2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 1.6MB
Sample261030-bcp9ysch86
SHA256 d39af1110e1fb58a00e92def7e5a09b7b6c65e33be7235e9f08289e9ac4a483f
MD5 804e059ea9795c3ddc7633649a01e39e
SHA1 d75b361690bcc6fbdee0945df952632407bef908
SHA512 0493b3e71dbccd5697f92a8b77fde0f1bf180106400f7c8227ca936c545fbe4829bc9bf8b94a09f438ada0eca3cafea242abd39b4cd5b9b5cb9e5f962df2676a
SSDEEP 24576:3ifHP4PJEwO9e4yO1bcaJsY0xRcU/ELJUcJXYOQ5Nq:yfHP4PJuto6VScXBXYOQ5Nq
TLSH
T147756D36B77AC829C544D5F02A28EA6544EE6D680F1F47C7A3DCDA29CF351C21B33A52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 1.6MB

2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 01843fa5c2267ff8ebec4be4cb2c8bdb
SHA256 d39af1110e1fb58a00e92def7e5a09b7b6c65e33be7235e9f08289e9ac4a483f
MD5 804e059ea9795c3ddc7633649a01e39e
SHA1 d75b361690bcc6fbdee0945df952632407bef908
SHA512 0493b3e71dbccd5697f92a8b77fde0f1bf180106400f7c8227ca936c545fbe4829bc9bf8b94a09f438ada0eca3cafea242abd39b4cd5b9b5cb9e5f962df2676a
SSDEEP 24576:3ifHP4PJEwO9e4yO1bcaJsY0xRcU/ELJUcJXYOQ5Nq:yfHP4PJuto6VScXBXYOQ5Nq
TLSH
T147756D36B77AC829C544D5F02A28EA6544EE6D680F1F47C7A3DCDA29CF351C21B33A52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2d:93:3b:ad:7b:69:77:53:51:c7:94:da:5d:d4:5f:0a:ea:2e:80:55:b2:2b:0b:7d:0a:1b:ee:7a:83:fa:0a:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=成都奇鲁科技有限公司

Chains

Oct 26, 2026

CN=成都奇鲁科技有限公司

Minor OS version

Major OS version

Entry point

394453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean\ai_cooling_group\client\ai_cooling\Release\ai_cooling_ui.pdb

kernel32

GetPrivateProfileStringW GetPrivateProfileIntW SetLastError IsBadReadPtr VirtualProtect GetCurrentThreadId GetCurrentProcessId WaitForSingleObject HeapSetInformation SetErrorMode SetUnhandledExceptionFilter CloseHandle MultiByteToWideChar Sleep CreateEventW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteFileW GetCommandLineW FindResourceW LoadLibraryW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW SetStdHandle HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale RaiseException DecodePointer ExitThread GetTimeZoneInformation GetFileType GetACP GetConsoleMode FindClose FindFirstFileW FindNextFileW GetFullPathNameW lstrlenW VerSetConditionMask OpenProcess VerifyVersionInfoW K32GetModuleFileNameExW DeleteAtom AddAtomW FindAtomW WritePrivateProfileStringW CopyFileW WideCharToMultiByte GetStringTypeW FormatMessageW TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA InterlockedExchange InterlockedCompareExchange LocalFree TerminateProcess CreateThread GetCurrentThread SetThreadPriority CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent ReleaseMutex WaitForMultipleObjects GetFileSizeEx GetStdHandle WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer SetFilePointerEx DuplicateHandle GetNativeSystemInfo CreateMutexW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW CreateProcessW OutputDebugStringA CreateFileW RegisterWaitForSingleObject UnregisterWaitEx GetVersionExW LoadLibraryExW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile UnhandledExceptionFilter GetStartupInfoW MapViewOfFileEx lstrcmpiW DeviceIoControl lstrcmpA lstrcmpiA GetSystemDirectoryW CreateFileA FreeResource GetSystemWindowsDirectoryW WaitForSingleObjectEx SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait GetThreadTimes FreeLibraryAndExitThread ReleaseSemaphore InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind GetFileAttributesExW ExitProcess GetConsoleCP

user32

WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer wsprintfW SendMessageTimeoutW DispatchMessageW CharNextW WaitForInputIdle GetMessageW PostThreadMessageW GetAncestor GetWindowInfo GetWindow PeekMessageW GetWindowThreadProcessId UnregisterClassW TranslateMessage GetShellWindow GetDesktopWindow WindowFromPoint GetWindowRect GetForegroundWindow ShowWindow LoadStringW RegisterWindowMessageW PostMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassExW DestroyWindow GetWindowLongW GetClassInfoExW CreateWindowExW SetWindowLongW GetMonitorInfoW MonitorFromPoint GetCursorPos SetForegroundWindow TrackPopupMenu GetSubMenu DestroyMenu LoadMenuW LoadIconW GetParent SendMessageW LoadCursorW FindWindowW IsWindow

advapi32

GetUserNameW OpenProcessToken GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegGetValueW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA RegEnumKeyExA

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeSecurity CoInitializeEx CoCreateGuid

oleaut32

SysAllocString VariantInit VariantClear SysFreeString VarUI4FromStr

shlwapi

PathIsRootW PathIsDirectoryW StrStrIA PathIsRelativeW StrStrIW StrTrimA StrCmpNIW PathAppendW PathRemoveFileSpecW PathFindFileNameW PathRenameExtensionW StrCmpIW PathCombineW PathFileExistsW SHGetValueA SHSetValueA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdiplusShutdown GdiplusStartup

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

wininet

InternetGetConnectedState

winmm

timeGetTime timeBeginPeriod timeEndPeriod

crypt32

CryptStringToBinaryW CertGetNameStringW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_804e059ea9795c3ddc7633649a01e39e_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

gdiplus

urlmon

wininet

winmm

crypt32

wintrust

secur32

iphlpapi

generic