2026-10-22_40faf02ac61361039aa8666656998635_amadey_darkgate_elex_luca-stealer_medusalocker_metamorfo_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_40faf02ac61361039aa8666656998635_amadey_darkgate_elex_luca-stealer_medusalocker_metamorfo_njrat_remcos
Size 2.7MB
Sample261024-ss7bvavwhx
SHA256 fab30c0d0fb115a83b6e9e173f3577c1b4a7514db9de7f59eb0b60283a80554d
MD5 40faf02ac61361039aa8666656998635
SHA1 ebc44ec460c76410ffd37f57e5a78fb2da0155c1
SHA512 837bc08dd4767c50c25d2d2ad7eab8d5d99b3c9e575cbdce885916fefba815805b97baadfdf3152c92edb9fbc4cdd071e061b72d2130125d00253f940ed39aef
SSDEEP 49152:y2ZZylOtxudozW/R0WyR2ha7NFgD2xK4agkXZa2iueVVGE:x0OtMdnyo6QcKQOiVx
TLSH
T1DDD51610BA47CD22D66101715969EF7A405BEE743BE0B4C772C43AEF3A308DE6D36A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_40faf02ac61361039aa8666656998635_amadey_darkgate_elex_luca-stealer_medusalocker_metamorfo_njrat_remcos

.exe 2.7MB

2026-10-22_40faf02ac61361039aa8666656998635_amadey_darkgate_elex_luca-stealer_medusalocker_metamorfo_njrat_remcos

IMPHASH 2461bec5d193ad5e9d624705c3dec717
SHA256 fab30c0d0fb115a83b6e9e173f3577c1b4a7514db9de7f59eb0b60283a80554d
MD5 40faf02ac61361039aa8666656998635
SHA1 ebc44ec460c76410ffd37f57e5a78fb2da0155c1
SHA512 837bc08dd4767c50c25d2d2ad7eab8d5d99b3c9e575cbdce885916fefba815805b97baadfdf3152c92edb9fbc4cdd071e061b72d2130125d00253f940ed39aef
SSDEEP 49152:y2ZZylOtxudozW/R0WyR2ha7NFgD2xK4agkXZa2iueVVGE:x0OtMdnyo6QcKQOiVx
TLSH
T1DDD51610BA47CD22D66101715969EF7A405BEE743BE0B4C772C43AEF3A308DE6D36A16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

30:a3:58:81:7c:3b:7c:f6:06:97:7b:ac:0d:75:88:dd:ef:c3:4f:c3:f2:55:4a:57:8c:26:1e:17:06:f5:46:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津微极智科技有限公司,O=天津微极智科技有限公司,ST=天津市,C=CN

Chains

Aug 29, 2023

CN=天津微极智科技有限公司,O=天津微极智科技有限公司,ST=天津市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=天津微极智科技有限公司,O=天津微极智科技有限公司,ST=天津市,C=CN

Serial Number

0a:e1:b2:23:7a:c3:65:79:5f:93:c1:69:14:90:86:66

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2022 - Mar 19, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1357741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\MGame\Ultra Uninstaller\Uninstaller_Main\bin\Release\UltraUninstaller.pdb

kernel32

GetSystemInfo SetLastError SystemTimeToFileTime GetLocalTime GetFileAttributesExW GetOverlappedResult CreateNamedPipeW SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe WriteFile ReadFile CreateMutexW ReleaseMutex CopyFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot FileTimeToSystemTime MoveFileExW lstrcmpiW GetProcessId GetStartupInfoW CreateProcessW GetCurrentThread OutputDebugStringW GetTempPathW SetFileAttributesW RemoveDirectoryW GetFileTime GetFileSize GetFileAttributesW GetDriveTypeW DeleteFileW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW lstrcpynW K32GetProcessImageFileNameW K32GetModuleFileNameExW K32EnumProcesses lstrlenW GetExitCodeProcess TerminateProcess QueryDosDeviceW GetLongPathNameW GetLogicalDriveStringsW IsBadReadPtr VirtualProtect GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetVersionExW GetTickCount64 OpenProcess WaitForMultipleObjects CloseHandle LoadLibraryW FreeLibrary GetProcAddress GetModuleHandleW GetCurrentProcess Sleep CreateEventW WaitForSingleObject ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCommandLineW WideCharToMultiByte FindNextFileW FindFirstFileW FindClose GetModuleFileNameW MultiByteToWideChar FindResourceW SizeofResource LockResource WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStdHandle LoadResource FindResourceExW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize GetSystemWindowsDirectoryW InterlockedCompareExchange CreateFileA HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError GetSystemDirectoryW lstrcmpiA lstrcmpA InitializeSListHead UnhandledExceptionFilter RaiseException DecodePointer IsDebuggerPresent GetStringTypeW FormatMessageW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread FindFirstFileExW GetFileInformationByHandle AreFileApisANSI DeviceIoControl TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetCPInfo QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW LoadLibraryExW MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetFileSizeEx SetFilePointer LocalFree InterlockedIncrement InterlockedDecrement LocalAlloc FlushFileBuffers MulDiv GetACP ExitProcess FreeResource lstrcmpW SetEndOfFile ResumeThread GetTempFileNameW GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree IsProcessorFeaturePresent

