2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos
Size 6.7MB
Sample261012-vcvdfst16m
SHA256 63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd
MD5 8916c1401868bfcf2c383f12e1b3e5ab
SHA1 f0eeca298a61a0c763bd42779442bdc481291641
SHA512 1c4652c8d20012a2c154ce6e48343dbf63d0efa52c179c45dd5ab95f3f5a99edd4eac334111f8255f0e267a21251e6bff9379a57f75c8f89b9bfa6c087b3b912
SSDEEP 98304:EB4BjfY7QDgILVjVoqcBjQ3JyxkCJqe8+tGfTlzNgaPJ:EBMBxrokCfazOax
TLSH
T11D667D207786C4BEE49202F05F2DEFBF445DAE250B6440D7A3D4BA5D2971AC31A32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos

.exe 6.7MB

2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos

IMPHASH f80db34e78ed110cf5790dfdb75b4f4b
SHA256 63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd
MD5 8916c1401868bfcf2c383f12e1b3e5ab
SHA1 f0eeca298a61a0c763bd42779442bdc481291641
SHA512 1c4652c8d20012a2c154ce6e48343dbf63d0efa52c179c45dd5ab95f3f5a99edd4eac334111f8255f0e267a21251e6bff9379a57f75c8f89b9bfa6c087b3b912
SSDEEP 98304:EB4BjfY7QDgILVjVoqcBjQ3JyxkCJqe8+tGfTlzNgaPJ:EBMBxrokCfazOax
TLSH
T11D667D207786C4BEE49202F05F2DEFBF445DAE250B6440D7A3D4BA5D2971AC31A32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2633680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\eb9866819bf58bed\bin_x86\v141_xp\Release Static\neutral\recuva.pdb

wininet

HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetCrackUrlW HttpQueryInfoW InternetCloseHandle InternetQueryDataAvailable InternetReadFile InternetOpenUrlW InternetOpenW HttpSendRequestW

kernel32

ExpandEnvironmentStringsA VerifyVersionInfoA HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource InitializeCriticalSectionAndSpinCount GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle CreateEventA SetLastError GetCurrentThreadId RaiseException FreeLibrary MulDiv QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcessId GetLogicalDrives FindClose GlobalAlloc GlobalLock GlobalUnlock GlobalReAlloc GlobalFree SetErrorMode InterlockedDecrement InterlockedIncrement Sleep GetLocalTime GetCurrentProcess GetCommandLineW SetEvent GetSystemTimeAsFileTime InterlockedExchange GetTickCount WaitForSingleObjectEx ReleaseSemaphore DuplicateHandle CreateSemaphoreA WriteFile WaitForMultipleObjects ResetEvent CompareFileTime SystemTimeToFileTime FileTimeToSystemTime InitializeCriticalSection VirtualProtect GetCurrentThread LoadLibraryA GetModuleHandleA TlsSetValue TlsAlloc TlsGetValue TlsFree GetSystemDirectoryA GetCommandLineA FindFirstFileExW SetEnvironmentVariableA GetOEMCP SetStdHandle IsValidLocale GetConsoleMode GetConsoleCP GetStdHandle VirtualQuery GetACP SystemTimeToTzSpecificLocalTime PeekNamedPipe ExitProcess GetTimeZoneInformation GetFileType GetModuleHandleExW RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait CreateFileA SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue GetStringTypeExA GetUserDefaultLCID LCMapStringA TerminateProcess UnhandledExceptionFilter AreFileApisANSI FormatMessageA CreateWaitableTimerA SetWaitableTimer TryEnterCriticalSection GetExitCodeThread SwitchToThread LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent FileTimeToDosDateTime LocalFileTimeToFileTime DosDateTimeToFileTime WaitForMultipleObjectsEx VirtualFree VirtualAlloc InterlockedCompareExchange InterlockedExchangeAdd OpenEventA QueueUserAPC ExitThread SleepEx GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeW FindFirstVolumeW MoveFileExW GetFileTime GetFileSizeEx FileTimeToLocalFileTime BackupSeek BackupRead GetCompressedFileSizeW SetEndOfFile SetFilePointerEx FlushFileBuffers ReadFile GlobalHandle lstrcmpA SetFileTime SetFilePointer GetFileSize LocalFree VerifyVersionInfoW VerSetConditionMask GlobalMemoryStatus GetSystemInfo GetVersionExA MapViewOfFile GetWindowsDirectoryA GetVolumeNameForVolumeMountPointW GetVersion UnmapViewOfFile GetVolumePathNameW DeviceIoControl GetLocaleInfoA GetSystemDefaultLCID IsWow64Process CreateDirectoryA GetFileAttributesA GetSystemTime SetUnhandledExceptionFilter VirtualQueryEx CreateThread TerminateThread ResumeThread WaitForSingleObject RtlCaptureContext RegisterWaitForSingleObject

