2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader
Size 1.6MB
Sample260919-29w2wagl21
SHA256 33cf32bf7462d83cb7d94c07c238a5d1f714820132838a78a2487f50a8823828
MD5 8ec89b27c1ee2c60d03d387fdb27d455
SHA1 94049eeeb8cda1cdaa21fbba3e6cceb8ccee6609
SHA512 0a783107b5d675b111b90bd7c458727826689ce24119e6e9ad37b2b0748718c9bdebd71935421f04a642c385a2700971b6e647020161e3b7737f7a4cb2e4ba4c
SSDEEP 24576:Y3Re+iNEESKSn2tKzhn6HElm+RSqf2YTb8fI45TmWPV4WsRgIeVLKjv7:Y3asP2tKV6HPsSqfYJ5TmkMQVLKT
TLSH
T1E175E0507962C032D56262300D69F7AB41ADBE751F360ADF73C82E6D6E705C26A31E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

.exe 1.6MB

2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

IMPHASH 4ac212615b53630ffc8a6cde58da6c98
SHA256 33cf32bf7462d83cb7d94c07c238a5d1f714820132838a78a2487f50a8823828
MD5 8ec89b27c1ee2c60d03d387fdb27d455
SHA1 94049eeeb8cda1cdaa21fbba3e6cceb8ccee6609
SHA512 0a783107b5d675b111b90bd7c458727826689ce24119e6e9ad37b2b0748718c9bdebd71935421f04a642c385a2700971b6e647020161e3b7737f7a4cb2e4ba4c
SSDEEP 24576:Y3Re+iNEESKSn2tKzhn6HElm+RSqf2YTb8fI45TmWPV4WsRgIeVLKjv7:Y3asP2tKV6HPsSqfYJ5TmkMQVLKT
TLSH
T1E175E0507962C032D56262300D69F7AB41ADBE751F360ADF73C82E6D6E705C26A31E3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\gitee\network_develop0\out\Release\NetworkDaemon.pdb

fwpuclnt

FwpmTransactionCommit0 FwpmFilterDestroyEnumHandle0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmCalloutGetByKey0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerAdd0 FwpmFilterEnum0 FwpmEngineClose0 FwpmTransactionAbort0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmTransactionBegin0 FwpmFilterCreateEnumHandle0

ws2_32

inet_ntoa

iphlpapi

DeleteUnicastIpAddressEntry GetUnicastIpAddressTable GetAdaptersInfo FreeMibTable

rasapi32

RasHangUpW RasEnumConnectionsW

kernel32

WriteFile GetStdHandle ExitProcess GetModuleHandleExW GetCommandLineA ExitThread GetCommandLineW GetFileSizeEx GetFileType HeapAlloc HeapFree SetEnvironmentVariableW RaiseException SetLastError UnmapViewOfFile CloseHandle ReadFile GetCurrentProcess TerminateProcess GetModuleFileNameW OpenProcess MultiByteToWideChar GetLastError Process32NextW Process32FirstW GetProcAddress GetModuleHandleW WideCharToMultiByte GetTickCount VirtualFree VirtualAlloc OpenFileMappingW GetCurrentProcessId MapViewOfFile CreateEventW FreeLibrary FindFirstFileExA FindNextFileA FindClose WaitForMultipleObjects SetEvent ResetEvent GetExitCodeProcess RtlUnwind LoadLibraryW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode FlushFileBuffers ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect GetVersionExW LoadLibraryExW GetModuleHandleA SetStdHandle HeapSize WriteConsoleW CreateToolhelp32Snapshot QueryPerformanceCounter CreateFileW FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread

advapi32

ReportEventW RegOpenKeyExW RegDeleteTreeW RegDeleteKeyW RegEnumKeyW DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW RegGetValueW RegCloseKey

rpcrt4

UuidEqual UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_8ec89b27c1ee2c60d03d387fdb27d455_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

fwpuclnt

ws2_32

iphlpapi

rasapi32

kernel32

advapi32

rpcrt4

generic