user32

RegisterWindowMessageW wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetSystemMetrics SetPropW GetPropW GetClientRect SetWindowLongW GetParent LoadCursorW CharNextW MonitorFromPoint IsChild DestroyWindow UpdateLayeredWindow IsWindowVisible IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty GetClassNameW wvsprintfW SetCursor InflateRect OffsetRect SetForegroundWindow RemovePropW IsIconic SetWindowRgn MessageBoxW DrawIconEx CharPrevW DrawTextW SetRect HideCaret ShowCaret GetSysColor GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn FillRect FindWindowExW IsWindowEnabled GetWindowDC LoadImageW SendMessageW PostMessageW SetTimer KillTimer IsWindow ShowWindow MoveWindow SetWindowPos GetDC ReleaseDC GetWindowRect CopyRect PtInRect GetWindowLongW FindWindowW SendMessageTimeoutW ClientToScreen MonitorFromWindow SystemParametersInfoW GetWindow EnableWindow SetFocus DispatchMessageW TranslateMessage GetMessageW ChangeWindowMessageFilter SetActiveWindow PostQuitMessage SetWindowTextW EnumDisplayMonitors GetMonitorInfoW GetIconInfo DestroyIcon GetWindowThreadProcessId EnumWindows

gdi32

SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush CreateRoundRectRgn GetClipBox CreateDIBSection SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle GetStockObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps GetCharABCWidthsW DeleteObject GetObjectW GetTextExtentPoint32W SetDIBitsToDevice SelectObject CombineRgn CreateRectRgnIndirect CreateDCW GetDIBits

advapi32

EnumServicesStatusExW QueryServiceLockStatusW UnlockServiceDatabase RegEnumKeyExA RegOpenKeyExA RegQueryValueExA LockServiceDatabase DeleteService ControlService ChangeServiceConfigW RegCloseKey RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegOpenKeyW RegDeleteTreeW RegDeleteKeyValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor QueryServiceStatus RegGetValueW RegDeleteKeyW RegCreateKeyW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegEnumValueW QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegNotifyChangeKeyValue RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegEnumKeyW RegSetValueExW

shell32

ord155 SHGetPathFromIDListW SHGetFolderLocation SHGetKnownFolderPath SHGetDesktopFolder SHChangeNotify ord680 SHGetFileInfoW SHFileOperationW ShellExecuteW ShellExecuteExW ord165 SHGetSpecialFolderPathW ord727

ole32

OleInitialize CoCreateGuid OleUninitialize CoCreateInstance CoTaskMemFree StringFromCLSID CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CoUninitialize CLSIDFromString CoInitialize

oleaut32

SafeArrayPutElement SafeArrayCreate VariantTimeToSystemTime SystemTimeToVariantTime VariantClear VariantInit SysFreeString SysAllocString

shlwapi

PathAppendW StrStrIW PathCombineW PathIsDirectoryW PathRemoveFileSpecW StrCmpIW PathFileExistsW wnsprintfW PathAddBackslashW SHCreateStreamOnFileEx StrStrIA StrTrimA StrCmpNIW SHSetValueA SHGetValueA SHAutoComplete PathFindFileNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

gdiplus

GdipGetPropertyItemSize GdiplusStartup GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetPropertyItem GdipAlloc GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipFree GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipSaveImageToFile GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipClosePathFigure GdipDrawImageRectRectI GdipDrawImageRectI GdipSetInterpolationMode GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipCloneBitmapAreaI GdipGetImageHeight GdipCreatePath GdipGetImageEncoders GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipGetImageGraphicsContext GdipGetImageWidth GdipDeletePath

msi

ord217 ord173 ord248 ord45

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

comctl32

_TrackMouseEvent ord17 ImageList_DrawEx InitCommonControlsEx

msimg32

GradientFill AlphaBlend

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

generic

count=39, id=259, version=24610,

count=190, id=261, version=24610,

count=30, id=260, version=24610,

count=9, id=260, version=27045,

count=20, id=261, version=27045,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=199, version=41118,

count=27, id=259, version=26706,

count=64, id=261, version=27049,

count=1, id=263, version=24610,

count=6, id=261, version=27032,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=4, id=261, version=27031,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=19, id=262, version=24610,

count=39, id=257, version=24610,

count=611, id=1, productName=Unmarked objects,

count=85, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,