2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader
Size 60.2MB
Sample261027-11e7bsvx7q
SHA256 6255a86917256ec32eebbbe49fc3e5ff981b4ee8ec66d3f280a51f53a617bbf3
MD5 f2098bd0dfe75fbe8b0107b3b71a2b84
SHA1 9430bbfcd90500f3bbae374d11e582578b56e3a7
SHA512 3109770c5891c82a9b346e449023cfedcc7661346f08bef4bdff388e1ac4e3cc117966791dc5bbd0d7b1227b87171d65c32d5d77d6536b740c74557559dbe300
SSDEEP 1572864:+IFTg6aybaTcZTp7GN0ayp318h47al+znhKWoQmiAgboj1HL2H:dT7aQnZTwN0n3H7bjloQmobM18
TLSH
T1DED7339321FE8BBBC8214AB31DD41A32C1A5AE6EC7B545B7525C3E6B34770913A21D33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

.exe 60.2MB

2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

IMPHASH af6d6265ecf5c8beb0c613059f6f2174
SHA256 6255a86917256ec32eebbbe49fc3e5ff981b4ee8ec66d3f280a51f53a617bbf3
MD5 f2098bd0dfe75fbe8b0107b3b71a2b84
SHA1 9430bbfcd90500f3bbae374d11e582578b56e3a7
SHA512 3109770c5891c82a9b346e449023cfedcc7661346f08bef4bdff388e1ac4e3cc117966791dc5bbd0d7b1227b87171d65c32d5d77d6536b740c74557559dbe300
SSDEEP 1572864:+IFTg6aybaTcZTp7GN0ayp318h47al+znhKWoQmiAgboj1HL2H:dT7aQnZTwN0n3H7bjloQmobM18
TLSH
T1DED7339321FE8BBBC8214AB31DD41A32C1A5AE6EC7B545B7525C3E6B34770913A21D33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

b3:a1:bc:9b:f2:02:ca:c3:82:52:88:3c:5a:e8:49:03:be:0c:d7:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Dashengzhixing Technology Co.\, Ltd.,O=Beijing Dashengzhixing Technology Co.\, Ltd.,L=北京,ST=北京,C=CN

Chains

Aug 8, 2018

CN=Beijing Dashengzhixing Technology Co.\, Ltd.,O=Beijing Dashengzhixing Technology Co.\, Ltd.,L=北京,ST=北京,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Dashengzhixing Technology Co.\, Ltd.,O=Beijing Dashengzhixing Technology Co.\, Ltd.,L=北京,ST=北京,C=CN

Serial Number

2a:02:e6:da:00:a1:40:59:e4:fe:99:2f:8e:dd:ae:c5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 11, 2017 - Feb 7, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

314514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\ACSource\ACTalk\ACSetup\ACSetup\Release\ACSetup.pdb

wsock32

recv WSAGetLastError inet_addr inet_ntoa ioctlsocket setsockopt select __WSAFDIsSet WSAStartup WSACleanup closesocket send connect gethostbyname htons socket htonl

shlwapi

StrStrIW StrStrA SHDeleteKeyW SHSetValueW SHGetValueW PathFindFileNameW PathStripToRootW PathIsDirectoryW PathRemoveExtensionA PathCombineW PathRemoveBackslashW PathFileExistsW PathRemoveFileSpecW StrStrIA PathFindFileNameA PathAppendW

