2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 3.6MB
Sample261024-p47j7svsbs
SHA256 87188b37a3e17c7e80efffe15e925dd768d6438a6a648dba9fe86ebe1eae0d74
MD5 5577be7fc53e61c9109de4eb8baf5b23
SHA1 25c79aea42402606f8f105da47d7421acb8396a1
SHA512 703023a9132a9e3b2c66c839ddb532480c2abf5b5d9207d93a6f99ef4559acdf43a1fe681cd119222dd20d20e7686081ed494d87d64f6db6eca9d61542af1c78
SSDEEP 98304:QjFGqQ/3Y7MTbCGF/AsedZD0pB2ukXNIEw4:qFTvMT1/PoNId4
TLSH
T11306DF113682C07BD9A30131497DE7FA197C6E351F3081E7A3D43A2D6E789E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 3.6MB

2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH a81994a8e54b90ebc57ddfe905d7f15e
SHA256 87188b37a3e17c7e80efffe15e925dd768d6438a6a648dba9fe86ebe1eae0d74
MD5 5577be7fc53e61c9109de4eb8baf5b23
SHA1 25c79aea42402606f8f105da47d7421acb8396a1
SHA512 703023a9132a9e3b2c66c839ddb532480c2abf5b5d9207d93a6f99ef4559acdf43a1fe681cd119222dd20d20e7686081ed494d87d64f6db6eca9d61542af1c78
SSDEEP 98304:QjFGqQ/3Y7MTbCGF/AsedZD0pB2ukXNIEw4:qFTvMT1/PoNId4
TLSH
T11306DF113682C07BD9A30131497DE7FA197C6E351F3081E7A3D43A2D6E789E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\873524\out\Release\360AblumViewer.pdb

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipFillRectangleI GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipReleaseDC GdipAlloc

kernel32

VirtualFree FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetThreadAffinityMask GetDateFormatW GetTimeFormatW CompareStringW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetNumberFormatW GetCurrencyFormatW EnumCalendarInfoExW EnumDateFormatsExW GetSystemDefaultLCID GetUserDefaultLCID GetModuleHandleW LockResource HeapDestroy HeapSize GetProcessHeap GetCurrentProcessId DeleteCriticalSection LoadResource SizeofResource FindResourceW FindResourceExW GetPrivateProfileIntW GlobalAlloc GlobalLock GlobalUnlock FileTimeToSystemTime InitializeCriticalSection WaitForMultipleObjects GetFileTime FindFirstChangeNotificationW FindNextChangeNotification FindCloseChangeNotification FreeResource FindClose SetFileTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation SystemTimeToFileTime lstrlenW FindFirstFileW FindNextFileW GetVersion GetShortPathNameW GetLongPathNameW GetFileSizeEx GetTempPathW RemoveDirectoryW GetFileAttributesExW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW InterlockedExchange InterlockedCompareExchange LocalFree GetCurrentProcess GetCurrentThreadId GetSystemTime GetWindowsDirectoryW VirtualAlloc GlobalFree GetFileSize ReadFile GetFileAttributesA DeleteFileA MulDiv WriteFile MoveFileW OutputDebugStringW InterlockedDecrement lstrcmpiW GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA SetEndOfFile SetFilePointer GetLocalTime GetThreadLocale FormatMessageW CreateDirectoryW CopyFileW GetCommandLineW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TlsAlloc SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent VirtualQuery GetNativeSystemInfo GetSystemDirectoryW TlsSetValue TlsFree LCMapStringW GetTickCount GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW LocalFileTimeToFileTime CreateFileA SetFilePointerEx HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex RtlUnwind InterlockedFlushSList ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetCommandLineA GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl TlsGetValue HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetFileAttributesW CreateFileW GetStdHandle GetCurrentThread GetConsoleCP GetConsoleMode VirtualProtect GetFileType IsValidLocale EnumSystemLocalesW ReadConsoleW FlushFileBuffers IsValidCodePage GetOEMCP SetStdHandle WriteConsoleW SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA ReleaseSemaphore SignalObjectAndWait CreateSemaphoreA GetModuleFileNameA TryEnterCriticalSection HeapQueryInformation SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetModuleHandleA SetProcessAffinityMask DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue WaitForMultipleObjectsEx InterlockedIncrement RtlCaptureStackBackTrace

