2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos
Size 6.0MB
Sample261102-hdw78att4m
SHA256 e196573596f2cc07fe1d2212df4a29eb06a5953da8fa18ea6195d192d8a3bd92
MD5 db7c85d9ca8c384e890e0b9b4e23e3c3
SHA1 2c3ba438fbe678349aeda260fd7eb7de1146d859
SHA512 1467c7dd5bb427ff5494bbf79940e779285a5dfda87780e73a9c7b83d806fc90535b4c842fe4639d4f0645f698312aaf48c1e0636cf0f290a1599c88ef886c21
SSDEEP 98304:7QJ3vTff345bUfONDm0RuSXj+fA69PRvO4WnYEiRSh7NlqZwgzuQHqGG0YAA4vz/:7uTfw5bUfONrwlRSh7NlqZwvQHvYAR
TLSH
T1F6568D323906C57BEA8105B14D7CEEAF559C9A250F6614D393CC2F2EDAB81C32B31967
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

.exe 6.0MB

2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 1272cb0868d40dde91181f648ffbd630
SHA256 e196573596f2cc07fe1d2212df4a29eb06a5953da8fa18ea6195d192d8a3bd92
MD5 db7c85d9ca8c384e890e0b9b4e23e3c3
SHA1 2c3ba438fbe678349aeda260fd7eb7de1146d859
SHA512 1467c7dd5bb427ff5494bbf79940e779285a5dfda87780e73a9c7b83d806fc90535b4c842fe4639d4f0645f698312aaf48c1e0636cf0f290a1599c88ef886c21
SSDEEP 98304:7QJ3vTff345bUfONDm0RuSXj+fA69PRvO4WnYEiRSh7NlqZwgzuQHqGG0YAA4vz/:7uTfw5bUfONrwlRSh7NlqZwvQHvYAR
TLSH
T1F6568D323906C57BEA8105B14D7CEEAF559C9A250F6614D393CC2F2EDAB81C32B31967
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3335083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Sources\Futuristic City\Futuristic City 3D Settings\Release\Futuristic City 3D Screensaver.pdb

d3d9

Direct3DCreate9

kernel32

LoadLibraryA GlobalAlloc GlobalLock lstrcmpiA lstrcpyA FindResourceA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA IsDBCSLeadByte GetGeoInfoA GetUserGeoID GetUserDefaultUILanguage QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes FlushFileBuffers GetTimeZoneInformation SetConsoleCtrlHandler GetFileSizeEx HeapQueryInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW IsThreadAFiber SizeofResource FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapSize SetFilePointerEx ReadConsoleW GetConsoleMode WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess SystemTimeToTzSpecificLocalTime GetCurrentThreadId GetFileType GetFileInformationByHandle GetDriveTypeW CreateFileW VirtualQuery LoadResource GetSystemInfo ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind InterlockedFlushSList GetCurrentProcessId FlsFree LockResource LoadLibraryExA GetProcAddress GetModuleHandleA WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RaiseException GetModuleFileNameA GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable CreateProcessW GetExitCodeProcess DeleteFileW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTime FileTimeToSystemTime SystemTimeToFileTime CloseHandle DecodePointer Sleep CreateDirectoryA OutputDebugStringA MoveFileA DeleteFileA EnumResourceTypesA FreeResource FreeLibrary EnumResourceNamesA FindClose FindNextFileA FindFirstFileA GetFileAttributesA GetCurrentDirectoryA GetFullPathNameA GetLocalTime LoadLibraryW lstrcmpA lstrlenA GetSystemDirectoryA VirtualFree VirtualProtect CreateProcessA GetCommandLineA GetFileAttributesExW PeekNamedPipe MoveFileExW VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList GetConsoleOutputCP InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree HeapAlloc OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx DebugBreak InitializeCriticalSection WriteConsoleW SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetStringTypeW SetCurrentDirectoryW CreateSymbolicLinkW GetFileInformationByHandleEx GetModuleHandleW CloseThreadpoolWait SetThreadpoolWait ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA LocalFree GetLocaleInfoEx EncodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait

user32

SetCursorPos ShowCursor SetTimer GetForegroundWindow DispatchMessageA PeekMessageA GetKeyState PostMessageA DefWindowProcA PostQuitMessage CallWindowProcA UnregisterClassA RegisterClassExA GetClassInfoExA CreateWindowExA EnumWindows FindWindowA EnumChildWindows GetParent GetClassNameA GetWindow GetTopWindow GetWindowTextA TranslateMessage GetMessageA RegisterWindowMessageA wsprintfA GetWindowRect SendMessageA GetMonitorInfoA DestroyWindow GetCursorPos MonitorFromRect EnumDisplayDevicesA EnumDisplaySettingsA DestroyIcon LoadIconA LoadCursorA SetWindowLongA GetWindowLongA MessageBoxA AdjustWindowRect GetClientRect SetWindowTextA EndPaint BeginPaint ReleaseDC GetDC GetSystemMetrics EnableWindow GetActiveWindow CharNextA IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard GetDlgItem EndDialog DialogBoxParamA ShowWindow

gdi32

GetDeviceCaps

comdlg32

CommDlgExtendedError GetOpenFileNameA

advapi32

RegFlushKey RegEnumKeyA RegEnumValueA RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey RegQueryInfoKeyA

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal CoTaskMemFree CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SysAllocStringLen CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit VarUI4FromStr SysAllocString SysFreeString VariantClear OleLoadPicture

comctl32

InitCommonControlsEx

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

urlmon

ObtainUserAgentString

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetSetStatusCallback InternetCloseHandle InternetOpenA

dinput8

DirectInput8Create

d3dx9_43

D3DXOptimizeVertices D3DXOptimizeFaces D3DXVec3TransformNormal D3DXAssembleShader D3DXCompileShader D3DXMatrixRotationZ D3DXLoadSurfaceFromFileInMemory D3DXMatrixTransformation D3DXGetFVFVertexSize D3DXMatrixRotationY D3DXMatrixRotationAxis D3DXMatrixTranslation D3DXMatrixRotationX D3DXVec3TransformCoord D3DXMatrixOrthoLH D3DXMatrixReflect D3DXMatrixLookAtLH D3DXMatrixScaling D3DXSaveSurfaceToFileA D3DXPlaneTransform D3DXCreateCubeTextureFromFileInMemory D3DXCreateTextureFromResourceA D3DXCreateTextureFromResourceExA D3DXCreateTextureFromFileA D3DXCreateTextureFromFileExA D3DXPlaneFromPoints D3DXCreateTextureFromFileInMemoryEx D3DXCreateCubeTexture D3DXCreateTexture D3DXMatrixPerspectiveFovLH D3DXVec3Normalize D3DXMatrixInverse D3DXMatrixTranspose D3DXVec3Transform D3DXMatrixMultiply D3DXCreateTextureFromFileInMemory

winmm

timeGetDevCaps timeGetTime timeBeginPeriod timeEndPeriod

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

895KB

Virtual Size

895KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_db7c85d9ca8c384e890e0b9b4e23e3c3_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos

d3d9

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

urlmon

wininet

dinput8

d3dx9_43

winmm

generic