2026-10-31_ec8ff61a7b31f592a4ddbc112f7ffe47_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_ec8ff61a7b31f592a4ddbc112f7ffe47_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 2.1MB
Sample261101-xdsmcset6n
SHA256 b8937237cb1cc432a1dc344b701ef4a6d1c11a09c4f0614c6e20e9aab842e144
MD5 ec8ff61a7b31f592a4ddbc112f7ffe47
SHA1 040ab1f764777acf3728ee96ad7c9ced733e741f
SHA512 96802c243010e210b041dad306ef5c6ec05201670059d698604105343272ca2df433dc96d90e7f300d5fa168ba3eeb79599b425db4265224effefd8c503ac4b6
SSDEEP 49152:KpJyseEZbHSWtJTkDfU+68/oO+gB8nHYRJxP7kWt+lq:mJyseEZbHSWtJTkzU2B84lP7kLq
TLSH
T1EDA5BF11BB418271E1B102705579AF76897D7D39BF348ACB63D01B2DD9302E2AD36F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_ec8ff61a7b31f592a4ddbc112f7ffe47_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-31_ec8ff61a7b31f592a4ddbc112f7ffe47_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 2.1MB

2026-10-31_ec8ff61a7b31f592a4ddbc112f7ffe47_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH befaf5a7c5c508d9e294f65d7a6f4b48
SHA256 b8937237cb1cc432a1dc344b701ef4a6d1c11a09c4f0614c6e20e9aab842e144
MD5 ec8ff61a7b31f592a4ddbc112f7ffe47
SHA1 040ab1f764777acf3728ee96ad7c9ced733e741f
SHA512 96802c243010e210b041dad306ef5c6ec05201670059d698604105343272ca2df433dc96d90e7f300d5fa168ba3eeb79599b425db4265224effefd8c503ac4b6
SSDEEP 49152:KpJyseEZbHSWtJTkDfU+68/oO+gB8nHYRJxP7kWt+lq:mJyseEZbHSWtJTkzU2B84lP7kLq
TLSH
T1EDA5BF11BB418271E1B102705579AF76897D7D39BF348ACB63D01B2DD9302E2AD36F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

801915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\xhuabao_ludashi_del_cos\StatisticalSDK\StatisticalSDK\Release\promoteEngine.pdb

ws2_32

__WSAFDIsSet select gethostname WSASetLastError getaddrinfo freeaddrinfo send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ioctlsocket sendto recvfrom listen htonl accept WSACleanup WSAStartup socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv

wldap32

ord301 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord143 ord200

crypt32

CryptStringToBinaryA PFXImportCertStore CertAddCertificateContextToStore CryptDecodeObjectEx CertEnumCertificatesInStore CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CertOpenStore CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose

kernel32

GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW GetPrivateProfileIntW CreateDirectoryW SizeofResource GetCommandLineW LockResource LoadResource FindResourceW DeleteCriticalSection GetExitCodeProcess FindClose GetPrivateProfileStringW DeleteFileW GetTempFileNameW FindNextFileW GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW lstrlenW GetFileSizeEx RemoveDirectoryW GetFileAttributesW lstrcmpW DeviceIoControl lstrcmpA lstrcmpiA WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW CopyFileW SetUnhandledExceptionFilter SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetDiskFreeSpaceExW MoveFileW IsBadWritePtr TlsSetValue SetEndOfFile CancelWaitableTimer TlsAlloc TlsFree IsBadReadPtr GetProcessHeap QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA IsProcessorFeaturePresent GetThreadTimes CreateProcessW GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW CreateMutexW WaitForSingleObjectEx SleepEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetTempPathW FindFirstFileW CreateFileW GetCurrentDirectoryW ExpandEnvironmentStringsW TryEnterCriticalSection TlsGetValue GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache SignalObjectAndWait SetThreadPriority GetThreadPriority ChangeTimerQueueTimer GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle GetFullPathNameW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GetLocaleInfoW

user32

GetMessagePos CallWindowProcW SetWindowPos SetWindowTextW RegisterClassExW ShowWindow EnumDisplayDevicesW GetAsyncKeyState LoadCursorW KillTimer GetClassInfoExW wsprintfW SendMessageTimeoutW GetForegroundWindow GetClassNameW GetWindowTextW PostThreadMessageW MessageBoxW UnregisterClassW FindWindowExA GetDesktopWindow FindWindowA GetMonitorInfoW MonitorFromWindow EnumDisplaySettingsW GetWindowThreadProcessId FindWindowExW FindWindowW SetWindowLongW GetWindowLongW WindowFromPoint GetWindowRect ReleaseDC GetDC GetSystemMetrics SetTimer CreateWindowExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW GetKeyState IsWindow

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptAcquireContextA RegEnumKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptEncrypt CryptImportKey CryptGetHashParam CryptDestroyKey CryptReleaseContext

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW

shlwapi

SHGetValueW PathAppendW PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW PathFindFileNameA PathCombineW StrStrIW PathIsRootW SHSetValueW SHGetValueA PathGetDriveNumberW PathRemoveBackslashW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessImageFileNameW GetModuleFileNameExW

powrprof

CallNtPowerInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

netapi32

Netbios

wininet

HttpQueryInfoA InternetSetOptionW InternetConnectW InternetCloseHandle InternetGetLastResponseInfoW HttpSendRequestExW InternetReadFileExA InternetErrorDlg InternetOpenUrlW HttpAddRequestHeadersA HttpSendRequestW HttpAddRequestHeadersW InternetReadFile HttpEndRequestW InternetCrackUrlW HttpQueryInfoW FtpGetFileSize FtpCommandW HttpOpenRequestW InternetQueryOptionW InternetWriteFile InternetSetStatusCallbackW FtpOpenFileW InternetOpenW InternetSetOptionA

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=605, id=1, productName=Unmarked objects,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=112, id=260, version=27034,

count=45, id=265, version=27051,

count=1, id=261, version=35219,

count=3, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,