2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 350KB
Sample261012-3nkbmacv9j
SHA256 a0de4d40fd4b608199752f5188b1e468a1d21dff999fb577c45a05987c8db8e4
MD5 3f2e4ceef8c030094ad00b595220bf7e
SHA1 b1023c0f4e627c5634b3d0964aed854ec7897a14
SHA512 78d1241ebdfeff942fbd66980b7bff253922ecc372c167dd29815d15493d680a3e82492f45d185ff81fcb7345dedc6bc473e4775b61508447dd13d29557ad9c0
SSDEEP 6144:X46b3uRZ7uQWrt/QWAQwVh3hXA0LnyAOE3T8s0gE6vuXk7B7HBV+UdvrEFp7hK35:X46SR8TtNwVJhxLyoT8sfvuXk7B7HBjz
TLSH
T13474AF00359287F5D172053138F8ABB645FDB93C0B694ADBA3901B1E9E3C2D36A35E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 350KB

2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 8e25e9045aecf86aaeb252023a680220
SHA256 a0de4d40fd4b608199752f5188b1e468a1d21dff999fb577c45a05987c8db8e4
MD5 3f2e4ceef8c030094ad00b595220bf7e
SHA1 b1023c0f4e627c5634b3d0964aed854ec7897a14
SHA512 78d1241ebdfeff942fbd66980b7bff253922ecc372c167dd29815d15493d680a3e82492f45d185ff81fcb7345dedc6bc473e4775b61508447dd13d29557ad9c0
SSDEEP 6144:X46b3uRZ7uQWrt/QWAQwVh3hXA0LnyAOE3T8s0gE6vuXk7B7HBV+UdvrEFp7hK35:X46SR8TtNwVJhxLyoT8sfvuXk7B7HBjz
TLSH
T13474AF00359287F5D172053138F8ABB645FDB93C0B694ADBA3901B1E9E3C2D36A35E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c8:fd:3f:a5:fd:e8:f4:4b:57:e6:79:d5:20:2c:60:11:45:68:67:97:45:bb:0d:35:0a:7f:b3:d0:eb:22:dc:f6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 19, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4b:e5:60:b8:13:38:47:bf:03:9f:0f:d8:37:2e:cc:49:51:c3:30:6d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 19, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

0f:90:ac:3c:2d:fd:8c:c6:1e:a1:46:8f:ad:e3:2b:77

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 5, 2024 - Sep 6, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

55047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

EpSecuritySupport.pdb

kernel32

GetTickCount SetEvent Sleep GetModuleFileNameW GetCommandLineW ReadDirectoryChangesW GetOverlappedResult CreateEventW WaitForMultipleObjects CreateDirectoryW lstrcpyW lstrcatW GetLastError CreateFileW LocalFree VerifyVersionInfoW FreeLibrary VerSetConditionMask GetProcAddress LoadLibraryW CloseHandle OpenProcess GetSystemDirectoryW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI SetLastError MultiByteToWideChar WideCharToMultiByte FormatMessageW SwitchToThread GetCurrentThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind RaiseException LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW SetFilePointerEx FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapReAlloc WriteConsoleW HeapSize SetEndOfFile GetThreadTimes

winspool.drv

GetPrinterDriverDirectoryW

advapi32

RegisterServiceCtrlHandlerExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW SetServiceStatus DeleteService ControlService StartServiceW StartServiceCtrlDispatcherW OpenServiceW QueryServiceStatusEx SetSecurityDescriptorDacl GetSecurityDescriptorDacl SetFileSecurityW GetAclInformation GetAce EqualSid SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW DeleteAce GetFileSecurityW

shell32

SHGetFolderPathW CommandLineToArgvW

setupapi

SetupIterateCabinetW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_3f2e4ceef8c030094ad00b595220bf7e_amadey_darkgate_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

kernel32

winspool.drv

advapi32

shell32

setupapi

generic