user32

CharLowerA BringWindowToTop GetDesktopWindow InvalidateRgn DestroyAcceleratorTable SetLayeredWindowAttributes SetWindowContextHelpId CopyImage GetComboBoxInfo AdjustWindowRectEx GetMenu RemoveMenu SetCaretPos SetClipboardData EmptyClipboard OpenClipboard GetScrollInfo SetScrollRange DragDetect GetKeyState SetScrollPos DestroyCaret CreateCaret HideCaret ShowCaret CreatePopupMenu CheckMenuItem SetMenuItemBitmaps CheckMenuRadioItem GetMenuInfo SetMenuInfo DeleteMenu GetMenuItemCount GetMenuItemID GetUpdateRect CheckDlgButton IsIconic FlashWindowEx GetIconInfo CreateIconFromResourceEx LookupIconIdFromDirectoryEx MonitorFromPoint IsMenu TrackPopupMenu GetSubMenu DrawFrameControl InflateRect SetWindowPlacement PostQuitMessage LoadStringA SetCursorPos GetMessagePos DestroyCursor CallNextHookEx SetParent SetTimer KillTimer MsgWaitForMultipleObjects CopyIcon GetSysColorBrush IsDlgButtonChecked MapDialogRect DrawIconEx WindowFromPoint ClientToScreen SetRect FrameRect TranslateMessage MonitorFromWindow MapWindowPoints GetActiveWindow UnhookWindowsHookEx GetWindowThreadProcessId GetWindowPlacement GetWindowDC GetWindow DestroyMenu MessageBeep EnableMenuItem DestroyIcon EndDialog CopyRect RedrawWindow GetSystemMenu DestroyWindow BeginPaint EndPaint FillRect IsWindowEnabled GetSysColor GetFocus DrawFocusRect SetCursor TrackMouseEvent SetFocus SetCapture GetCapture ReleaseCapture GetCursorPos ScreenToClient PtInRect UpdateWindow InvalidateRect SetRectEmpty SetWindowPos ShowWindow OffsetRect IsWindow ReleaseDC GetDC EnumWindows IsWindowVisible GetSystemMetrics MoveWindow GetWindowRect GetClientRect GetDlgCtrlID EnumChildWindows GetParent GetDlgItem DrawEdge IsChild CharLowerBuffA ExitWindowsEx CloseClipboard

oleaut32

VarBstrFromR8 VariantChangeType VariantClear VariantInit SysAllocString SysStringLen LoadRegTypeLi VarUI4FromStr SysFreeString SysAllocStringByteLen LoadTypeLi SysAllocStringLen OleCreateFontIndirect VarBstrCmp DispCallFunc

gdiplus

GdiplusStartup GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdiplusShutdown GdipBitmapUnlockBits

iphlpapi

GetAdaptersAddresses

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

930KB

Virtual Size

930KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

181KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

321KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

852KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos

wininet

kernel32

user32

oleaut32

gdiplus

iphlpapi

generic