2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 5.8MB
Sample260930-d49tsazsbt
SHA256 05f5c16c8ec9ae7c80f648544e065312495390648409d55b5c76453ce6832be1
MD5 2f9b137961f9bac06c11988950afb107
SHA1 4151be376b0e2ad7bd04be74013e261d39a47206
SHA512 2259e1698f4257a475a7b4822787bb2a430c97ca9eb500161b10110c8a72b1d70cea3694466a60380a74dbc860d924df1d79d40349d05d60d358e157e3f3ffd8
SSDEEP 98304:ArQX6ul1G6yjMiYfkHRSXNssqoUBPoM40iF6HYp4UVGk30eVkbJPbLvul:yQXd1nkHeMriF64mUVv0eeJPH
TLSH
T18256E030BB4A8031E9A201B056ADABBB546DBA38177900CBF2941F9D59706D37E37F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 5.8MB

2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH d6d16ba00d6c313df7cfd64034a9b3b4
SHA256 05f5c16c8ec9ae7c80f648544e065312495390648409d55b5c76453ce6832be1
MD5 2f9b137961f9bac06c11988950afb107
SHA1 4151be376b0e2ad7bd04be74013e261d39a47206
SHA512 2259e1698f4257a475a7b4822787bb2a430c97ca9eb500161b10110c8a72b1d70cea3694466a60380a74dbc860d924df1d79d40349d05d60d358e157e3f3ffd8
SSDEEP 98304:ArQX6ul1G6yjMiYfkHRSXNssqoUBPoM40iF6HYp4UVGk30eVkbJPbLvul:yQXd1nkHeMriF64mUVv0eeJPH
TLSH
T18256E030BB4A8031E9A201B056ADABBB546DBA38177900CBF2941F9D59706D37E37F53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2386352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Surfright\Producten\Alert\branch-2xxx\bin\Release\hmpalert.pdb

kernel32

CloseHandle InterlockedIncrement QueueUserWorkItem GetSystemTimeAsFileTime CreateDirectoryW DeleteCriticalSection CompareFileTime InitializeCriticalSection EnterCriticalSection GetWindowsDirectoryW TryEnterCriticalSection LeaveCriticalSection InterlockedDecrement MultiByteToWideChar WideCharToMultiByte InterlockedExchange InterlockedCompareExchange CreateEventW CreateThread SignalObjectAndWait TerminateThread WaitForSingleObject FindResourceW SizeofResource LoadResource LockResource FreeResource GetLastError Sleep GetCurrentProcess GetModuleHandleA GetProcAddress WTSGetActiveConsoleSessionId LocalAlloc GetDriveTypeW GetVolumeInformationW FileTimeToSystemTime GetDateFormatW SetEvent ResetEvent SetThreadPriority GetCurrentThread GetTickCount OpenProcess DuplicateHandle GetModuleHandleExW GetLogicalDriveStringsW QueryDosDeviceW GetLongPathNameW GlobalAlloc GlobalLock GlobalUnlock FileTimeToLocalFileTime GetComputerNameW GetCurrentProcessId WaitForMultipleObjects WaitForSingleObjectEx GetOverlappedResult CancelIo CreateWaitableTimerW SetWaitableTimer CreateFileA GetFileSize CreateTimerQueue DeleteTimerQueueEx CopyFileW DeleteFileW DeleteTimerQueueTimer CreateTimerQueueTimer ReadDirectoryChangesW FreeLibrary ReadFile GetFileInformationByHandle IsWow64Process LoadLibraryW ReadProcessMemory QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA ProcessIdToSessionId WriteFile FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryA LoadLibraryExA VirtualProtect LoadLibraryExW GetFileSizeEx GetSystemTime SetLastError CreateHardLinkW MoveFileExW OpenEventW GetCurrentThreadId SetFilePointer GetComputerNameA GetLocalTime GlobalFree GetModuleFileNameW GetExitCodeProcess TerminateProcess GetTimeZoneInformation GetVersionExW CreateProcessW CreateEventA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile CreateFileW HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW CreateIoCompletionPort DisconnectNamedPipe GetQueuedCompletionStatus CreateNamedPipeW ConnectNamedPipe PeekNamedPipe WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetFileType GetACP ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer SwitchToThread GetStringTypeW TransactNamedPipe CancelWaitableTimer ResumeThread InitializeCriticalSectionAndSpinCount GetCalendarInfoA MulDiv ConvertDefaultLocale VerifyVersionInfoW VerSetConditionMask GetSystemWow64DirectoryW OpenMutexW GetNativeSystemInfo GetModuleHandleExA GetConsoleMode VirtualAlloc GetStdHandle VirtualFree SetNamedPipeHandleState WaitNamedPipeW GetModuleHandleW VirtualQuery RaiseException DeviceIoControl GetSystemDirectoryW LocalFree HeapValidate SystemTimeToFileTime

user32

GetUserObjectInformationW GetAsyncKeyState TrackPopupMenu ModifyMenuW EnumDesktopWindows ChildWindowFromPointEx ScrollDC CreateIconIndirect LoadImageW EnableMenuItem SetMenuDefaultItem AppendMenuW CreatePopupMenu RegisterWindowMessageA ChangeDisplaySettingsW EnumDisplaySettingsW PostQuitMessage GetMessageW WindowFromPoint SetWindowTextW SetWindowLongW EnableWindow SetFocus SetCursor TrackMouseEvent GetPropW SetPropW MoveWindow SetParent UpdateWindow SetCursorPos ClientToScreen MapWindowPoints GetClassNameW EnumWindows MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetMonitorInfoW MonitorFromWindow GetWindowRect GetCursorPos GetWindow GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowRgn EqualRect IsZoomed ShowWindow GetParent CallNextHookEx IsWindowVisible RealGetWindowClassA IsRectEmpty IsIconic SetLayeredWindowAttributes EndPaint BeginPaint UnhookWinEvent UnhookWindowsHookEx DispatchMessageW TranslateMessage PeekMessageW SetWindowsHookExW SetWinEventHook GetForegroundWindow SystemParametersInfoW GetSystemMetrics GetClientRect CallWindowProcW GetWindowTextLengthW SendMessageW RegisterClassW GetClassInfoW GetIconInfo DestroyIcon ReleaseCapture SetCapture ScreenToClient DrawFocusRect InflateRect InvalidateRect PtInRect SetRectEmpty OffsetRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CharUpperW ReleaseDC GetDC MessageBoxExW GetDesktopWindow RedrawWindow SetWindowPos DrawIconEx SetRect PostMessageW KillTimer SetTimer MessageBoxW DrawTextW CopyRect FillRect AllowSetForegroundWindow FindWindowExW CharUpperBuffW CharLowerW CharLowerBuffW ExitWindowsEx RegisterWindowMessageW GetThreadDesktop IsDialogMessageW SwitchDesktop OpenInputDesktop GetUserObjectInformationA CloseDesktop AttachThreadInput SetForegroundWindow BringWindowToTop IsWindowEnabled GetClipboardData DefWindowProcW IsClipboardFormatAvailable MsgWaitForMultipleObjectsEx

fltlib

FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceFindClose FilterGetDosName

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

488KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

1004B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

696KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2f9b137961f9bac06c11988950afb107_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

fltlib

mpr

netapi32

generic