2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat
Size 1.9MB
Sample260910-hfd5eshl8x
SHA256 e18aa5119b9330f23ef27844ea03f7439448da55af74fa87ece586dea610889c
MD5 2ffcb53bfbad4a7bc7078271e8e31791
SHA1 925a8878f24d2800b6ffae6fff580866b7b9bb0f
SHA512 58bac6cc3956a0587705e8ddac99e4ae9bee517616a6d7631ec4eb769d7aa734cc253a8916930501d4b33e15976f3ca4a08007ee0b7b224bb089b30eef44a04d
SSDEEP 49152:VktERlzetzBeg2L9SgFp9B5rRAu9SlPCkORi2RNioDmg27RnWGj:VktERlzetzBeg2L9l9jr2ucORioD5273
TLSH
T1B595CF257802C075D99100B1DABCEBF58A6D9E308B3561D79B943E6CEA301E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

.exe 1.9MB

2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

IMPHASH 660b2eb72a7cb7cd1570b35441627052
SHA256 e18aa5119b9330f23ef27844ea03f7439448da55af74fa87ece586dea610889c
MD5 2ffcb53bfbad4a7bc7078271e8e31791
SHA1 925a8878f24d2800b6ffae6fff580866b7b9bb0f
SHA512 58bac6cc3956a0587705e8ddac99e4ae9bee517616a6d7631ec4eb769d7aa734cc253a8916930501d4b33e15976f3ca4a08007ee0b7b224bb089b30eef44a04d
SSDEEP 49152:VktERlzetzBeg2L9SgFp9B5rRAu9SlPCkORi2RNioDmg27RnWGj:VktERlzetzBeg2L9l9jr2ucORioD5273
TLSH
T1B595CF257802C075D99100B1DABCEBF58A6D9E308B3561D79B943E6CEA301E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

677347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

kernel32

GetCurrentProcess TerminateProcess OpenProcess GlobalAlloc GlobalFree LocalAlloc LocalFree SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindNextFileW FlushFileBuffers GetFileSizeEx GetFullPathNameW SetEndOfFile SetFilePointerEx GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW GetNamedPipeInfo SetEvent ResetEvent ReleaseMutex WaitForSingleObject CreateEventW WaitForMultipleObjects SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue VirtualAlloc VirtualFree FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryExW MoveFileExW RtlCaptureStackBackTrace InitializeCriticalSection DeleteCriticalSection LCMapStringW GetCurrentThread FormatMessageW LocalReAlloc GetSystemTimeAsFileTime MultiByteToWideChar GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TryEnterCriticalSection QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetModuleHandleW EncodePointer DecodePointer CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW SignalObjectAndWait CreateThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RtlUnwind GetTimeZoneInformation GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread ResumeThread ExitProcess GetCommandLineA ReadConsoleW GetConsoleCP HeapFree HeapAlloc GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap HeapSize WriteConsoleW RaiseException GetOverlappedResult ConnectNamedPipe ReadFile FindClose DeleteFileW GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation GetCurrentThreadId GetCurrentProcessId Sleep WriteFile GetFileAttributesW GetStdHandle LeaveCriticalSection EnterCriticalSection SwitchToThread GetEnvironmentVariableW TlsFree GetTickCount GetModuleFileNameW SetDllDirectoryW CloseHandle GetLastError CreateMutexW GetCommandLineW

user32

PostQuitMessage PostMessageW PeekMessageW DispatchMessageW TranslateMessage DestroyWindow SetTimer MsgWaitForMultipleObjectsEx DefWindowProcW CreateWindowExW RegisterClassW SetWindowLongW GetWindowLongW GetShellWindow EnumWindows KillTimer GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW ConvertStringSidToSidW CreateProcessWithTokenW LookupPrivilegeValueW SetTokenInformation GetTokenInformation GetSidSubAuthority GetLengthSid FreeSid EqualSid DuplicateTokenEx AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW CommandLineToArgvW SHCreateDirectoryExW

ws2_32

htonl ntohs bind closesocket connect ioctlsocket getsockname getsockopt htons listen recv select send socket WSAStartup WSAGetLastError __WSAFDIsSet inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname WSASetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_2ffcb53bfbad4a7bc7078271e8e31791_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

kernel32

user32

crclient

advapi32

shell32

ws2_32

generic