2026-09-29_15debf15a92fa811dadda7de758b11c8_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_15debf15a92fa811dadda7de758b11c8_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.8MB
Sample260930-fswh5afc96
SHA256 1ac571edecb3110e410bf3929ee608ec067adc2cdfb7846123aa51b76ff17cbd
MD5 15debf15a92fa811dadda7de758b11c8
SHA1 d1a6e0eb624a0a673a2cc874535335a254c7a64f
SHA512 86423355a1612605d9357c7045d26219a169780770a9d8feb0dc1573711a58d637793ebe53c46106dbf3520da19fb9878ab491e6d3e3be2ff8e589ae87a17a65
SSDEEP 49152:QCmMLgfcMlRunXh2BErhW8arSj8RoTCCrfJ4klKXnt:jm1R0ABEhJTnfJ4k
TLSH
T1CFD5E030BA06C132D9A201B09BBCABAF946DBB241B7545CB63C40F2D9D705D35A3677B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_15debf15a92fa811dadda7de758b11c8_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-09-29_15debf15a92fa811dadda7de758b11c8_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.8MB

2026-09-29_15debf15a92fa811dadda7de758b11c8_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 1c0b33497cd05c00b9bb9e1b15085a8f
SHA256 1ac571edecb3110e410bf3929ee608ec067adc2cdfb7846123aa51b76ff17cbd
MD5 15debf15a92fa811dadda7de758b11c8
SHA1 d1a6e0eb624a0a673a2cc874535335a254c7a64f
SHA512 86423355a1612605d9357c7045d26219a169780770a9d8feb0dc1573711a58d637793ebe53c46106dbf3520da19fb9878ab491e6d3e3be2ff8e589ae87a17a65
SSDEEP 49152:QCmMLgfcMlRunXh2BErhW8arSj8RoTCCrfJ4klKXnt:jm1R0ABEhJTnfJ4k
TLSH
T1CFD5E030BA06C132D9A201B09BBCABAF946DBB241B7545CB63C40F2D9D705D35A3677B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

740350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\905349\out\Release\SodaDownloader.pdb

crypt32

CryptStringToBinaryA

kernel32

lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetTempPathW InterlockedIncrement InterlockedDecrement GetCommandLineW CreateDirectoryW MoveFileW FindResourceW OutputDebugStringW SetFilePointer SetEndOfFile GlobalAlloc SetFilePointerEx ReadFile GetFileSizeEx FindNextFileW WriteFile ExpandEnvironmentStringsW FindClose Process32NextW Process32FirstW CreateToolhelp32Snapshot PostQueuedCompletionStatus CreateIoCompletionPort TerminateThread InterlockedExchange lstrlenA GetFileSize InterlockedCompareExchange WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers IsValidLocale GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind GetPrivateProfileStringW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask ChangeTimerQueueTimer GetThreadPriority lstrlenW SignalObjectAndWait GetPrivateProfileIntW SizeofResource LoadResource GetProcessHeap HeapDestroy LockResource DeviceIoControl DeleteCriticalSection InitializeCriticalSection EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject MulDiv SetThreadAffinityMask LocalFree GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer UnregisterWaitEx UnmapViewOfFile CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP GetCurrentDirectoryW SetFileTime VerifyVersionInfoW VerSetConditionMask HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceFrequency GetCPInfo FormatMessageW TryEnterCriticalSection IsDebuggerPresent MoveFileExW DeleteFileW SetFileAttributesW MapViewOfFileEx SetThreadPriority MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadTimes GetExitCodeThread GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetErrorMode SetLastError GetLastError RaiseException GetLongPathNameW GetFileAttributesW FindFirstFileW CreateFileW FindResourceExW

user32

GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow UpdateLayeredWindow SetTimer GetSystemMetrics GetDC ReleaseDC MapWindowPoints GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId LoadImageW MonitorFromWindow KillTimer GetDesktopWindow GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData EqualRect UnionRect IntersectRect SetCursor LoadCursorW PtInRect IsRectEmpty OffsetRect ScreenToClient GetCursorPos InvalidateRect SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseCapture DrawTextW SetCapture GetKeyState GetFocus IsZoomed MoveWindow CallWindowProcW MonitorFromPoint RegisterClassExW IsWindow SetWindowTextW EnableWindow SetFocus GetMonitorInfoW GetWindow GetParent GetWindowRect GetClientRect ShowWindow PeekMessageW CharNextW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos wsprintfW SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic AttachThreadInput

gdi32

GetDeviceCaps SelectObject CreateFontIndirectW DeleteObject GetStockObject GetObjectW BitBlt CreateRoundRectRgn CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn CreateCompatibleDC DeleteDC SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx

advapi32

RegQueryInfoKeyW RegEnumKeyExW RegEnumKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW OpenProcessToken

shell32

SHGetSpecialFolderPathW CommandLineToArgvW ord165 ShellExecuteExW SHGetFolderPathW ShellExecuteW

ole32

CoCreateGuid CoTaskMemRealloc CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoUninitialize OleInitialize OleUninitialize

oleaut32

LoadRegTypeLi LoadTypeLi SysStringLen VarUI4FromStr VariantInit SysFreeString SysAllocString

shlwapi

StrCmpIW PathFindFileNameW PathCombineW PathAppendW PathFileExistsW SHGetValueW StrCmpNIW StrStrIW PathRemoveFileSpecW PathCanonicalizeW PathIsPrefixW PathRemoveBackslashW StrStrIA ord176 PathIsRelativeW SHGetValueA SHSetValueA StrTrimA

version

VerQueryValueW

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent InitCommonControlsEx

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmDisableIME ImmGetContext ImmReleaseContext

wininet

InternetConnectW InternetOpenW InternetCrackUrlW InternetCloseHandle InternetSetOptionW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW

gdiplus

GdipSetStringFormatLineAlign GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipCreateFontFromDC GdipDrawImageRectRectI GdipFillPath GdipFillEllipse GdipDrawPath GdipDrawEllipse GdipDrawRectangleI GdipDrawLineI GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=28, id=259, version=26706,

count=38, id=261, version=27051,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=38, id=260, version=26706,

count=131, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=768, id=1, productName=Unmarked objects,

count=1, id=261, version=34123,

count=1, id=260, version=27048,

count=34, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,