2026-10-22_be37ee134ea3d3fed56db2ac849295b0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_be37ee134ea3d3fed56db2ac849295b0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 2.2MB
Sample261023-19acfaes6v
SHA256 d341a13574f1156df18e3b6b51a9f6c2bfd9b3a7ec62b95c7392573f992af9d6
MD5 be37ee134ea3d3fed56db2ac849295b0
SHA1 7185d45fe32d03bd9f7cacee595ebebc75ebeae7
SHA512 354871b849efd7afa706c2df045df1d5960d2f5ab87fc9308303ad02787bf3d46ee845cb549e7f504bd98c2884c9935d45e657d6d148560a1309d799ce7f88f2
SSDEEP 24576:d+OVvDNRVEroC5ojtuWXUAymWR6tAiPd2nI8zFIgH1xYt41tBp39+mz6nfkwS6gj:lNR65GD2m/vPDg1xYt4fB+mz65S6giU3
TLSH
T14FA5CF2179428032D5A10170EDFCEB6F956CBE642F3409DB63D43F6D9A309D26D36A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_be37ee134ea3d3fed56db2ac849295b0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-10-22_be37ee134ea3d3fed56db2ac849295b0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 2.2MB

2026-10-22_be37ee134ea3d3fed56db2ac849295b0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH af53ed54cf01cb89ba7ba797c62ddd63
SHA256 d341a13574f1156df18e3b6b51a9f6c2bfd9b3a7ec62b95c7392573f992af9d6
MD5 be37ee134ea3d3fed56db2ac849295b0
SHA1 7185d45fe32d03bd9f7cacee595ebebc75ebeae7
SHA512 354871b849efd7afa706c2df045df1d5960d2f5ab87fc9308303ad02787bf3d46ee845cb549e7f504bd98c2884c9935d45e657d6d148560a1309d799ce7f88f2
SSDEEP 24576:d+OVvDNRVEroC5ojtuWXUAymWR6tAiPd2nI8zFIgH1xYt41tBp39+mz6nfkwS6gj:lNR65GD2m/vPDg1xYt4fB+mz65S6giU3
TLSH
T14FA5CF2179428032D5A10170EDFCEB6F956CBE642F3409DB63D43F6D9A309D26D36A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

713003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\802059\out\Release\SodaDownloader.pdb

kernel32

SizeofResource WriteFile SetFilePointer OutputDebugStringW FindResourceW FindResourceExW GetPrivateProfileIntW GetPrivateProfileStringW InterlockedCompareExchange GetFileSize lstrlenA InterlockedExchange TerminateThread GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree SetEndOfFile SetFileAttributesW DeleteFileW MoveFileExW lstrlenW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetTempPathW MapViewOfFileEx InterlockedDecrement GetCommandLineW MapViewOfFile EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject UnmapViewOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetProcessHeap FindFirstFileExW GetConsoleCP FlushFileBuffers ReadConsoleW HeapDestroy IsValidLocale GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask LockResource CreateFileMappingW VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes GetCurrentThreadId TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP VerSetConditionMask VerifyVersionInfoW GetCurrentDirectoryW HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent LoadResource IsValidCodePage HeapSize MulDiv SetThreadAffinityMask LocalFree LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer GetModuleHandleW DeviceIoControl DeleteCriticalSection InitializeCriticalSection GetConsoleMode GetFileAttributesW GetCurrentProcessId InterlockedIncrement CreateFileW

user32

SetWindowLongW GetWindowLongW ShowWindow AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow DrawTextW GetDesktopWindow SetClipboardData EmptyClipboard GetAsyncKeyState GetSysColor ClientToScreen SetCursor UnionRect EqualRect IntersectRect PtInRect OffsetRect IsZoomed GetCursorPos GetKeyState ScreenToClient SetWindowRgn UpdateLayeredWindow IsRectEmpty GetUpdateRect MoveWindow EndPaint BeginPaint InvalidateRect ReleaseCapture SetCapture GetFocus CallWindowProcW RegisterClassW LoadCursorW MonitorFromPoint FindWindowW GetWindowThreadProcessId SetWindowPos IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable CharNextW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostQuitMessage SetFocus SetWindowTextW GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow GetMonitorInfoW PeekMessageW SetTimer KillTimer LoadImageW IsWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW MonitorFromWindow ReleaseDC GetDC GetSystemMetrics DestroyWindow

gdi32

GetObjectW GetDeviceCaps GetStockObject CreateFontIndirectW DeleteObject BitBlt CreateRoundRectRgn GetWindowOrgEx CreateRectRgnIndirect SaveDC ExtSelectClipRgn RestoreDC CreateDIBSection CreateCompatibleDC SelectObject DeleteDC SetWindowOrgEx SetStretchBltMode StretchBlt SetTextColor SetBkColor SetBkMode GetObjectA

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumKeyExA OpenProcessToken OpenSCManagerW EnumServicesStatusW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemRealloc CoTaskMemFree OleUninitialize CoTaskMemAlloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx OleInitialize CoUninitialize

oleaut32

VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantInit SysFreeString

shlwapi

SHGetValueA SHSetValueA StrTrimA StrStrIA PathIsRelativeW ord176 SHGetValueW PathRemoveFileSpecW PathCanonicalizeW PathFileExistsW PathAppendW PathCombineW PathFindFileNameW StrCmpIW StrCmpNIW StrStrIW

version

VerQueryValueW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmDisableIME

gdiplus

GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipCreateBitmapFromStream GdipImageGetFrameCount GdiplusShutdown GdipGetImageWidth GdipImageGetFrameDimensionsList GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipCreatePen1 GdipDeletePen GdipDrawArc GdipCreateLineBrushFromRect GdipDeleteBrush GdipCloneBrush GdipSetLineBlend GdipCreatePen2 GdipCreateMatrix GdipTranslateMatrix GdipFree GdipAlloc GdiplusStartup GdipCloneImage GdipDisposeImage GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits GdipRotateMatrix GdipMeasureString GdipFillEllipse GdipDrawEllipse GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipCreateLineBrushFromRectI GdipFillPath GdipCreateSolidFill GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipSetWorldTransform GdipClosePathFigure ord1 GdipAddPathLine GdipAddPathEllipse GdipAddPathRectangle GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipFillRegion GdipSetPathGradientFocusScales GdipDeleteRegion GdipCreateRegionPath GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipCreatePathGradientFromPath GdipAddPathPath GdipDeletePath GdipCreatePath GdipSetPixelOffsetMode GdipLoadImageFromFile GdipImageRotateFlip GdipDeleteMatrix GdipDrawImageRect

msimg32

AlphaBlend

crypt32

CryptStringToBinaryA CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetConnectW

generic

count=37, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=38, id=265, version=27048,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=36, id=260, version=26706,

count=129, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=654, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=260, version=27048,

count=31, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,