2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

General

Target
2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader
Size 1.7MB
Sample261003-teycfseb28
SHA256 8334e54fb399be7bc50b3d9cf356fe6066760cce42ac28dc9c77b0fb19536b93
MD5 22bdd00f3261174ff47d4c50d2542a6a
SHA1 6f1ef20455f30ae4d2ed78cebc5d4cdf42aacb80
SHA512 0ad6bd1d7ed717f094b5106622ceea8ccd99cbc2cb02b9bed64f3aa0be0060aec9a4c503179b10d36d6e4fefd2ce5d51f5362d3bd0cc1a30154ebf0083aa0ba5
SSDEEP 24576:H9W7J7u5jO6GJjCWTsWoNH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dMuk6k7IWoNHLNiXicJFFRGNzj3
TLSH
T1BC85E126B272C433C1B320318E28A72061BDBDB11D368A9773D86B6D5E745E1FA35673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

.exe 1.7MB

2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

IMPHASH 3c325a3a73b0ebb3344fdf24949bc09c
SHA256 8334e54fb399be7bc50b3d9cf356fe6066760cce42ac28dc9c77b0fb19536b93
MD5 22bdd00f3261174ff47d4c50d2542a6a
SHA1 6f1ef20455f30ae4d2ed78cebc5d4cdf42aacb80
SHA512 0ad6bd1d7ed717f094b5106622ceea8ccd99cbc2cb02b9bed64f3aa0be0060aec9a4c503179b10d36d6e4fefd2ce5d51f5362d3bd0cc1a30154ebf0083aa0ba5
SSDEEP 24576:H9W7J7u5jO6GJjCWTsWoNH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dMuk6k7IWoNHLNiXicJFFRGNzj3
TLSH
T1BC85E126B272C433C1B320318E28A72061BDBDB11D368A9773D86B6D5E745E1FA35673
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

175524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jskinner\sublime_text\build\x32\dist\plugin_host.pdb

python33

PyEval_RestoreThread Py_IgnoreEnvironmentFlag PyObject_Size PyUnicode_FromString PyErr_Print PyList_SetItem _Py_TrueStruct PyCallable_Check PyExc_TypeError PyGILState_Ensure PyImport_Import PyEval_InitThreads PyObject_CallObject PyTuple_SetItem PyByteArray_FromStringAndSize PyUnicode_DecodeUTF32 PySequence_Check PyList_GetItem PyDict_New PyDict_SetItem PyBytes_Size PyMapping_Check PyObject_GetAttrString PyImport_AddModule PyRun_SimpleStringFlags PyModule_Create2 PyList_New PyImport_AppendInittab Py_DontWriteBytecodeFlag PyModule_GetDict PyTuple_GetItem Py_InitializeEx PyType_IsSubtype PyFloat_Type PyBool_Type Py_NoUserSiteDirectory PyErr_SetString PyFloat_FromDouble PyLong_FromLongLong PyDict_SetItemString PyTuple_New PyLong_AsLongLong _Py_NoneStruct PyGILState_Release PyRun_StringFlags Py_NoSiteFlag PyFloat_AsDouble PyLong_FromUnsignedLongLong PyLong_FromLong PyEval_SaveThread PyUnicode_AsUTF8AndSize PyUnicode_DecodeUTF8 PyErr_Occurred PySequence_GetItem PyBytes_AsString PyMapping_Items Py_SetPath PyBool_FromLong

kernel32

OpenEventA WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleCP GetConsoleMode SetFilePointerEx GetACP GetCommandLineW GetCommandLineA GetModuleFileNameA GetStdHandle HeapReAlloc GetModuleHandleExW ExitThread HeapSize GetFileType SetStdHandle RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority GetTempPathW CloseHandle CreateProcessW SetEvent CreateEventA GetModuleFileNameW WaitForSingleObject OpenEventW CreateEventW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WaitForSingleObjectEx OpenFileMappingW UnmapViewOfFile MapViewOfFile GetCurrentProcess TerminateProcess GetVersionExW OpenProcess ExitProcess GetCurrentProcessId OutputDebugStringW GetCurrentThreadId Sleep RaiseException CreateThread IsDebuggerPresent ReleaseSemaphore CreateSemaphoreW CreateDirectoryW FindClose CreateFileW GetFileAttributesW SetCurrentDirectoryW FlushFileBuffers DuplicateHandle GetModuleHandleA GetProcAddress CreateSemaphoreA GetTickCount GetSystemTimeAsFileTime SystemTimeToFileTime LocalFree FormatMessageA SetWaitableTimer VirtualQuery HeapFree WaitForMultipleObjectsEx ResetEvent HeapAlloc GetProcessHeap TlsSetValue CreateWaitableTimerW GetLastError GetLogicalProcessorInformation TlsAlloc TlsGetValue TlsFree RtlCaptureContext GetProcessId LoadLibraryW FreeLibrary VirtualQueryEx SetUnhandledExceptionFilter SetNamedPipeHandleState WriteFile WaitForMultipleObjects TransactNamedPipe WaitNamedPipeW SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue WideCharToMultiByte TryEnterCriticalSection GetCurrentThread EncodePointer DecodePointer MultiByteToWideChar QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount GetModuleHandleW CompareStringW LCMapStringW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent

user32

wsprintfW

shell32

SHGetFolderPathW

Name

.text

Size

361KB

Virtual Size

361KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_22bdd00f3261174ff47d4c50d2542a6a_amadey_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

python33

kernel32

user32

shell32

generic