2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat
Size 2.1MB
Sample261024-trd5caay7x
SHA256 9f49a98e4b14a8e2e8c1d897535184ba369932ef14d2e34735ac5ff815f3a0a6
MD5 3a3cdbdbc7b95729815062b46535620f
SHA1 beee803076d5724f0a6487a6d13a0f26faecfb88
SHA512 2129bb6efd1886ddb8fdd0bb1fce135df169e5d30be7a5651196ee505f605ef49428a469be9f48e1bc9848e20730069da3cb884157124e714dd80d0c0d2eff24
SSDEEP 49152:RktERlzetzBeg2L9S9Fp9B5rRAu9SlPFdORi2RNi0508m1v4Wg0hCBf:RktERlzetzBeg2L9u9jr2uiORi0lm1gR
TLSH
T18DA5DF217842C079D59100B1D9BCEBF58A7D9E308B2561DB97943E6CEA302E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat

.exe 2.1MB

2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH 660b2eb72a7cb7cd1570b35441627052
SHA256 9f49a98e4b14a8e2e8c1d897535184ba369932ef14d2e34735ac5ff815f3a0a6
MD5 3a3cdbdbc7b95729815062b46535620f
SHA1 beee803076d5724f0a6487a6d13a0f26faecfb88
SHA512 2129bb6efd1886ddb8fdd0bb1fce135df169e5d30be7a5651196ee505f605ef49428a469be9f48e1bc9848e20730069da3cb884157124e714dd80d0c0d2eff24
SSDEEP 49152:RktERlzetzBeg2L9S9Fp9B5rRAu9SlPFdORi2RNi0508m1v4Wg0hCBf:RktERlzetzBeg2L9u9jr2uiORi0lm1gR
TLSH
T18DA5DF217842C079D59100B1D9BCEBF58A7D9E308B2561DB97943E6CEA302E27B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

677347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

kernel32

GetCurrentProcess TerminateProcess OpenProcess GlobalAlloc GlobalFree LocalAlloc LocalFree SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindNextFileW FlushFileBuffers GetFileSizeEx GetFullPathNameW SetEndOfFile SetFilePointerEx GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW GetNamedPipeInfo SetEvent ResetEvent ReleaseMutex WaitForSingleObject CreateEventW WaitForMultipleObjects SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue VirtualAlloc VirtualFree FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryExW MoveFileExW RtlCaptureStackBackTrace InitializeCriticalSection DeleteCriticalSection LCMapStringW GetCurrentThread FormatMessageW LocalReAlloc GetSystemTimeAsFileTime MultiByteToWideChar GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TryEnterCriticalSection QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetModuleHandleW EncodePointer DecodePointer CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW SignalObjectAndWait CreateThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RtlUnwind GetTimeZoneInformation GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread ResumeThread ExitProcess GetCommandLineA ReadConsoleW GetConsoleCP HeapFree HeapAlloc GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap HeapSize WriteConsoleW RaiseException GetOverlappedResult ConnectNamedPipe ReadFile FindClose DeleteFileW GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation GetCurrentThreadId GetCurrentProcessId Sleep WriteFile GetFileAttributesW GetStdHandle LeaveCriticalSection EnterCriticalSection SwitchToThread GetEnvironmentVariableW TlsFree GetTickCount GetModuleFileNameW SetDllDirectoryW CloseHandle GetLastError CreateMutexW GetCommandLineW

user32

PostQuitMessage PostMessageW PeekMessageW DispatchMessageW TranslateMessage DestroyWindow SetTimer MsgWaitForMultipleObjectsEx DefWindowProcW CreateWindowExW RegisterClassW SetWindowLongW GetWindowLongW GetShellWindow EnumWindows KillTimer GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW ConvertStringSidToSidW CreateProcessWithTokenW LookupPrivilegeValueW SetTokenInformation GetTokenInformation GetSidSubAuthority GetLengthSid FreeSid EqualSid DuplicateTokenEx AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW CommandLineToArgvW SHCreateDirectoryExW

ws2_32

htonl ntohs bind closesocket connect ioctlsocket getsockname getsockopt htons listen recv select send socket WSAStartup WSAGetLastError __WSAFDIsSet inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname WSASetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_3a3cdbdbc7b95729815062b46535620f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat

kernel32

user32

crclient

advapi32

shell32

ws2_32

generic