2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos
Size 2.6MB
Sample260919-tls2baha84
SHA256 77e561778755bf3993e7acc32c35f9b256be5a65fb86d0390d56ad09e0b222aa
MD5 11aa86f35785e942021982993d7629e0
SHA1 097b73b9420a97d7abf7afd1c3223be95b41ad13
SHA512 b9ca6e4bb36aad55340747347ce005f5ee99b6db68da4246913e89b7e2e19ebc5d367dce970ccc875391cfad567b2f62bc48798edd894e71cc74744e0651529c
SSDEEP 49152:0ZMZhevSINfmrPEuCZ4mvMyAPNTJmFo2uoEkGaMUolS3e7:dZhevv3uChvee0oEkGX
TLSH
T17ED5CF337390C0F5D1621574697CAB6A99BDBF300B2589C7B3803E2C6DB1AC39535A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos

.exe 2.6MB

2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos

IMPHASH 1cc2ceef54daceac9068d0203660ee8b
SHA256 77e561778755bf3993e7acc32c35f9b256be5a65fb86d0390d56ad09e0b222aa
MD5 11aa86f35785e942021982993d7629e0
SHA1 097b73b9420a97d7abf7afd1c3223be95b41ad13
SHA512 b9ca6e4bb36aad55340747347ce005f5ee99b6db68da4246913e89b7e2e19ebc5d367dce970ccc875391cfad567b2f62bc48798edd894e71cc74744e0651529c
SSDEEP 49152:0ZMZhevSINfmrPEuCZ4mvMyAPNTJmFo2uoEkGaMUolS3e7:dZhevv3uChvee0oEkGX
TLSH
T17ED5CF337390C0F5D1621574697CAB6A99BDBF300B2589C7B3803E2C6DB1AC39535A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

08:1c:0d:6f:b7:b9:62:a0:3d:26:31:08:5c:66:b0:7e:2d:f7:1a:bf:41:79:82:18:b4:af:5c:2e:a1:07:66:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1187746374661,CN=Aeroadmin LLC,O=Aeroadmin LLC,STREET=ul Konstantina Simonova\, 5 / korp 1 kv 16,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c16657567656e652e73406165726f61646d696e2e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 15, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

51:96:07:f8:a2:b2:b6:f2:fb:43:2f:b5

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2025 - Aug 27, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1248418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

aeroadmin.pdb

kernel32

AreFileApisANSI OpenProcess GetCurrentProcess GetVersionExW WTSGetActiveConsoleSessionId GetCommandLineW AttachConsole TerminateProcess GetCurrentProcessId ProcessIdToSessionId GetTickCount MoveFileExW WriteFile GetFileSizeEx CreateDirectoryW GetFileAttributesW Sleep ReadFile GetFileSize FreeLibrary GetFullPathNameW GetModuleFileNameW DeleteFileW CreateFileW CloseHandle LoadLibraryW DeleteCriticalSection InitializeCriticalSectionAndSpinCount DecodePointer GetProcAddress GetModuleHandleW GetLastError RaiseException WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA ReadConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetStdHandle GetModuleFileNameA ExitThread GetModuleHandleExW ExitProcess RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer WideCharToMultiByte MultiByteToWideChar GetStringTypeW FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection EncodePointer SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW SleepEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetExitCodeProcess UnmapViewOfFile CreateFileMappingW MapViewOfFile OpenFileMappingW SetEvent WaitForSingleObject WaitForMultipleObjects GetTickCount64 LocalFree GetUserGeoID GetGeoInfoW GetGeoInfoA GetSystemDirectoryW CancelIo GetOverlappedResult CreateNamedPipeW ConnectNamedPipe CreateJobObjectW SetInformationJobObject CreateProcessW AssignProcessToJobObject ResumeThread WaitNamedPipeW SetNamedPipeHandleState GetFileInformationByHandle GlobalAlloc GlobalLock GlobalUnlock GlobalFree SetThreadExecutionState GetConsoleWindow GetProcessId lstrlenW lstrcpynW GetSystemTime CompareFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetCurrentDirectoryW LocalAlloc OutputDebugStringA FreeConsole SetConsoleCtrlHandler GenerateConsoleCtrlEvent GetThreadTimes HeapAlloc GetProcessHeap HeapFree GetComputerNameW GetUserDefaultUILanguage FindResourceW LockResource LoadResource SizeofResource MoveFileW GetLogicalDriveStringsW GetVolumeInformationW GetDiskFreeSpaceExW FindFirstFileW FindNextFileW FindClose RemoveDirectoryW GetFileAttributesExW SetFileTime SetFilePointer SetEndOfFile ResetEvent InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer VirtualQuery

