2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 1.3MB
Sample260825-sgcm4abl4w
SHA256 ebb1de9c01ee78a74c5da92901fc8f50c3c7013462cdcf002444595c9ca1f52e
MD5 3ccc217e67b60638a02934976b695bd9
SHA1 0ec3b404afc266ed5e03515938ba89c2c1e42ca7
SHA512 ba1fdca7b08272745a849c54c148210d2ddfc4990ed9342ea1ed53b9848d13bfb91a9e3731f9a45e4a310556f1727ce1b4c7ae98ebc751401a37177705f8a1e9
SSDEEP 24576:ESUg4wd1XQ/EFd6oQ7dWWCjm1bmitsxq6OYAw3A8ckOXJATVVMrzS2LnUMDIE:HU7wcIJjtAsw6F9xO03Mrm27UMDIE
TLSH
T13B55AF617A43C0B2D59100F08D7DAB7B4A2CAF291B314AD7E3C86E3D59305D16A37B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 1.3MB

2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH 1679a5c6f05d9b5195b66ccfe1b877de
SHA256 ebb1de9c01ee78a74c5da92901fc8f50c3c7013462cdcf002444595c9ca1f52e
MD5 3ccc217e67b60638a02934976b695bd9
SHA1 0ec3b404afc266ed5e03515938ba89c2c1e42ca7
SHA512 ba1fdca7b08272745a849c54c148210d2ddfc4990ed9342ea1ed53b9848d13bfb91a9e3731f9a45e4a310556f1727ce1b4c7ae98ebc751401a37177705f8a1e9
SSDEEP 24576:ESUg4wd1XQ/EFd6oQ7dWWCjm1bmitsxq6OYAw3A8ckOXJATVVMrzS2LnUMDIE:HU7wcIJjtAsw6F9xO03Mrm27UMDIE
TLSH
T13B55AF617A43C0B2D59100F08D7DAB7B4A2CAF291B314AD7E3C86E3D59305D16A37B9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects command variations typically used by ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

721346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Legion\source\repos\last project\Release\curl.pdb

ws2_32

inet_addr recv ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send closesocket

normaliz

IdnToAscii

wldap32

ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegCreateKeyExA RegSetValueExA

kernel32

GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameA ExitProcess HeapAlloc GetModuleHandleExW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW RaiseException RtlUnwind WaitForSingleObject LoadLibraryW HeapFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetExitCodeProcess CreateProcessA SetStdHandle HeapReAlloc HeapSize FindFirstFileExA GetTimeZoneInformation FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap WriteConsoleW SetEndOfFile SetFilePointerEx GetCurrentDirectoryW GetLogicalDrives FindFirstFileW Process32First FindNextFileW TerminateProcess GetDriveTypeA FindClose OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle FreeConsole lstrcmpW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetLastError SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA QueryPerformanceCounter GetTickCount Sleep MultiByteToWideChar WideCharToMultiByte MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA VerSetConditionMask VerifyVersionInfoA CreateFileA GetFileSizeEx GetCurrentThread GetThreadTimes UnregisterWaitEx QueryDepthSList InterlockedFlushSList CreateDirectoryW CreateFileW DeleteFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetModuleHandleW CreateDirectoryExW CopyFileW MoveFileExW FormatMessageW GetStringTypeW TryEnterCriticalSection GetCurrentThreadId DuplicateHandle GetCurrentProcess SwitchToThread GetExitCodeThread InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_3ccc217e67b60638a02934976b695bd9_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

ws2_32

normaliz

wldap32

crypt32

advapi32

kernel32

generic