2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 4.2MB
Sample260826-21tkdsfg45
SHA256 b6a853085e3d6263921df5c23ddff7e2f7150d555de92f1e08ba42097fa329a6
MD5 664b83752fee6df821967c44d29ed5f3
SHA1 291396729dc26be20676592f09f64c5f8b6c0092
SHA512 8d69ab809ec2070087a0dc0efda9ab5346435c8070c8141891777da3a0fa01dc2cf8664145aa27ef359c270bbfecfac894ef36ce71db49ec6ce93c321927f48d
SSDEEP 49152:F5Yc3Gy3p7SiYan6+uuHaCbVECKXUKZsJm3dPWxp+8wIgKb/vYXoY9j4F7ebZe4c:V3VZVdSv3dP0KIgKFGIJbF
TLSH
T1D626A21226D1DFE5C05F61B0EC2AB6F8562B9D20DF220FCB6E407F5935B16916831A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 4.2MB

2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 2460524b1b5ecd233a122baefa2291ff
SHA256 b6a853085e3d6263921df5c23ddff7e2f7150d555de92f1e08ba42097fa329a6
MD5 664b83752fee6df821967c44d29ed5f3
SHA1 291396729dc26be20676592f09f64c5f8b6c0092
SHA512 8d69ab809ec2070087a0dc0efda9ab5346435c8070c8141891777da3a0fa01dc2cf8664145aa27ef359c270bbfecfac894ef36ce71db49ec6ce93c321927f48d
SSDEEP 49152:F5Yc3Gy3p7SiYan6+uuHaCbVECKXUKZsJm3dPWxp+8wIgKb/vYXoY9j4F7ebZe4c:V3VZVdSv3dP0KIgKFGIJbF
TLSH
T1D626A21226D1DFE5C05F61B0EC2AB6F8562B9D20DF220FCB6E407F5935B16916831A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d1:79:a9:2d:db:e1:4c:31:22:a5:a6:65:fd:f8:12:d4:33:1a:93:dc:2d:7e:26:5b:97:46:03:81:38:17:f2:41

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 30, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:84:8e:a3:9b:36:d7:bb:53:3c:f4:3d:96:d6:e1:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2025632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\AcroRd32Exe.pdb

kernel32

LoadResource SizeofResource FindResourceW LoadLibraryA SetDllDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW QueryDosDeviceW lstrcmpA lstrcmpW CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetSystemPowerStatus CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA FindResourceExW LockResource SetErrorMode QueryPerformanceCounter HeapSetInformation WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv IsProcessorFeaturePresent LoadLibraryExW UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetExitCodeProcess InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy RaiseException DecodePointer GetLongPathNameW GetCurrentDirectoryW SetCurrentDirectoryW GetTickCount OpenMutexW GetVolumeInformationW CreateThread CreateEventW CreateMutexW ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType GetStartupInfoW lstrlenW GetCurrentProcess GetTempPathW CreateFileW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask MultiByteToWideChar WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwind VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx FormatMessageW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc DebugBreak IsDebuggerPresent GetModuleHandleExW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW GetVersionExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryFullProcessImageNameW GlobalHandle GlobalSize GetComputerNameExW OpenEventW CreateDirectoryExW CompareFileTime GetFileTime GetFullPathNameW GetExitCodeThread GetTempFileNameW GetModuleHandleExA InitializeCriticalSectionAndSpinCount GetStdHandle ExitThread SearchPathW VirtualFree CreateJobObjectW CreateRemoteThread SignalObjectAndWait VirtualProtect VirtualQuery GetProcessId TerminateProcess DuplicateHandle GetProcessTimes ExpandEnvironmentStringsW ProcessIdToSessionId IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryThreadCycleTime GetThreadPriority UnregisterWaitEx RegisterWaitForSingleObject GetUserDefaultLangID GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA SetEnvironmentVariableW GetEnvironmentVariableW GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetProfileStringW ReadProcessMemory CreateIoCompletionPort TerminateJobObject GetQueuedCompletionStatus UnregisterWait PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation SetProcessDEPPolicy AssignProcessToJobObject

user32

CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW PostMessageW LoadIconW SetProcessWindowStation ReleaseDC GetDC MsgWaitForMultipleObjects RegisterClipboardFormatW PeekMessageW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongW ShowWindow SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA KillTimer SetTimer DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA GetThreadDesktop PostThreadMessageW IsWindowEnabled CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows EnableWindow GetRawInputDeviceInfoW SetActiveWindow PtInRect SetCursorPos CreateIconFromResourceEx GetWindowTextLengthW RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction GetProcessWindowStation SendDlgItemMessageW CloseWindow LoadCursorW GetClipboardData OpenClipboard CloseClipboard IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats EmptyClipboard SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer GetWindowDC GetMessageW SystemParametersInfoW BeginPaint EndPaint ScreenToClient GetClientRect MapWindowPoints SetCursor IsChild IsDialogMessageW FillRect LoadBitmapW MapDialogRect SetWindowContextHelpId GetClassInfoExW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen MoveWindow SetCapture ReleaseCapture InvalidateRect InvalidateRgn SetFocus DestroyAcceleratorTable CreateDialogIndirectParamW UpdateWindow SetRect IsRectEmpty PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongW GetWindowTextW GetAncestor FindWindowW GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics keybd_event BringWindowToTop SetWindowPos WaitForInputIdle EnumDesktopWindows GetGUIThreadInfo SetWindowTextW AllowSetForegroundWindow GetForegroundWindow CharNextW EndDialog DialogBoxParamW UnregisterClassW GetWindowThreadProcessId FindWindowExW IsWindow SendMessageTimeoutW GetUserObjectInformationW GetPropA

advapi32

CryptGenKey RegGetValueW RegQueryValueA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW RegOpenKeyExA ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW LookupPrivilegeValueW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CredFree CredReadW RegQueryValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CryptSetKeyParam CryptContextAddRef GetUserNameW ImpersonateAnonymousToken

shlwapi

UrlUnescapeW PathFindFileNameW PathRemoveFileSpecW PathIsURLW UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathFindExtensionA PathCombineW PathIsRelativeW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathIsUNCServerShareW ord219 PathFindExtensionW UrlCanonicalizeW PathCreateFromUrlW PathAddBackslashW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetCredentials WinHttpWriteData

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_664b83752fee6df821967c44d29ed5f3_akira_amadey_darkgate_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

kernel32

user32

advapi32

shlwapi

version

winhttp

generic