-console-l2-1-0

ReadConsoleOutputW SetConsoleCursorPosition AttachConsole GetConsoleScreenBufferInfo

api-ms-win-service-management-l1-1-0

DeleteService OpenServiceW OpenSCManagerW CreateServiceW CloseServiceHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-winsvc-l1-1-0

ControlService QueryServiceStatus

api-ms-win-core-registry-l1-1-0

RegSetKeySecurity RegCreateKeyExW RegCloseKey RegSetValueExW RegEnumKeyExW RegEnumValueW RegNotifyChangeKeyValue RegOpenKeyExW RegDeleteTreeW RegGetValueW RegOpenCurrentUser

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask GetProcessAffinityMask

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW RegSetKeyValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_fbf635461447a24c23c4848d561e3c96_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_njrat_remcos

PE Signature issue

PE Signature issue

shlwapi

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

wintrust

crypt32

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

oleaut32

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-versionansi-l1-1-1

api-ms-win-core-versionansi-l1-1-0

kernel32

user32

shell32

ole32

dbghelp

winhttp

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-1

generic