2026-10-16_94dc2e664cdfa8ea2006c73366724935_amadey_darkgate_elex_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_94dc2e664cdfa8ea2006c73366724935_amadey_darkgate_elex_remcos_rhadamanthys_stop
Size 404KB
Sample261017-nvmm1aef86
SHA256 194a441e0087a47152765ee172f03f9a970e398e2c0471c87e05931b236c1d55
MD5 94dc2e664cdfa8ea2006c73366724935
SHA1 d13f361f06b1e897259eab1f52856a03093352f2
SHA512 f2703b0b7bbf56af26853a5adaf8b7ef188af5d343075e93e33775ed10611b4f9db1f17d35d1997c6d36640f191972f3e8515302f52cc99e05240a1c1644909d
SSDEEP 6144:yLY4Tzu7uxsLKUqsygK239CkLudenHL15jl8ZARrDsPVnk:yLlvFuL/qsdd9Ckamr15jaZAR06
TLSH
T182949D11F795D072DA5705704D6ADB7B593AB5B41B241AC3F3E40EBA4F303E1AA3A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-16_94dc2e664cdfa8ea2006c73366724935_amadey_darkgate_elex_remcos_rhadamanthys_stop

.exe 404KB

2026-10-16_94dc2e664cdfa8ea2006c73366724935_amadey_darkgate_elex_remcos_rhadamanthys_stop

IMPHASH 3f7622b5ee08a8f8373a0406a2203220
SHA256 194a441e0087a47152765ee172f03f9a970e398e2c0471c87e05931b236c1d55
MD5 94dc2e664cdfa8ea2006c73366724935
SHA1 d13f361f06b1e897259eab1f52856a03093352f2
SHA512 f2703b0b7bbf56af26853a5adaf8b7ef188af5d343075e93e33775ed10611b4f9db1f17d35d1997c6d36640f191972f3e8515302f52cc99e05240a1c1644909d
SSDEEP 6144:yLY4Tzu7uxsLKUqsygK239CkLudenHL15jl8ZARrDsPVnk:yLlvFuL/qsdd9Ckamr15jaZAR06
TLSH
T182949D11F795D072DA5705704D6ADB7B593AB5B41B241AC3F3E40EBA4F303E1AA3A30A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7e:3e:37:3a:de:79:05:bc:d0:83:39:40:79:06:33:73:8e:76:39:7b:ee:fc:26:e1:40:47:4e:ea:0c:5f:6c:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=110111-1957418,CN=DOCTORSOFT CO.\,LTD.,O=DOCTORSOFT CO.\,LTD.,STREET=43 Digital-ro 26-gil,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 27, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Digest

80:45:33:62:14:77:e5:d6:a6:75:22:3a:7e:17:7e:b2:6f:86:4e:b1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 27, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

19:3e:22:ae:de:43:37:15:e5:5b:1f:42

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 22, 2025 - Apr 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

155766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Netrix\Agent_themida\Release\nxtray.pdb

kernel32

SetFileAttributesW DeleteFileW CreateDirectoryW WriteFile ReadFile GetVersionExW GetProcAddress GetModuleHandleW GetCurrentProcess OpenProcess LoadLibraryW FreeLibrary TerminateProcess MultiByteToWideChar CreateEventW OpenEventW CreateFileW SetFilePointer GetEnvironmentVariableW GetCurrentThreadId GetModuleFileNameA GetPrivateProfileSectionA GetPrivateProfileIntA GetPrivateProfileStringA GetEnvironmentVariableA ProcessIdToSessionId GetCurrentProcessId GetUserDefaultLangID CreateToolhelp32Snapshot Process32FirstW LoadLibraryA CreateProcessW GetCurrentDirectoryA PeekNamedPipe GetFileInformationByHandle GetFullPathNameA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime DeleteFileA MoveFileA FindNextFileA FindFirstFileA SetEnvironmentVariableA CompareStringW CompareStringA GetProcessHeap SetEndOfFile GetTimeZoneInformation CreateFileA GetLocaleInfoW FlushFileBuffers SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA FindClose FindFirstFileW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetPrivateProfileIntW WideCharToMultiByte GetLastError DeleteCriticalSection WaitForMultipleObjects Sleep SetEvent CloseHandle InitializeCriticalSection Process32NextW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW InterlockedIncrement InterlockedDecrement InterlockedExchange UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree ExitThread CreateThread GetStartupInfoW RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess GetStdHandle HeapSize GetModuleHandleA

user32

DispatchMessageW TranslateMessage PostMessageW RegisterWindowMessageW GetMessageW wsprintfA MessageBoxW TrackPopupMenu SetForegroundWindow GetCursorPos InsertMenuW ModifyMenuW SetMenuDefaultItem DestroyMenu GetSubMenu LoadMenuW KillTimer PostQuitMessage EndPaint BeginPaint DefWindowProcW UpdateWindow ShowWindow SetTimer CreateWindowExW RegisterClassExW LoadCursorW LoadIconW

advapi32

RegQueryValueExW RegQueryInfoKeyW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW Shell_NotifyIconW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_94dc2e664cdfa8ea2006c73366724935_amadey_darkgate_elex_remcos_rhadamanthys_stop

kernel32

user32

advapi32

shell32

version

generic