2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat
Size 1.9MB
Sample260924-r4sgdsxset
SHA256 d31a03997631ee852564f3386b2acd2c0512f2c5375b07dbb3e7b018028c77ff
MD5 0aafff8de509e10e5fbc9d8b54c4e4bc
SHA1 9e9d48418e011af1ecbab41dab000eb0f68ccbfd
SHA512 62c472b76c50c7924ba586170b5f0dcf63caaa9e952207c18df8897a4c6a0f9d3b56cbc76c5f6190a5fe5564043adba5f9fd5900b92c9bd2fe9dfac362d6a23d
SSDEEP 49152:wktERlzetzBeg2L9SgFp9B5rRAu9SlPCkORi2RNiGDmg27RnWGj:wktERlzetzBeg2L9l9jr2ucORiGD5273
TLSH
T1DE95CF257802C075D99100B1CABCEBF58A6D9E309B3561D79B943E6CEA301E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

.exe 1.9MB

2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

IMPHASH 660b2eb72a7cb7cd1570b35441627052
SHA256 d31a03997631ee852564f3386b2acd2c0512f2c5375b07dbb3e7b018028c77ff
MD5 0aafff8de509e10e5fbc9d8b54c4e4bc
SHA1 9e9d48418e011af1ecbab41dab000eb0f68ccbfd
SHA512 62c472b76c50c7924ba586170b5f0dcf63caaa9e952207c18df8897a4c6a0f9d3b56cbc76c5f6190a5fe5564043adba5f9fd5900b92c9bd2fe9dfac362d6a23d
SSDEEP 49152:wktERlzetzBeg2L9SgFp9B5rRAu9SlPCkORi2RNiGDmg27RnWGj:wktERlzetzBeg2L9l9jr2ucORiGD5273
TLSH
T1DE95CF257802C075D99100B1CABCEBF58A6D9E309B3561D79B943E6CEA301E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

677347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

kernel32

GetCurrentProcess TerminateProcess OpenProcess GlobalAlloc GlobalFree LocalAlloc LocalFree SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindNextFileW FlushFileBuffers GetFileSizeEx GetFullPathNameW SetEndOfFile SetFilePointerEx GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW GetNamedPipeInfo SetEvent ResetEvent ReleaseMutex WaitForSingleObject CreateEventW WaitForMultipleObjects SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue VirtualAlloc VirtualFree FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryExW MoveFileExW RtlCaptureStackBackTrace InitializeCriticalSection DeleteCriticalSection LCMapStringW GetCurrentThread FormatMessageW LocalReAlloc GetSystemTimeAsFileTime MultiByteToWideChar GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TryEnterCriticalSection QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetModuleHandleW EncodePointer DecodePointer CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW SignalObjectAndWait CreateThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RtlUnwind GetTimeZoneInformation GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread ResumeThread ExitProcess GetCommandLineA ReadConsoleW GetConsoleCP HeapFree HeapAlloc GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap HeapSize WriteConsoleW RaiseException GetOverlappedResult ConnectNamedPipe ReadFile FindClose DeleteFileW GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation GetCurrentThreadId GetCurrentProcessId Sleep WriteFile GetFileAttributesW GetStdHandle LeaveCriticalSection EnterCriticalSection SwitchToThread GetEnvironmentVariableW TlsFree GetTickCount GetModuleFileNameW SetDllDirectoryW CloseHandle GetLastError CreateMutexW GetCommandLineW

user32

PostQuitMessage PostMessageW PeekMessageW DispatchMessageW TranslateMessage DestroyWindow SetTimer MsgWaitForMultipleObjectsEx DefWindowProcW CreateWindowExW RegisterClassW SetWindowLongW GetWindowLongW GetShellWindow EnumWindows KillTimer GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW ConvertStringSidToSidW CreateProcessWithTokenW LookupPrivilegeValueW SetTokenInformation GetTokenInformation GetSidSubAuthority GetLengthSid FreeSid EqualSid DuplicateTokenEx AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW CommandLineToArgvW SHCreateDirectoryExW

ws2_32

htonl ntohs bind closesocket connect ioctlsocket getsockname getsockopt htons listen recv select send socket WSAStartup WSAGetLastError __WSAFDIsSet inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname WSASetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_0aafff8de509e10e5fbc9d8b54c4e4bc_amadey_darkgate_elex_expiro_glassworm_luca-stealer_magniber_njrat

kernel32

user32

crclient

advapi32

shell32

ws2_32

generic