user32

RegisterClassExW CreateWindowExW DrawMenuBar LoadImageW GetGuiResources SetWindowTextW PostMessageW DestroyMenu TrackPopupMenu InsertMenuW CreatePopupMenu GetSystemMetrics GetCursorPos DefWindowProcW SetForegroundWindow PostQuitMessage DestroyWindow FindWindowW SendMessageW MessageBoxW ShowWindow IsWindow GetClipboardSequenceNumber OpenClipboard IsClipboardFormatAvailable CloseClipboard CharUpperBuffW MsgWaitForMultipleObjects GetDesktopWindow EmptyClipboard SetClipboardData LoadCursorW SetCursor SetClassLongW wsprintfW ExitWindowsEx ChangeDisplaySettingsW LockWorkStation GetMonitorInfoW EnumDisplaySettingsW EnumDisplayMonitors SendInput GetDC ReleaseDC mouse_event EnumDisplayDevicesW GetClipboardData ChangeDisplaySettingsExW OpenDesktopW SetThreadDesktop CloseDesktop MapVirtualKeyW RegisterClipboardFormatW GetWindowLongW TranslateMessage MapWindowPoints RedrawWindow SystemParametersInfoW EnableWindow GetDlgItem GetAsyncKeyState SetMenu GetClientRect InvalidateRect AdjustWindowRect SetFocus GetKeyState SetWindowPos EnableMenuItem GetSystemMenu GetWindowTextW MoveWindow FillRect UpdateWindow ScreenToClient DrawTextW CallNextHookEx MessageBeep ClientToScreen SetWindowsHookExW BroadcastSystemMessageW UnhookWindowsHookEx GetWindow GetPropW CallWindowProcW RemovePropW SetWindowTextA SetParent SetWindowLongW SetPropW GetWindowTextA GetScrollInfo SetScrollInfo IsDlgButtonChecked IsWindowEnabled GetMenu DrawEdge DrawTextExW DrawFrameControl GetParent GetKeyboardState ToAscii SetScrollPos ShowScrollBar SetScrollRange HideCaret ShowCaret SetCaretPos RegisterClassW BeginPaint EndPaint GetFocus GetScrollPos GetScrollRange CreateCaret DestroyCaret GetWindowPlacement DrawIconEx DestroyIcon OpenWindowStationW SetProcessWindowStation CloseWindowStation OpenInputDesktop GetUserObjectInformationW GetCursorInfo GetIconInfo GetWindowDC DestroyCursor CreateIconIndirect InsertMenuItemW CreateMenu SetMenuItemInfoW RemoveMenu GetMenuBarInfo GetDCEx LoadIconW PeekMessageW DispatchMessageW GetWindowRect

gdi32

GetTextMetricsW GetStockObject GetTextExtentPoint32W SetROP2 GetROP2 CreatePen Rectangle CreateDIBitmap CreatePatternBrush CreateFontW CreateFontIndirectW SetBkMode SetBrushOrgEx BitBlt SelectObject CreateDIBSection CreateCompatibleBitmap DeleteDC GetDeviceCaps GetDIBits StretchBlt SaveDC RestoreDC GetBitmapBits CreateBitmap SetBkColor ExtTextOutW SetTextColor CreateCompatibleDC DeleteObject CreateSolidBrush GetObjectW

shell32

ord74 SHBrowseForFolderW ord680 ShellExecuteW SHGetFileInfoW SHGetPathFromIDListW SHGetMalloc SHGetSpecialFolderPathW DragQueryFileW Shell_NotifyIconW CommandLineToArgvW ShellExecuteExW SHGetFolderPathW ord47

ole32

CoTaskMemAlloc OleIsCurrentClipboard OleSetClipboard CreateStreamOnHGlobal OleInitialize CoWaitForMultipleHandles CoUninitialize CoInitializeEx OleUninitialize CoInitialize CoCreateInstance

oleaut32

SysStringLen SysFreeString VariantInit VariantClear SysAllocString

comctl32

ord17 InitCommonControlsEx

crypt32

CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptHashCertificate CertFreeCertificateContext CertGetCertificateContextProperty CryptMsgClose CertCloseStore

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider

wintrust

WinVerifyTrust

gdiplus

GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdiplusShutdown GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusStartup

iphlpapi

IcmpCreateFile GetAdaptersAddresses IcmpSendEcho

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

msimg32

AlphaBlend

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winhttp

WinHttpOpen WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpSetStatusCallback WinHttpQueryOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpWriteData

winmm

waveOutOpen waveInAddBuffer waveInGetNumDevs timeEndPeriod timeBeginPeriod waveOutClose waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveInClose waveInUnprepareHeader waveInReset waveInStart waveInPrepareHeader waveInOpen waveInGetDevCapsW

ws2_32

gethostbyname inet_ntoa select freeaddrinfo getpeername closesocket setsockopt send ioctlsocket listen getaddrinfo accept recv WSAConnect ntohl gethostname bind WSAGetLastError WSAStartup WSACleanup WSASocketW

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

wininet

InternetGetConnectedState

comdlg32

GetOpenFileNameW

advapi32

DeleteService CreateProcessAsUserW SetServiceStatus RegisterServiceCtrlHandlerExW OpenSCManagerW CreateServiceW ChangeServiceConfig2W CloseServiceHandle RegCreateKeyExW OpenServiceW StartServiceW StartServiceCtrlDispatcherW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityInfo SetTokenInformation GetTokenInformation CreateWellKnownSid EqualSid ConvertSidToStringSidW GetSidSubAuthority GetSidSubAuthorityCount CryptAcquireContextW CryptGenRandom CryptReleaseContext ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW CreateProcessWithTokenW CreateProcessWithLogonW SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW RegCloseKey OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx SetFileSecurityW LookupAccountSidW AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

crypt32

bcrypt

wintrust

gdiplus

iphlpapi

mpr

msimg32

urlmon

userenv

winhttp

winmm

ws2_32

wtsapi32

wininet

comdlg32

advapi32

generic