2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos
Size 578KB
Sample260910-jtkpssszav
SHA256 b15066346555ba0c40f749b8e54297101af81b56df8da430e01b75f51a845665
MD5 01a9172529bc23fe7b02d843afc578c5
SHA1 33ddd449bf71cf05b85b45e3b66467ec6dd37597
SHA512 b6da23501c729c04847692ff0bf8d254a0a50a4af0d86687c6ea9bb24beb40d64e272b740f58c723ee19ca6b7112bfe2077b93828db509b193f6845d434b8d57
SSDEEP 12288:+f/6yrJ9Iihyzexws228/6XWNe81NaDUkpoCUyu:+f/6yr7hQexD228/mUkpNRu
TLSH
T11DC48D1279A2C537D5B251F04939DB6A502EA9600F7619CBA3D80B2D9E345F32F32A37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos

File Explorer

2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos

.exe 578KB

2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos

IMPHASH 1c78f93f95796b269910f6eba481c943
SHA256 b15066346555ba0c40f749b8e54297101af81b56df8da430e01b75f51a845665
MD5 01a9172529bc23fe7b02d843afc578c5
SHA1 33ddd449bf71cf05b85b45e3b66467ec6dd37597
SHA512 b6da23501c729c04847692ff0bf8d254a0a50a4af0d86687c6ea9bb24beb40d64e272b740f58c723ee19ca6b7112bfe2077b93828db509b193f6845d434b8d57
SSDEEP 12288:+f/6yrJ9Iihyzexws228/6XWNe81NaDUkpoCUyu:+f/6yr7hQexD228/mUkpNRu
TLSH
T11DC48D1279A2C537D5B251F04939DB6A502EA9600F7619CBA3D80B2D9E345F32F32A37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266933

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\BuildAgent\work\Setup_BGFX_1_6\_result\x86_Release\dbginfo\msilogengine.pdb

kernel32

ReadFile SetLastError GetCurrentProcessId ProcessIdToSessionId FreeLibrary GetModuleHandleW GetProcAddress LocalFree FormatMessageW GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte ResetEvent WaitForSingleObjectEx CreateEventW WaitForMultipleObjects HeapAlloc HeapFree GetProcessHeap LocalAlloc InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId CopyFileA WriteConsoleW DeleteFileW CreateFileW CreateFileA GetLocalTime GetCommandLineW CreateEventA SetEvent CloseHandle CopyFileW GetExitCodeProcess GetLastError GetCommandLineA FindNextFileA FindFirstFileExA ReadConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize OpenProcess CreateDirectoryW GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FormatMessageA FindClose GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter RaiseException RtlUnwind LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle HeapReAlloc IsValidCodePage GetOEMCP

user32

RegisterWindowMessageA

advapi32

GetAclInformation AddAccessAllowedAceEx SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetLengthSid FreeSid CreateWellKnownSid AllocateAndInitializeSid AddAccessDeniedAceEx

shell32

SHGetFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_01a9172529bc23fe7b02d843afc578c5_amadey_cobalt-strike_darkgate_elex_lockergoga_luca-stealer_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

generic