2026-10-14_c11c20f47a1810e0385a631d05501573_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_c11c20f47a1810e0385a631d05501573_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 3.6MB
Sample261014-p21nwadt21
SHA256 557639d81d199f724d29fcabb3cfb6e25f9d65dcba10a3fe16b6596697e0d4c6
MD5 c11c20f47a1810e0385a631d05501573
SHA1 4daf66da888abd7fc9eda6cb2925aa8cdb34b8a6
SHA512 28281567fe8a0c6e83cffa1c2fe9aa4ad8c28c1a9e96e0a00a2d8d32865f55963644479f27ccb35eb205df25a18afa62d1a957d30b3538974a976c1b073b06ea
SSDEEP 98304:HjFGqQ/3Y7MTbCGF/AsedZD0pB2uF5jlu95:DFTvMT1/Pv5jQX
TLSH
T1C206CE113AC2807BD9A30131497DE7FA193D6E351F3081E7A3D43A2D6E749E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c11c20f47a1810e0385a631d05501573_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-14_c11c20f47a1810e0385a631d05501573_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 3.6MB

2026-10-14_c11c20f47a1810e0385a631d05501573_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH a81994a8e54b90ebc57ddfe905d7f15e
SHA256 557639d81d199f724d29fcabb3cfb6e25f9d65dcba10a3fe16b6596697e0d4c6
MD5 c11c20f47a1810e0385a631d05501573
SHA1 4daf66da888abd7fc9eda6cb2925aa8cdb34b8a6
SHA512 28281567fe8a0c6e83cffa1c2fe9aa4ad8c28c1a9e96e0a00a2d8d32865f55963644479f27ccb35eb205df25a18afa62d1a957d30b3538974a976c1b073b06ea
SSDEEP 98304:HjFGqQ/3Y7MTbCGF/AsedZD0pB2uF5jlu95:DFTvMT1/Pv5jQX
TLSH
T1C206CE113AC2807BD9A30131497DE7FA193D6E351F3081E7A3D43A2D6E749E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\873524\out\Release\360AblumViewer.pdb

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipFillRectangleI GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipReleaseDC GdipAlloc

kernel32

VirtualFree FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetThreadAffinityMask GetDateFormatW GetTimeFormatW CompareStringW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetNumberFormatW GetCurrencyFormatW EnumCalendarInfoExW EnumDateFormatsExW GetSystemDefaultLCID GetUserDefaultLCID GetModuleHandleW LockResource HeapDestroy HeapSize GetProcessHeap GetCurrentProcessId DeleteCriticalSection LoadResource SizeofResource FindResourceW FindResourceExW GetPrivateProfileIntW GlobalAlloc GlobalLock GlobalUnlock FileTimeToSystemTime InitializeCriticalSection WaitForMultipleObjects GetFileTime FindFirstChangeNotificationW FindNextChangeNotification FindCloseChangeNotification FreeResource FindClose SetFileTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation SystemTimeToFileTime lstrlenW FindFirstFileW FindNextFileW GetVersion GetShortPathNameW GetLongPathNameW GetFileSizeEx GetTempPathW RemoveDirectoryW GetFileAttributesExW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW InterlockedExchange InterlockedCompareExchange LocalFree GetCurrentProcess GetCurrentThreadId GetSystemTime GetWindowsDirectoryW VirtualAlloc GlobalFree GetFileSize ReadFile GetFileAttributesA DeleteFileA MulDiv WriteFile MoveFileW OutputDebugStringW InterlockedDecrement lstrcmpiW GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA SetEndOfFile SetFilePointer GetLocalTime GetThreadLocale FormatMessageW CreateDirectoryW CopyFileW GetCommandLineW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TlsAlloc SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent VirtualQuery GetNativeSystemInfo GetSystemDirectoryW TlsSetValue TlsFree LCMapStringW GetTickCount GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW LocalFileTimeToFileTime CreateFileA SetFilePointerEx HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex RtlUnwind InterlockedFlushSList ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetCommandLineA GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl TlsGetValue HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetFileAttributesW CreateFileW GetStdHandle GetCurrentThread GetConsoleCP GetConsoleMode VirtualProtect GetFileType IsValidLocale EnumSystemLocalesW ReadConsoleW FlushFileBuffers IsValidCodePage GetOEMCP SetStdHandle WriteConsoleW SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA ReleaseSemaphore SignalObjectAndWait CreateSemaphoreA GetModuleFileNameA TryEnterCriticalSection HeapQueryInformation SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetModuleHandleA SetProcessAffinityMask DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue WaitForMultipleObjectsEx InterlockedIncrement RtlCaptureStackBackTrace

