2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader
Size 3.6MB
Sample260922-k6mwcsce64
SHA256 91083c37f834879b4dcf7f76ef8e2ff91b87eea8ffdbb517fa0580a2f525e5f0
MD5 efc5d2b1c5bb0ee07bb7c4a5525de34f
SHA1 77c7a39d746ee611b1deeeed540d2bbb61bce407
SHA512 467da7509dbfddd4ddf1c7cd5b0c4baae87a11686a9dafa22709cf10ff2800b945a0af26d951cef1b7fe7e1d3c051d16e789d10163b3944bf13236d868b17183
SSDEEP 98304:r3czn5PIlmeJwqbhIW5uz/Cnr+UawDjrW5pm6008tVAn0n:ro594wkIW5uz/gawDj+pVeh
TLSH
T12506120179A1717AC52302318F9DBAB520BD3EB1563A55EF23E83B2C1D718D26B39727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

.exe 3.6MB

2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

IMPHASH 192935baf4dee964a1e27272752a8b4e
SHA256 91083c37f834879b4dcf7f76ef8e2ff91b87eea8ffdbb517fa0580a2f525e5f0
MD5 efc5d2b1c5bb0ee07bb7c4a5525de34f
SHA1 77c7a39d746ee611b1deeeed540d2bbb61bce407
SHA512 467da7509dbfddd4ddf1c7cd5b0c4baae87a11686a9dafa22709cf10ff2800b945a0af26d951cef1b7fe7e1d3c051d16e789d10163b3944bf13236d868b17183
SSDEEP 98304:r3czn5PIlmeJwqbhIW5uz/Cnr+UawDjrW5pm6008tVAn0n:ro594wkIW5uz/gawDj+pVeh
TLSH
T12506120179A1717AC52302318F9DBAB520BD3EB1563A55EF23E83B2C1D718D26B39727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetThreadTimes CreateSemaphoreA CreateEventA SetThreadPriority GetDiskFreeSpaceExW GetCommandLineW InterlockedDecrement InterlockedIncrement CreateThread lstrcmpiW OutputDebugStringW GetStdHandle GetFileInformationByHandle GetSystemInfo GetProcessAffinityMask GlobalMemoryStatus FileTimeToSystemTime FileTimeToLocalFileTime SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize FindNextFileW FindFirstFileW GetModuleHandleA FindClose MoveFileExW MoveFileW DeleteFileW GetFileAttributesW SetFileAttributesW CreateFileW RemoveDirectoryW CreateDirectoryW GetCurrentDirectoryW GetWindowsDirectoryW GetTempPathW SetFileTime SetLastError GetCurrentThreadId GetCurrentProcessId FormatMessageW LocalFree GetModuleFileNameW LoadLibraryW FreeLibrary WideCharToMultiByte MultiByteToWideChar CreateEventW CloseHandle WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection GetSystemDirectoryW LoadLibraryExW lstrcatW GetVersionExW VirtualFree VirtualAlloc lstrlenW GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead GetACP VerSetConditionMask VerifyVersionInfoW FreeResource ExitProcess MulDiv GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileType DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime GetLocalTime HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetFileAttributesExW CopyFileW GetExitCodeProcess CreateProcessW RtlUnwind ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThread FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx GetTimeZoneInformation ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW GetModuleHandleW GetProcAddress FindResourceW SizeofResource LoadResource LockResource SetPriorityClass Sleep WaitForMultipleObjects GetCurrentProcess CompareFileTime GetTickCount DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetLastError RaiseException DecodePointer

user32

ClientToScreen GetSysColor CreateAcceleratorTableW InvalidateRgn DestroyIcon GetIconInfo GetClientRect GetPropW SetPropW SetForegroundWindow GetSystemMetrics MsgWaitForMultipleObjects BringWindowToTop IsWindowVisible SetWindowPos DestroyWindow IsWindow GetClassInfoExW RegisterClassExW RegisterClassW DefWindowProcW GetCaretPos DispatchMessageW TranslateMessage GetMessageW PostMessageW EndDialog SendMessageW SetCaretPos ShowCaret HideCaret CreateCaret EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetWindowRgn MonitorFromPoint GetDesktopWindow SetRect FillRect ShowWindow MoveWindow GetDlgItem SetDlgItemTextW SetFocus GetFocus GetKeyState EnableWindow DrawTextW CharPrevW SetWindowRgn IsIconic IntersectRect UpdateWindow PtInRect IsRectEmpty MapWindowPoints GetCursorPos GetUpdateRect CharNextW EndPaint BeginPaint ReleaseDC GetDC SetCapture InvalidateRect SetWindowTextW GetWindowRect ScreenToClient SetTimer UpdateLayeredWindow PostQuitMessage ReleaseCapture IsZoomed GetWindowTextLengthW GetWindowTextW LoadStringW CreateWindowExW CallWindowProcW SystemParametersInfoW MapDialogRect OffsetRect UnionRect InflateRect GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow PeekMessageW KillTimer MessageBoxW SetCursor GetParent LoadCursorW LoadIconW wsprintfW CharUpperW GetWindowLongW SetWindowLongW

gdi32

GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn GetObjectA CreateRoundRectRgn GetDIBits CreateDCW SetWindowOrgEx BitBlt CreateDIBSection GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteDC CreatePen CreateFontIndirectW PtInRegion CreateRectRgn GetDeviceCaps DeleteObject CreateICW CreateCompatibleDC CreateCompatibleBitmap TextOutW MoveToEx SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetObjectW LineTo

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW

shell32

SHGetFileInfoW SHBrowseForFolderW ord75 SHGetSpecialFolderPathW ShellExecuteW SHGetPathFromIDListW

ole32

RegisterDragDrop CoCreateInstance CoInitialize CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree OleInitialize RevokeDragDrop CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning

oleaut32

SysAllocString SysAllocStringLen VarUI4FromStr SysFreeString VariantClear SysStringLen VariantInit

shlwapi

ord219 PathFileExistsW

gdiplus

GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawRectangleI GdipDrawPath GdipCreateFontFromDC GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdiplusStartup GdiplusShutdown GdipCreateLineBrushI GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawArcI GdipCreateBitmapFromHBITMAP GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipSetTextRenderingHint GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdipFillRectangleI GdipBitmapUnlockBits GdipCreateHBITMAPFromBitmap

comctl32

_TrackMouseEvent ord17

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

Name

.text

Size

779KB

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_efc5d2b1c5bb0ee07bb7c4a5525de34f_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

imm32

generic