2026-10-01_41377d6f437215f15b152b5d749352f6_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_41377d6f437215f15b152b5d749352f6_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 9.1MB
Sample261002-tfprpswdkf
SHA256 75992a8c3300aab77fcbcfde25cec19d421407ff1c13b29bc701bdcf3c6a2181
MD5 41377d6f437215f15b152b5d749352f6
SHA1 5fdbd8e61c3816fa107cf53fa6c999c0c149d2e4
SHA512 b7236467925adb9d5732ac2ebf02d3c71acaca306191dae8c1288fb0dd6dd1b8b3dba09e4dbda43cc2c287898fc2735b7f4d07e07ecee290515ddf3c8cdb71a2
SSDEEP 196608:6gMp0jWZNlSIKTiFTdQGq15KpKYecqQXfM+zZW6:zJjWZNlSI0iBd415KcYxqQXfr
TLSH
T1C5A6122077428076D5E151B0892B9B6950E97F342B6284FFE3D87A6E1D708C23F3BE56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_41377d6f437215f15b152b5d749352f6_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 9.1MB

2026-10-01_41377d6f437215f15b152b5d749352f6_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH a5d509e6c6dc7241c19d0f169b7bf88f
SHA256 75992a8c3300aab77fcbcfde25cec19d421407ff1c13b29bc701bdcf3c6a2181
MD5 41377d6f437215f15b152b5d749352f6
SHA1 5fdbd8e61c3816fa107cf53fa6c999c0c149d2e4
SHA512 b7236467925adb9d5732ac2ebf02d3c71acaca306191dae8c1288fb0dd6dd1b8b3dba09e4dbda43cc2c287898fc2735b7f4d07e07ecee290515ddf3c8cdb71a2
SSDEEP 196608:6gMp0jWZNlSIKTiFTdQGq15KpKYecqQXfM+zZW6:zJjWZNlSI0iBd415KcYxqQXfr
TLSH
T1C5A6122077428076D5E151B0892B9B6950E97F342B6284FFE3D87A6E1D708C23F3BE56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

31:b8:a2:14:38:95:59:69:9a:23:45:30:b3:2d:e6:2e:3f:8b:ff:a8:9e:1e:8f:9d:3a:f5:76:38:c4:9c:10:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

Chains

Sep 2, 2026

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

Serial Number

0b:44:52:82:d0:6a:1d:7f:c0:6c:f7:d6:2d:a3:a0:11

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 12, 2026 - Apr 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

563733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryExW lstrcmpiW SetEvent CreateEventW GetDriveTypeW InitializeCriticalSectionEx GetTickCount64 GetModuleHandleW FreeLibrary GetCurrentProcess Sleep DecodePointer VerifyVersionInfoW GetCurrentThreadId InitializeCriticalSectionAndSpinCount RaiseException VerSetConditionMask MultiByteToWideChar DeleteCriticalSection CreateDirectoryW WideCharToMultiByte LoadLibraryW GetProcAddress GetStartupInfoW WaitForSingleObject ReadFile CreateFileW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetACP ExitProcess GetModuleFileNameW GetFileType GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError MoveFileExW MoveFileW FindResourceW lstrlenW SizeofResource LockResource LoadResource FindResourceExW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW VirtualProtect GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue lstrcmpA DeviceIoControl ReleaseMutex SetUnhandledExceptionFilter UnhandledExceptionFilter GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW FindFirstFileW FindClose DeleteFileW GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceCounter TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessId GetFileAttributesExW GetPrivateProfileStringW GetTickCount OutputDebugStringW CloseHandle WriteFile GetDiskFreeSpaceExW OpenProcess WriteConsoleW GetShortPathNameW SetFileTime GetTempFileNameW GetLogicalDriveStringsW SetFilePointer SetEndOfFile GetStdHandle VirtualFree VirtualAlloc GetSystemInfo ReleaseSemaphore ResetEvent CreateSemaphoreW WaitForMultipleObjects GetFileSizeEx GetLocalTime GetCurrentProcessId LocalFree FormatMessageW WritePrivateProfileStringW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLongPathNameW QueryDosDeviceW TerminateProcess GetExitCodeProcess

user32

DefWindowProcW MonitorFromWindow UnregisterClassW RegisterClassExW PostMessageW ReleaseDC CallWindowProcW SendMessageW GetDC FindWindowExW GetClassInfoExW IsDialogMessageW GetActiveWindow EndDialog DialogBoxParamW GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetForegroundWindow GetSystemMetrics IsIconic IsWindowVisible PostQuitMessage CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW ScreenToClient GetWindowRect GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint KillTimer CharUpperW CharLowerW RegisterWindowMessageW SendMessageTimeoutW SendNotifyMessageW FindWindowW wsprintfW CopyRect OffsetRect UnionRect EqualRect PtInRect SetCursor DrawFocusRect SetTimer ReleaseCapture SetCapture GetAsyncKeyState SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow IsWindow CreateWindowExW

gdi32

CreateFontW EnumFontFamiliesW RectVisible OffsetViewportOrgEx SelectClipRgn SaveDC CreateDIBSection GetObjectW SetViewportOrgEx GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateRectRgnIndirect DeleteDC RestoreDC SelectObject DeleteObject

advapi32

GetTokenInformation RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegGetValueW FreeSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetUserNameW

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW SHChangeNotify ShellExecuteExW SHGetSpecialFolderPathW ord165

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoCreateGuid CoInitializeSecurity

oleaut32

VariantInit SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysAllocStringLen VarUI4FromStr SysFreeString SysStringLen

shlwapi

StrTrimA StrStrIA SHDeleteValueW SHSetValueW PathIsRelativeW PathIsDirectoryW PathRemoveFileSpecW SHCreateStreamOnFileEx SHGetValueW StrCmpIW StrToInt64ExW PathFindFileNameW PathFindExtensionW PathFileExistsW PathCombineW PathAppendW StrStrIW StrCmpNIW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateBitmapFromStream GdipDisposeImage GdiplusShutdown GdiplusStartup GdipCloneImage GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipAlloc GdipFree GdipDeleteFontFamily GdipCreateFont GdipDeleteBrush GdipCreateSolidFill GdipGetImageWidth GdipGetImageHeight GdipCreateFontFamilyFromName GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipDrawString

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winhttp

WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryHeaders WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetTimeouts

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_41377d6f437215f15b152b5d749352f6_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

urlmon

psapi

version

winhttp

secur32

wininet

iphlpapi

generic