2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader
Size 2.8MB
Sample260930-aaaaaa1gna
SHA256 62dcde7b287a8001b99ed34609ae213584aca539f7cf2478ccf3d334d82ea833
MD5 5f7fdf8469acf1a3723684686f1d0844
SHA1 fa36c49158b852a35e62c38ef822b049197ea22a
SHA512 c5f09bcff1ce3b7d8ee9fdeb5b0289fd65271768065d3b4fdf668801fe23160cbad40926b981d05955d35749dd676c9d275983e4a9dc080553e8a6779f77ac7e
SSDEEP 49152:dSNmXVku+VVk+iZ0lPTEnypffJ4klKXnoVkYej15VHW:ENFVm+i+PfJ4kBA15V2
TLSH
T1ECD5CF037F558462D6A14D70DD78A7A55728FD2C17FA03E7728029E9ECE02C23E35AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader

File Explorer

2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader

.exe 2.8MB

2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader

IMPHASH d8e2ddd9dca905aa9fc7a711bb5bd0f4
SHA256 62dcde7b287a8001b99ed34609ae213584aca539f7cf2478ccf3d334d82ea833
MD5 5f7fdf8469acf1a3723684686f1d0844
SHA1 fa36c49158b852a35e62c38ef822b049197ea22a
SHA512 c5f09bcff1ce3b7d8ee9fdeb5b0289fd65271768065d3b4fdf668801fe23160cbad40926b981d05955d35749dd676c9d275983e4a9dc080553e8a6779f77ac7e
SSDEEP 49152:dSNmXVku+VVk+iZ0lPTEnypffJ4klKXnoVkYej15VHW:ENFVm+i+PfJ4kBA15V2
TLSH
T1ECD5CF037F558462D6A14D70DD78A7A55728FD2C17FA03E7728029E9ECE02C23E35AE6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

554120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-e1ae94d8e66344a7989020677190c8be\src\QQPY6.x\client\Release\QQPYZiZaoCi.pdb

kernel32

InterlockedCompareExchange MapViewOfFile OpenFileMappingW MoveFileExW SetFileAttributesW GetTempPathW InitializeCriticalSection ReleaseMutex RemoveDirectoryW ExitThread FreeLibraryAndExitThread SetUnhandledExceptionFilter IsDebuggerPresent VirtualQuery lstrcpyW GetCurrentProcessId GetProcAddress LoadLibraryW GetCurrentThread FormatMessageW GetCurrentThreadId WriteFile IsBadWritePtr CreateDirectoryW GetModuleFileNameW TerminateProcess GetCurrentProcess MapViewOfFileEx WaitForSingleObject CreateFileMappingW SystemTimeToFileTime GetFileSize GetLocalTime GetLastError UnmapViewOfFile SetFilePointer GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar WideCharToMultiByte GetStringTypeW SetLastError MoveFileW TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetVersionExW InterlockedDecrement InterlockedIncrement FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetFileTime ReadFile SetEndOfFile LocalAlloc GetSystemDirectoryW Sleep FileTimeToSystemTime CreateMutexW OpenMutexW LocalFree GetDiskFreeSpaceExW GetDriveTypeW FreeLibrary HeapFree GetProcessHeap HeapAlloc HeapReAlloc RtlUnwind RaiseException LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateThread SetStdHandle SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP GetCurrentDirectoryW GetFullPathNameW HeapSize FlushFileBuffers WriteConsoleW GetSystemTime GetTempFileNameW CopyFileW CloseHandle DeleteFileW SwitchToThread CreateFileW

user32

SetWindowLongW SetPropW IsWindowEnabled TrackMouseEvent RegisterClassExW UnregisterClassW ScreenToClient CreateWindowExW SetWindowPos IsWindowVisible CallWindowProcW DefWindowProcW GetWindowLongW GetWindowTextW SetFocus OffsetRect SetWindowTextW GetFocus GetWindowTextLengthW GetWindow MapWindowPoints MonitorFromWindow GetParent SetCursor GetDC ReleaseDC SetCapture GetCursorPos GetMonitorInfoW MonitorFromPoint PostMessageW GetKeyState EnableWindow GetDesktopWindow NotifyWinEvent PostQuitMessage TranslateMessage DispatchMessageW UpdateLayeredWindow ReleaseCapture GetPropW GetWindowRect GetMessageW wvsprintfW DestroyWindow IsIconic SetForegroundWindow IsWindow GetClientRect BeginPaint EndPaint ShowWindow PtInRect SetTimer KillTimer LoadCursorW SendMessageW DrawTextW ClientToScreen

advapi32

BuildExplicitAccessWithNameW SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegOpenKeyW RegSetValueExW RegCloseKey GetSecurityInfo RegOpenKeyExW GetLengthSid AddAccessAllowedAceEx InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

ShellExecuteW SHCreateDirectoryExW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoCreateGuid StringFromGUID2 CoInitialize CoUninitialize CoTaskMemFree

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

msimg32

AlphaBlend

gdi32

BitBlt GetStockObject SelectObject CreateDIBSection CreateCompatibleDC CreateFontIndirectW DeleteDC SetTextColor SetBkMode DeleteObject GetFontData

ws2_32

ntohl htonl

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redline-stealer_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

version

msimg32

gdi32

ws2_32

generic