2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

General

Target
2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader
Size 1.8MB
Sample260910-ge3wqayglc
SHA256 d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d
MD5 52be22a71bc3c0da32f39c5a3676e872
SHA1 48f338852e99b2613a13cd9c782831a4d9c9f81f
SHA512 0e931d037b9a18b1dc7e3e79b8e2ad88534491d8785f8f9175919334ecf5006fbeb1de6e213a681813b189a9c5b7597f328c0072342d03ade4c46a7e059024f8
SSDEEP 24576:GLECPTTOIJ8a1ntsmsEv9dPWTXNyxknw4FYnshx8OfVe247:G53TLsmsmXPWTX4x4x8EVep
TLSH
T1D495F120BA72C03AC57241718D78E7A5456DB9240F3146EFF7D85B2E5E708E2AB35A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

.exe 1.8MB

2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

IMPHASH a38a3b1ecad42456958003adf0c4d583
SHA256 d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d
MD5 52be22a71bc3c0da32f39c5a3676e872
SHA1 48f338852e99b2613a13cd9c782831a4d9c9f81f
SHA512 0e931d037b9a18b1dc7e3e79b8e2ad88534491d8785f8f9175919334ecf5006fbeb1de6e213a681813b189a9c5b7597f328c0072342d03ade4c46a7e059024f8
SSDEEP 24576:GLECPTTOIJ8a1ntsmsEv9dPWTXNyxknw4FYnshx8OfVe247:G53TLsmsmXPWTX4x4x8EVep
TLSH
T1D495F120BA72C03AC57241718D78E7A5456DB9240F3146EFF7D85B2E5E708E2AB35A33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

144383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsusFanControlService\Release\FanSetup.pdb

kernel32

GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile OutputDebugStringA GetModuleFileNameW GetDynamicTimeZoneInformation WaitForSingleObject GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Sleep GetConsoleMode GetFileAttributesA Process32NextW Process32FirstW CloseHandle SetCurrentDirectoryW GetCurrentProcessId CreateProcessW QueryFullProcessImageNameW GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize CreateFileW ReadConsoleW ReadFile GetLastError WideCharToMultiByte EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DuplicateHandle WaitForSingleObjectEx GetCurrentProcess SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree SetStdHandle GetFileType SetFilePointerEx GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleCP DeleteFileW MoveFileExW GetFileSizeEx CreateDirectoryW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap

shell32

SHGetFolderPathA ord680

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

kernel32

shell32

shlwapi

generic