2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 1.2MB
Sample261102-psl45acs7m
SHA256 2e4807ecf9dbca729876f7affb13a760883261bc1f97bea8b1d313b9b4e9faa7
MD5 a705bda90273ebb7f66c7a7a4f3b230f
SHA1 af027a9f2350f784448e0195a4f1368d2aa7c71a
SHA512 02c0656efac81ea3fb39ecd4a38d07e5279d8aaf873300c34b2469b3149203fc3093c9e116c0eb673e5c0470a8fda7a5135de25dce7a1ce3f4cd0511f4e59a59
SSDEEP 24576:4kezHNvcXAFnBW8rSoLJxBPeh5IwFieFT3u3kFskY/X65KFg0pzC8kK:2Fj7XrSIJbPeciif3hf65K20hrX
TLSH
T1EE4502103B41E4F6F27206310FE4DAA515EE7DA01E245ADB27E876AD4E305C1EA32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 1.2MB

2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH b8dcce26ab77a335796577948ea6c0ba
SHA256 2e4807ecf9dbca729876f7affb13a760883261bc1f97bea8b1d313b9b4e9faa7
MD5 a705bda90273ebb7f66c7a7a4f3b230f
SHA1 af027a9f2350f784448e0195a4f1368d2aa7c71a
SHA512 02c0656efac81ea3fb39ecd4a38d07e5279d8aaf873300c34b2469b3149203fc3093c9e116c0eb673e5c0470a8fda7a5135de25dce7a1ce3f4cd0511f4e59a59
SSDEEP 24576:4kezHNvcXAFnBW8rSoLJxBPeh5IwFieFT3u3kFskY/X65KFg0pzC8kK:2Fj7XrSIJbPeciif3hf65K20hrX
TLSH
T1EE4502103B41E4F6F27206310FE4DAA515EE7DA01E245ADB27E876AD4E305C1EA32F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetCurrentProcess WaitForSingleObject LoadLibraryW GetModuleHandleW GetUserDefaultLangID OutputDebugStringA WriteConsoleW GetTickCount SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetProcessHeap SetStdHandle Sleep MoveFileExW CopyFileW GetTempPathW GetCommandLineW CreateProcessW GetModuleFileNameW CloseHandle GetLastError HeapSize GetLongPathNameW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection FormatMessageW WideCharToMultiByte CreateFileW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW SetLastError MultiByteToWideChar GetStringTypeW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind RaiseException ExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA ExitProcess GetACP HeapAlloc HeapFree GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

user32

SendMessageW MessageBoxW EndDialog DialogBoxParamW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

QueryServiceStatusEx OpenServiceW DeleteService ControlService RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegCloseKey OpenSCManagerW CloseServiceHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_a705bda90273ebb7f66c7a7a4f3b230f_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos_smoke-loader

kernel32

user32

shell32

ole32

advapi32

generic