2026-10-23_297e1e198145dbce2d576ba8e739c3ee_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_297e1e198145dbce2d576ba8e739c3ee_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 3.9MB
Sample261023-rd1ebab15z
SHA256 fd1ce445447ab59d0b95f7b8148a790966f82f626f336483c8197fe19dd12ad5
MD5 297e1e198145dbce2d576ba8e739c3ee
SHA1 e8119fc055cbc7aa693336c8d533335a56dc48af
SHA512 c38e7a0503231758b8ea669f2a19f09f8906f48c76caf64ffd4949fbb8ce0e1818796d0407456687de9368f8d6abbf3b6e06d6a4ef0da45a6760ff471ec2fb69
SSDEEP 49152:QY5CA7FLl1dBf7IeB7U0KeSzMzOp09B/pwpTVlIlrP7iG3mSUCJmRIQ22WCMrTYM:b55xsa4z8PGpREzm2mSNJP2WCMvXWZK5
TLSH
T1B716F16136428035EA7611B1993CEEAAD89DAF304F7491CB63D82F7D1E711C39E31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_297e1e198145dbce2d576ba8e739c3ee_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-23_297e1e198145dbce2d576ba8e739c3ee_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 3.9MB

2026-10-23_297e1e198145dbce2d576ba8e739c3ee_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 85c223978c92a56cd0323b34acd96951
SHA256 fd1ce445447ab59d0b95f7b8148a790966f82f626f336483c8197fe19dd12ad5
MD5 297e1e198145dbce2d576ba8e739c3ee
SHA1 e8119fc055cbc7aa693336c8d533335a56dc48af
SHA512 c38e7a0503231758b8ea669f2a19f09f8906f48c76caf64ffd4949fbb8ce0e1818796d0407456687de9368f8d6abbf3b6e06d6a4ef0da45a6760ff471ec2fb69
SSDEEP 49152:QY5CA7FLl1dBf7IeB7U0KeSzMzOp09B/pwpTVlIlrP7iG3mSUCJmRIQ22WCMrTYM:b55xsa4z8PGpREzm2mSNJP2WCMvXWZK5
TLSH
T1B716F16136428035EA7611B1993CEEAAD89DAF304F7491CB63D82F7D1E711C39E31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

604578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\c_expand\install_uninstall\install_uninstall\Release\Install.pdb

kernel32

GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError MoveFileExW MoveFileW FindResourceW lstrlenW SizeofResource LockResource LoadResource FindResourceExW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW ReadFile UnlockFile WaitForSingleObject GetCurrentProcess WriteConsoleW CreateProcessW GetStartupInfoW GetModuleHandleW GetProcAddress LoadLibraryW WideCharToMultiByte MultiByteToWideChar VerSetConditionMask RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId VerifyVersionInfoW DecodePointer Sleep FreeLibrary LoadLibraryExW CreateFileW FindNextFileW FindFirstFileW FindClose GetFileSize GetTempFileNameA GetTempPathA CloseHandle WriteFile DeleteFileA GetTickCount64 ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlushFileBuffers GetCurrentThread GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread InitializeCriticalSectionEx GetDriveTypeW CreateEventW ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind lstrcmpiA lstrcmpA DeviceIoControl GetVersionExW GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange GetStdHandle SetEndOfFile GetFileInformationByHandle DeleteFileW LockFile CompareFileTime FindFirstChangeNotificationW SetEvent lstrcmpiW FindCloseChangeNotification SetFileTime CreateDirectoryW GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW GetCurrentProcessId TerminateProcess GetExitCodeProcess OpenProcess OutputDebugStringA OutputDebugStringW GetFileSizeEx GetLocalTime ResetEvent GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile GetTempFileNameW LocalFree FormatMessageW CopyFileW GetDiskFreeSpaceExW GetSystemDirectoryW GetFileAttributesExW SetFilePointer GetTickCount WaitForMultipleObjects LocalAlloc GetPrivateProfileStringW WritePrivateProfileStringW GetShortPathNameW IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GlobalAlloc GlobalLock GlobalUnlock GlobalFree FindFirstFileA FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter OpenFileMappingW ReleaseMutex GetCurrentDirectoryW SearchPathW CreateFileA

user32

OffsetRect UnionRect EqualRect PtInRect SetCursor DrawFocusRect DestroyCursor MoveWindow ReleaseDC GetShellWindow UnregisterClassA IsDialogMessageW GetActiveWindow EndDialog CopyRect GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetForegroundWindow GetSystemMetrics IsIconic IsWindowVisible PostQuitMessage CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW FillRect ScreenToClient GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint DrawTextW KillTimer SetTimer ReleaseCapture SetCapture GetAsyncKeyState GetFocus SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow IsWindow CreateWindowExW GetClassInfoExW FindWindowW SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW wsprintfW RegisterClassExW MonitorFromWindow SendMessageW GetDC UnregisterClassW CallWindowProcW GetWindowThreadProcessId FindWindowExW DefWindowProcW DialogBoxParamW PostMessageW WaitForInputIdle

gdi32

SelectObject SelectClipRgn SaveDC CreateDIBSection GetObjectW SetViewportOrgEx SetTextColor SetBkMode RestoreDC GetStockObject DeleteObject DeleteDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps CreateFontW EnumFontFamiliesW RectVisible OffsetViewportOrgEx

advapi32

CryptContextAddRef RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW CreateWellKnownSid DuplicateTokenEx GetLengthSid GetTokenInformation SetTokenInformation RegGetValueW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService LockServiceDatabase OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceConfig2W QueryServiceLockStatusW QueryServiceStatus QueryServiceStatusEx StartServiceW UnlockServiceDatabase RegEnumValueW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHChangeNotify CommandLineToArgvW ord165 ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW

ole32

CoInitializeSecurity CreateStreamOnHGlobal OleRun CoTaskMemFree CoTaskMemRealloc CoInitializeEx CoInitialize CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid CoSetProxyBlanket

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo VariantClear VariantInit SysAllocString SysAllocStringByteLen VariantCopy CreateErrorInfo VarUI4FromStr SysFreeString

shlwapi

PathFileExistsW PathCombineW PathAppendW PathRenameExtensionA PathFindFileNameA wnsprintfW AssocQueryStringW PathFindFileNameW PathIsRootW SHSetValueA SHGetValueA StrToIntExW StrCmpIW StrTrimA StrCmpNIW StrStrIW PathFindExtensionW SHGetValueW PathRemoveFileSpecW PathIsDirectoryW PathIsRelativeW StrStrIA SHSetValueW PathIsPrefixW PathAppendA

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateBitmapFromFileICM GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

setupapi

SetupIterateCabinetW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

secur32

GetUserNameExW

crypt32

CryptStringToBinaryA CertGetNameStringW CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

generic

count=17, id=241, version=40116,

count=166, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=208, version=65501,

count=3, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=16, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=6, id=261, version=27032,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=3, id=206, version=65501,

count=39, id=203, version=65501,

count=458, id=1, productName=Unmarked objects,

count=79, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,