2026-10-22_97db583c35336d044fc64fe9c4fc9d0e_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_97db583c35336d044fc64fe9c4fc9d0e_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 2.1MB
Sample261024-ebc5sastcw
SHA256 5fe82aefc78174d18cbbded019af3e6816ee7217de1503c04245b035e226b12d
MD5 97db583c35336d044fc64fe9c4fc9d0e
SHA1 2400ea6f897f55df0b1b6eaf8e14e02986d60a5f
SHA512 c669af9bf609238e9f74a47f0b374ff2ef9fe8604750e7017f523d24580b3223d8373bd55395680c1e307b4513d8c356e0252f61b54e9f2f5527edcd5db3f42d
SSDEEP 49152:0pJyseEZbHSWtJTkDfU+68/opDahYzED7R+lEPoDbT:oJyseEZbHSWtJTkzUJDaNvdYT
TLSH
T1FCA5CF11BB418171E2B102705579AB7689BD7D39BF308ACB63D01B2DD9306E2AD35F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_97db583c35336d044fc64fe9c4fc9d0e_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-22_97db583c35336d044fc64fe9c4fc9d0e_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 2.1MB

2026-10-22_97db583c35336d044fc64fe9c4fc9d0e_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH befaf5a7c5c508d9e294f65d7a6f4b48
SHA256 5fe82aefc78174d18cbbded019af3e6816ee7217de1503c04245b035e226b12d
MD5 97db583c35336d044fc64fe9c4fc9d0e
SHA1 2400ea6f897f55df0b1b6eaf8e14e02986d60a5f
SHA512 c669af9bf609238e9f74a47f0b374ff2ef9fe8604750e7017f523d24580b3223d8373bd55395680c1e307b4513d8c356e0252f61b54e9f2f5527edcd5db3f42d
SSDEEP 49152:0pJyseEZbHSWtJTkDfU+68/opDahYzED7R+lEPoDbT:oJyseEZbHSWtJTkzUJDaNvdYT
TLSH
T1FCA5CF11BB418171E2B102705579AB7689BD7D39BF308ACB63D01B2DD9306E2AD35F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

801915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\xhuabao_ludashi_del_cos\StatisticalSDK\StatisticalSDK\Release\promoteEngine.pdb

ws2_32

__WSAFDIsSet select gethostname WSASetLastError getaddrinfo freeaddrinfo send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ioctlsocket sendto recvfrom listen htonl accept WSACleanup WSAStartup socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv

wldap32

ord301 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord143 ord200

crypt32

CryptStringToBinaryA PFXImportCertStore CertAddCertificateContextToStore CryptDecodeObjectEx CertEnumCertificatesInStore CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CertOpenStore CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose

kernel32

GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW GetPrivateProfileIntW CreateDirectoryW SizeofResource GetCommandLineW LockResource LoadResource FindResourceW DeleteCriticalSection GetExitCodeProcess FindClose GetPrivateProfileStringW DeleteFileW GetTempFileNameW FindNextFileW GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW lstrlenW GetFileSizeEx RemoveDirectoryW GetFileAttributesW lstrcmpW DeviceIoControl lstrcmpA lstrcmpiA WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW CopyFileW SetUnhandledExceptionFilter SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetDiskFreeSpaceExW MoveFileW IsBadWritePtr TlsSetValue SetEndOfFile CancelWaitableTimer TlsAlloc TlsFree IsBadReadPtr GetProcessHeap QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA IsProcessorFeaturePresent GetThreadTimes CreateProcessW GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW CreateMutexW WaitForSingleObjectEx SleepEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetTempPathW FindFirstFileW CreateFileW GetCurrentDirectoryW ExpandEnvironmentStringsW TryEnterCriticalSection TlsGetValue GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache SignalObjectAndWait SetThreadPriority GetThreadPriority ChangeTimerQueueTimer GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle GetFullPathNameW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GetLocaleInfoW

user32

GetMessagePos CallWindowProcW SetWindowPos SetWindowTextW RegisterClassExW ShowWindow EnumDisplayDevicesW GetAsyncKeyState LoadCursorW KillTimer GetClassInfoExW wsprintfW SendMessageTimeoutW GetForegroundWindow GetClassNameW GetWindowTextW PostThreadMessageW MessageBoxW UnregisterClassW FindWindowExA GetDesktopWindow FindWindowA GetMonitorInfoW MonitorFromWindow EnumDisplaySettingsW GetWindowThreadProcessId FindWindowExW FindWindowW SetWindowLongW GetWindowLongW WindowFromPoint GetWindowRect ReleaseDC GetDC GetSystemMetrics SetTimer CreateWindowExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW GetKeyState IsWindow

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptAcquireContextA RegEnumKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptEncrypt CryptImportKey CryptGetHashParam CryptDestroyKey CryptReleaseContext

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW

shlwapi

SHGetValueW PathAppendW PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW PathFindFileNameA PathCombineW StrStrIW PathIsRootW SHSetValueW SHGetValueA PathGetDriveNumberW PathRemoveBackslashW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessImageFileNameW GetModuleFileNameExW

powrprof

CallNtPowerInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

netapi32

Netbios

wininet

HttpQueryInfoA InternetSetOptionW InternetConnectW InternetCloseHandle InternetGetLastResponseInfoW HttpSendRequestExW InternetReadFileExA InternetErrorDlg InternetOpenUrlW HttpAddRequestHeadersA HttpSendRequestW HttpAddRequestHeadersW InternetReadFile HttpEndRequestW InternetCrackUrlW HttpQueryInfoW FtpGetFileSize FtpCommandW HttpOpenRequestW InternetQueryOptionW InternetWriteFile InternetSetStatusCallbackW FtpOpenFileW InternetOpenW InternetSetOptionA

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=605, id=1, productName=Unmarked objects,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=112, id=260, version=27034,

count=45, id=265, version=27051,

count=1, id=261, version=35219,

count=3, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,