2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 5.4MB
Sample261002-qml3lsba63
SHA256 9b7a89722fd4690b4d042e650714ececde4599203d113103eaa1e3e92b47eec9
MD5 62d99249095e40388f71b7af2c6cc834
SHA1 342ccd7ec7f03cb8b7515918448562dd85c0e881
SHA512 902c173bd27a6e907e4926d4791b0c025e0bbe2e932eba0f449e0067003e1a4ce4d53d0c7f9f401d6269454544e5db0ce9b44f1fa2afe67c6b976436874d969f
SSDEEP 49152:M7zLNHEgkjKYHrJg1NNNRNNNTONv/TO98VChBtzysUVap/Uv/TO98VChBtzysUV3:yPREgWsbtzysiCbtzysiGj
TLSH
T14F46BE00AFA16836FD3245760DAA23664438FE31F74205DF9293F61E5761DF229372AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 5.4MB

2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 12d1a97939cd26567bc5fff948a29604
SHA256 9b7a89722fd4690b4d042e650714ececde4599203d113103eaa1e3e92b47eec9
MD5 62d99249095e40388f71b7af2c6cc834
SHA1 342ccd7ec7f03cb8b7515918448562dd85c0e881
SHA512 902c173bd27a6e907e4926d4791b0c025e0bbe2e932eba0f449e0067003e1a4ce4d53d0c7f9f401d6269454544e5db0ce9b44f1fa2afe67c6b976436874d969f
SSDEEP 49152:M7zLNHEgkjKYHrJg1NNNRNNNTONv/TO98VChBtzysUVap/Uv/TO98VChBtzysUV3:yPREgWsbtzysiCbtzysiGj
TLSH
T14F46BE00AFA16836FD3245760DAA23664438FE31F74205DF9293F61E5761DF229372AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CreateDirectoryW CreateProcessW DeleteCriticalSection EnterCriticalSection FindResourceW GetCurrentProcess GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempPathW GetTickCount InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadResource LockResource MultiByteToWideChar ReleaseSRWLockExclusive ReleaseSRWLockShared SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TlsGetValue VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _ftelli64 _wfopen fclose fflush fputc fread fseek fwrite setbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __sys_nerr _assert _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

_isctype_l _iswlower_l _strdup mbrlen memset strcmp strlen strncmp tolower toupper wcslen

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtof wcrtomb wcrtomb_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

Name

.text

Size

298KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/66

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic