2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader
Size 1.2MB
Sample261102-k6ak2agw2x
SHA256 67acd31b840983b636a93a8b0eedee858c042ad0f8804084bfe6af103a096251
MD5 c590d4d8a9f2424174cf6a4f5731101b
SHA1 cea0fa28d489d6e9130e47a3b9f745cc92433cd6
SHA512 493778f6bb4f31d7dd2570666d644046a4e2e9799141d49f0ba9f8b44e886b602b5d7846f6a31059faf454ce894aee7a8a8c2af87dbffb5576954c0c564065d2
SSDEEP 24576:335T+4NEESKSn2tKzhn6HElm+RSqfFHGsKOuXGgyShuk1t1T3JbANPs:33PsP2tKV6HPsSqf5GsKLGgBukD7kNk
TLSH
T14555F150B972C433C12216304D75FBAA45AD7EB41F324AEBB3C81E6D5E315C26A35E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

.exe 1.2MB

2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

IMPHASH 4ac212615b53630ffc8a6cde58da6c98
SHA256 67acd31b840983b636a93a8b0eedee858c042ad0f8804084bfe6af103a096251
MD5 c590d4d8a9f2424174cf6a4f5731101b
SHA1 cea0fa28d489d6e9130e47a3b9f745cc92433cd6
SHA512 493778f6bb4f31d7dd2570666d644046a4e2e9799141d49f0ba9f8b44e886b602b5d7846f6a31059faf454ce894aee7a8a8c2af87dbffb5576954c0c564065d2
SSDEEP 24576:335T+4NEESKSn2tKzhn6HElm+RSqfFHGsKOuXGgyShuk1t1T3JbANPs:33PsP2tKV6HPsSqf5GsKLGgBukD7kNk
TLSH
T14555F150B972C433C12216304D75FBAA45AD7EB41F324AEBB3C81E6D5E315C26A35E3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\gitee\network_develop0\out\Release\NetworkDaemon.pdb

fwpuclnt

FwpmTransactionCommit0 FwpmFilterDestroyEnumHandle0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmCalloutGetByKey0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerAdd0 FwpmFilterEnum0 FwpmEngineClose0 FwpmTransactionAbort0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmTransactionBegin0 FwpmFilterCreateEnumHandle0

ws2_32

inet_ntoa

iphlpapi

DeleteUnicastIpAddressEntry GetUnicastIpAddressTable GetAdaptersInfo FreeMibTable

rasapi32

RasHangUpW RasEnumConnectionsW

kernel32

WriteFile GetStdHandle ExitProcess GetModuleHandleExW GetCommandLineA ExitThread GetCommandLineW GetFileSizeEx GetFileType HeapAlloc HeapFree SetEnvironmentVariableW RaiseException SetLastError UnmapViewOfFile CloseHandle ReadFile GetCurrentProcess TerminateProcess GetModuleFileNameW OpenProcess MultiByteToWideChar GetLastError Process32NextW Process32FirstW GetProcAddress GetModuleHandleW WideCharToMultiByte GetTickCount VirtualFree VirtualAlloc OpenFileMappingW GetCurrentProcessId MapViewOfFile CreateEventW FreeLibrary FindFirstFileExA FindNextFileA FindClose WaitForMultipleObjects SetEvent ResetEvent GetExitCodeProcess RtlUnwind LoadLibraryW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode FlushFileBuffers ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect GetVersionExW LoadLibraryExW GetModuleHandleA SetStdHandle HeapSize WriteConsoleW CreateToolhelp32Snapshot QueryPerformanceCounter CreateFileW FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread

advapi32

ReportEventW RegOpenKeyExW RegDeleteTreeW RegDeleteKeyW RegEnumKeyW DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW RegGetValueW RegCloseKey

rpcrt4

UuidEqual UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c590d4d8a9f2424174cf6a4f5731101b_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader

fwpuclnt

ws2_32

iphlpapi

rasapi32

kernel32

advapi32

rpcrt4

generic