user32

MapWindowPoints GetWindowRect SetWindowTextW TrackPopupMenu GetParent SetWindowPos LoadCursorW SetWindowLongW GetWindowLongW PtInRect CopyRect FillRect GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW InflateRect GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu SetMenuItemInfoW OffsetRect CharLowerBuffW EqualRect SendMessageTimeoutW UnregisterClassW DestroyWindow CharNextW ShowCursor EnumWindows SetFocus EnableWindow EnumDisplayMonitors SetCapture ScreenToClient GetCursorPos SetCursor GetClientRect GetWindowTextW InvalidateRect ReleaseDC GetDC DrawTextW GetSystemMetrics GetDlgItem CallWindowProcW ReleaseCapture BeginPaint EndPaint IsWindowVisible CreateWindowExW ShowWindow SetPropW GetPropW RemovePropW GetSysColor MonitorFromPoint SetTimer KillTimer SetCursorPos ClientToScreen UpdateWindow LoadMenuW DestroyMenu CheckMenuItem MoveWindow PeekMessageW AttachThreadInput GetWindowPlacement SetWindowPlacement IsZoomed IsClipboardFormatAvailable IsWindowEnabled DefWindowProcW TrackMouseEvent GetForegroundWindow SetForegroundWindow EndDialog EnableMenuItem SetClassLongW GetKeyState PostMessageW SystemParametersInfoW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindow SendMessageW MessageBoxW GetActiveWindow IsRectEmpty IntersectRect GetWindowThreadProcessId DialogBoxParamW

gdi32

SelectClipRgn ExtCreatePen SetROP2 ExtSelectClipRgn ExcludeClipRect CreateRectRgn BitBlt TextOutW GetTextExtentPoint32W CreateCompatibleDC CreateCompatibleBitmap MoveToEx LineTo GetObjectW EndPage StartPage EndDoc StartDocW StretchDIBits ExtTextOutW SetMapMode CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor GetTextMetricsW CreateFontW CreateFontIndirectW GetDeviceCaps GetStockObject Rectangle SetDIBitsToDevice GetTextFaceW DPtoLP CreateDCW CreatePen SetBkColor IntersectClipRect

winspool.drv

DeviceCapabilitiesW

comdlg32

PrintDlgExW GetOpenFileNameW GetSaveFileNameW

advapi32

FreeSid RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity RegGetKeySecurity GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl RegDeleteKeyA AllocateAndInitializeSid RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW ImpersonateSelf

shell32

ShellExecuteW ord102 SHCreateDirectoryExW SHGetDesktopFolder ord232 SHFileOperationW SHGetFolderPathW ord17 ord16 ord155 ord18 DragQueryFileW ord165 SHChangeNotify SHGetSpecialFolderPathW DragFinish SHGetFolderLocation DragAcceptFiles

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit VariantClear VarUI4FromStr SysAllocString SysFreeString

shlwapi

SHQueryValueExA SHDeleteKeyW SHDeleteKeyA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW StrCmpLogicalW PathAddBackslashW PathFindExtensionW StrToIntExW SHGetValueA PathIsDirectoryW PathFindFileNameW

ws2_32

WSASetLastError select htonl ntohs __WSAFDIsSet

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW

psapi

EnumProcessModules EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA GetDeviceDriverBaseNameW GetDeviceDriverBaseNameA EnumDeviceDrivers GetMappedFileNameA GetMappedFileNameW InitializeProcessForWsWatch QueryWorkingSet EmptyWorkingSet GetModuleBaseNameW GetModuleBaseNameA GetProcessImageFileNameW GetProcessImageFileNameA GetWsChanges GetModuleFileNameExW GetModuleFileNameExA

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassRegistryPropertyW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=35, id=241, version=40116,

count=188, id=243, version=40116,

count=34, id=242, version=40116,

count=6, id=199, version=41118,

count=29, id=259, version=26706,

count=38, id=260, version=26706,

count=11, id=260, version=27045,

count=47, id=261, version=27045,

count=33, productName=Unmarked objects (old),

count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=136, id=261, version=26706,

count=531, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=102, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,