kernel32

FreeLibrary GetProcAddress GetModuleHandleW GetCurrentProcess GetPrivateProfileStringW WritePrivateProfileStringW WideCharToMultiByte GetFileAttributesW lstrcatW FindFirstFileW RemoveDirectoryW lstrcmpiW FindNextFileW DeleteFileW FindClose GetModuleHandleA SetErrorMode GetDiskFreeSpaceExW GetLogicalDriveStringsW GetDriveTypeW lstrcpyW GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess GetUserDefaultUILanguage SizeofResource LockResource LoadResource FindResourceW FindResourceExW LoadLibraryExW InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement CreateMutexW DecodePointer FreeResource ProcessIdToSessionId WTSGetActiveConsoleSessionId GetACP GetCurrentDirectoryW MulDiv LoadLibraryW DuplicateHandle DosDateTimeToFileTime SystemTimeToFileTime GetSystemInfo lstrcmpW LocalFree LocalFileTimeToFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InterlockedPushEntrySList RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA ExitProcess RaiseException GetProcessHeap HeapAlloc IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW HeapFree HeapReAlloc HeapSize HeapDestroy SetFileValidData GetCurrentProcessId GetCommandLineW GetTickCount FlushFileBuffers lstrcpynA lstrcpynW EncodePointer GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar ResumeThread WaitForMultipleObjects TerminateThread GetExitCodeThread SetThreadPriority GetPrivateProfileIntW GetLocalTime lstrlenW GetCurrentThreadId SetEndOfFile lstrlenA ResetEvent SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetStdHandle SetFileAttributesW SetFileTime CreateDirectoryW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExW VirtualAlloc VirtualFree GetFileSize CloseHandle GetLastError CreateFileW SetFilePointer WriteFile ReadFile SetLastError FindFirstFileExW GetConsoleCP UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx InitializeSListHead IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime OutputDebugStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetConsoleMode GetFileType ReadConsoleW

user32

GetParent OffsetRect GetPropW SetPropW EnableWindow SetFocus ShowWindow CreateWindowExW GetClassInfoExW RegisterClassExW SystemParametersInfoW DestroyWindow GetFocus GetKeyState SetCapture ReleaseCapture GetDC CallWindowProcW DefWindowProcW SendMessageW wvsprintfW GetWindow SetWindowPos SetWindowRgn GetWindowRect GetClientRect ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetCursorPos ScreenToClient SetWindowLongW GetWindowLongW MapWindowPoints IsRectEmpty SetWindowTextW GetWindowTextW GetWindowTextLengthW IsIconic PostQuitMessage CharNextW GetWindowThreadProcessId FindWindowExW IsWindow FindWindowW MessageBoxW PostMessageW KillTimer SetTimer wsprintfW LoadCursorW IntersectRect CreateCaret PostThreadMessageW PeekMessageW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor CharPrevW DrawTextW FillRect SetRect MonitorFromWindow GetMonitorInfoW MoveWindow CreateAcceleratorTableW InvalidateRgn RegisterClassW SetCursor PtInRect

gdi32

ExtTextOutW TextOutW MoveToEx CreateDIBSection SetStretchBltMode StretchBlt SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox CreateRoundRectRgn DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW GetObjectW SetWindowOrgEx CreateSolidBrush SetBkMode SetTextColor GetDeviceCaps CombineRgn GetCharABCWidthsW CreateRectRgnIndirect

advapi32

InitializeSecurityDescriptor GetFileSecurityW LookupAccountNameW GetUserNameW SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW GetNamedSecurityInfoW DeleteAce GetExplicitEntriesFromAclW SetSecurityDescriptorControl AddAccessAllowedAceEx OpenProcessToken DuplicateTokenEx GetTokenInformation RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW SetFileSecurityW GetSecurityDescriptorControl SetSecurityDescriptorDacl AddAccessAllowedAce AddAce EqualSid GetAce InitializeAcl GetLengthSid GetAclInformation GetSecurityDescriptorDacl

shell32

SHGetPathFromIDListW SHBrowseForFolderW ord680 SHGetSpecialFolderPathW ShellExecuteW

ole32

CoTaskMemAlloc CoUninitialize OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoInitialize CoInitializeEx

oleaut32

SysFreeString VarUI4FromStr SysStringLen SysAllocString

comctl32

_TrackMouseEvent ord17

userenv

CreateEnvironmentBlock

wininet

InternetTimeToSystemTimeA InternetSetCookieA InternetCrackUrlW InternetGetCookieA

urlmon

ObtainUserAgentString UrlMkGetSessionOption

Name

.text

Size

475KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59.5MB

Virtual Size

59.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_f2098bd0dfe75fbe8b0107b3b71a2b84_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

wsock32

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

userenv

wininet

urlmon

generic