2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 5.3MB
Sample261027-e5dy6sys7j
SHA256 5457f8bfa3ddeee338d2b1bb78fbf325a8f21b6695b0d32a926f87403586693f
MD5 e2597aaa95cf1051d45f04f9c802ae78
SHA1 acebae806baa47d7566915577a5a7207842d5301
SHA512 bfc9eac6e17d1f7eca72357c8c3db77ebfc2c49523a65e357b8cbeda8ec9a1822c692d7d51ac940a1b85fce6dc7ec0382fc7cbea5f37b6723b8d4846fa6b1e8c
SSDEEP 98304:hDwa5kP0NK8A7DuREfpEyk9lfNJ9ZCqgJwSLAiEs6g7eYtIuaNveKh:hDwtb7KEfbwSEZg7eYlaNveKh
TLSH
T14146DF21BB858071E8A201B05A6DAFBB447DB6352B7508CBF6D41F6E58709C37A36F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 5.3MB

2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH 8903159676c2883ac9268ebd2f8db820
SHA256 5457f8bfa3ddeee338d2b1bb78fbf325a8f21b6695b0d32a926f87403586693f
MD5 e2597aaa95cf1051d45f04f9c802ae78
SHA1 acebae806baa47d7566915577a5a7207842d5301
SHA512 bfc9eac6e17d1f7eca72357c8c3db77ebfc2c49523a65e357b8cbeda8ec9a1822c692d7d51ac940a1b85fce6dc7ec0382fc7cbea5f37b6723b8d4846fa6b1e8c
SSDEEP 98304:hDwa5kP0NK8A7DuREfpEyk9lfNJ9ZCqgJwSLAiEs6g7eYtIuaNveKh:hDwtb7KEfbwSEZg7eYlaNveKh
TLSH
T14146DF21BB858071E8A201B05A6DAFBB447DB6352B7508CBF6D41F6E58709C37A36F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2397536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Surfright\Producten\Alert\branch-2xxx\bin\Release\hmpalert.pdb

kernel32

CloseHandle InterlockedIncrement QueueUserWorkItem GetSystemTimeAsFileTime CreateDirectoryW DeleteCriticalSection CompareFileTime InitializeCriticalSection EnterCriticalSection GetWindowsDirectoryW TryEnterCriticalSection LeaveCriticalSection InterlockedDecrement MultiByteToWideChar WideCharToMultiByte InterlockedExchange InterlockedCompareExchange CreateEventW CreateThread SignalObjectAndWait TerminateThread WaitForSingleObject FindResourceW SizeofResource LoadResource LockResource FreeResource GetLastError Sleep GetCurrentProcess GetModuleHandleA GetProcAddress WTSGetActiveConsoleSessionId LocalAlloc GetDriveTypeW GetVolumeInformationW FileTimeToSystemTime GetDateFormatW SetEvent ResetEvent SetThreadPriority GetCurrentThread GetTickCount OpenProcess DuplicateHandle GetModuleHandleExW GetLogicalDriveStringsW QueryDosDeviceW GetLongPathNameW GlobalAlloc GlobalLock GlobalUnlock FileTimeToLocalFileTime GetComputerNameW GetCurrentProcessId WaitForMultipleObjects WaitForSingleObjectEx GetOverlappedResult CancelIo CreateWaitableTimerW SetWaitableTimer CreateFileA GetFileSize CreateTimerQueue DeleteTimerQueueEx CopyFileW DeleteFileW DeleteTimerQueueTimer CreateTimerQueueTimer ReadDirectoryChangesW FreeLibrary ReadFile GetFileInformationByHandle IsWow64Process LoadLibraryW ReadProcessMemory QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA ProcessIdToSessionId WriteFile FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryA LoadLibraryExA VirtualProtect LoadLibraryExW GetFileSizeEx GetSystemTime SetLastError CreateHardLinkW MoveFileExW OpenEventW GetCurrentThreadId SetFilePointer GetComputerNameA GetLocalTime GlobalFree GetModuleFileNameW GetExitCodeProcess TerminateProcess GetTimeZoneInformation GetVersionExW CreateProcessW CreateEventA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate CreateFileW GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile GetVersionExA DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW CreateIoCompletionPort DisconnectNamedPipe GetQueuedCompletionStatus CreateNamedPipeW ConnectNamedPipe PeekNamedPipe GetProcessTimes WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetFileType GetACP ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer SwitchToThread GetStringTypeW TransactNamedPipe CancelWaitableTimer ResumeThread InitializeCriticalSectionAndSpinCount GetCalendarInfoA MulDiv ConvertDefaultLocale VerifyVersionInfoW VerSetConditionMask GetSystemWow64DirectoryW OpenMutexW GetNativeSystemInfo GetModuleHandleExA GetConsoleMode VirtualAlloc GetStdHandle VirtualFree SetNamedPipeHandleState WaitNamedPipeW GetModuleHandleW VirtualQuery RaiseException DeviceIoControl GetSystemDirectoryW LocalFree HeapSize SystemTimeToFileTime

user32

GetUserObjectInformationW GetAsyncKeyState TrackPopupMenu ModifyMenuW EnumDesktopWindows ChildWindowFromPointEx ScrollDC CreateIconIndirect LoadImageW EnableMenuItem SetMenuDefaultItem AppendMenuW CreatePopupMenu RegisterWindowMessageA ChangeDisplaySettingsW EnumDisplaySettingsW PostQuitMessage GetMessageW WindowFromPoint SetWindowTextW SetWindowLongW EnableWindow SetFocus SetCursor TrackMouseEvent GetPropW SetPropW MoveWindow SetParent UpdateWindow SetCursorPos ClientToScreen MapWindowPoints GetClassNameW EnumWindows MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetMonitorInfoW MonitorFromWindow GetWindowRect GetCursorPos GetWindow GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowRgn EqualRect IsZoomed ShowWindow GetParent CallNextHookEx IsWindowVisible RealGetWindowClassA IsRectEmpty IsIconic SetLayeredWindowAttributes EndPaint BeginPaint UnhookWinEvent UnhookWindowsHookEx MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageW SetWindowsHookExW SetWinEventHook GetForegroundWindow SystemParametersInfoW GetSystemMetrics GetClientRect CallWindowProcW GetWindowTextLengthW SendMessageW RegisterClassW GetClassInfoW GetIconInfo DestroyIcon ReleaseCapture SetCapture ScreenToClient DrawFocusRect InflateRect InvalidateRect PtInRect SetRectEmpty OffsetRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CharUpperW ReleaseDC GetDC MessageBoxExW GetDesktopWindow RedrawWindow SetWindowPos DrawIconEx SetRect PostMessageW KillTimer SetTimer MessageBoxW DrawTextW CopyRect FillRect AllowSetForegroundWindow FindWindowExW CharUpperBuffW CharLowerW CharLowerBuffW ExitWindowsEx RegisterWindowMessageW GetThreadDesktop IsDialogMessageW SwitchDesktop OpenInputDesktop GetUserObjectInformationA CloseDesktop AttachThreadInput SetForegroundWindow BringWindowToTop IsWindowEnabled GetClipboardData DefWindowProcW IsClipboardFormatAvailable DispatchMessageW

fltlib

FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceFindClose FilterGetDosName

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

501KB

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

fltlib

mpr

netapi32

generic