user32

MapWindowPoints GetWindowRect SetWindowTextW TrackPopupMenu GetParent SetWindowPos LoadCursorW SetWindowLongW GetWindowLongW PtInRect CopyRect FillRect GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW InflateRect GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu SetMenuItemInfoW OffsetRect CharLowerBuffW EqualRect SendMessageTimeoutW UnregisterClassW DestroyWindow CharNextW ShowCursor EnumWindows SetFocus EnableWindow EnumDisplayMonitors SetCapture ScreenToClient GetCursorPos SetCursor GetClientRect GetWindowTextW InvalidateRect ReleaseDC GetDC DrawTextW GetSystemMetrics GetDlgItem CallWindowProcW ReleaseCapture BeginPaint EndPaint IsWindowVisible CreateWindowExW ShowWindow SetPropW GetPropW RemovePropW GetSysColor MonitorFromPoint SetTimer KillTimer SetCursorPos ClientToScreen UpdateWindow LoadMenuW DestroyMenu CheckMenuItem MoveWindow PeekMessageW AttachThreadInput GetWindowPlacement SetWindowPlacement IsZoomed IsClipboardFormatAvailable IsWindowEnabled DefWindowProcW TrackMouseEvent GetForegroundWindow SetForegroundWindow EndDialog EnableMenuItem SetClassLongW GetKeyState PostMessageW SystemParametersInfoW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindow SendMessageW MessageBoxW GetActiveWindow IsRectEmpty IntersectRect GetWindowThreadProcessId DialogBoxParamW

gdi32

SelectClipRgn ExtCreatePen SetROP2 ExtSelectClipRgn ExcludeClipRect CreateRectRgn BitBlt TextOutW GetTextExtentPoint32W CreateCompatibleDC CreateCompatibleBitmap MoveToEx LineTo GetObjectW EndPage StartPage EndDoc StartDocW StretchDIBits ExtTextOutW SetMapMode CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor GetTextMetricsW CreateFontW CreateFontIndirectW GetDeviceCaps GetStockObject Rectangle SetDIBitsToDevice GetTextFaceW DPtoLP CreateDCW CreatePen SetBkColor IntersectClipRect

winspool.drv

DeviceCapabilitiesW

comdlg32

PrintDlgExW GetOpenFileNameW GetSaveFileNameW

advapi32

FreeSid RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity RegGetKeySecurity GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl RegDeleteKeyA AllocateAndInitializeSid RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW ImpersonateSelf

shell32

ShellExecuteW ord102 SHCreateDirectoryExW SHGetDesktopFolder ord232 SHFileOperationW SHGetFolderPathW ord17 ord16 ord155 ord18 DragQueryFileW ord165 SHChangeNotify SHGetSpecialFolderPathW DragFinish SHGetFolderLocation DragAcceptFiles

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit VariantClear VarUI4FromStr SysAllocString SysFreeString

shlwapi

SHQueryValueExA SHDeleteKeyW SHDeleteKeyA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW StrCmpLogicalW PathAddBackslashW PathFindExtensionW StrToIntExW SHGetValueA PathIsDirectoryW PathFindFileNameW

ws2_32

WSASetLastError select htonl ntohs __WSAFDIsSet

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW

psapi

EnumProcessModules EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA GetDeviceDriverBaseNameW GetDeviceDriverBaseNameA EnumDeviceDrivers GetMappedFileNameA GetMappedFileNameW InitializeProcessForWsWatch QueryWorkingSet EmptyWorkingSet GetModuleBaseNameW GetModuleBaseNameA GetProcessImageFileNameW GetProcessImageFileNameA GetWsChanges GetModuleFileNameExW GetModuleFileNameExA

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassRegistryPropertyW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=35, id=241, version=40116,

count=188, id=243, version=40116,

count=34, id=242, version=40116,

count=6, id=199, version=41118,

count=29, id=259, version=26706,

count=38, id=260, version=26706,

count=11, id=260, version=27045,

count=47, id=261, version=27045,

count=33, productName=Unmarked objects (old),

count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=136, id=261, version=26706,

count=531, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=102, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,