2026-11-09_80e2e374e45cb2df1bfb4495e9d8d908_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_80e2e374e45cb2df1bfb4495e9d8d908_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader
Size 17.6MB
Sample261110-rt6ahaax7j
SHA256 466c05aaa5b20af73a67a0169628cc199a7590b6ecd325e9e204b90d8fe9654f
MD5 80e2e374e45cb2df1bfb4495e9d8d908
SHA1 531b966ac22de412fd4a2efd7f7d16fa1fc49666
SHA512 4db849b3a74542aed75ee5c6802518412a58c4553610aa083b59818adba7324dca6d4b26669d17734880803371dc8659e92cb10aceea80d733055573501275db
SSDEEP 393216:ayJzRNhCmUSIuEeoMT1Si8o5qhYI8413s9RQwx2lsVX9BfmqkX4uWxN:dJtCpSIupgdRhi/Q/lsVX9BfmqC4uWxN
TLSH
T107072322B5D18431C23342325D18B6AB9CBDBDB01B7491DB73E9362D5A704D2BA7B393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-09_80e2e374e45cb2df1bfb4495e9d8d908_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

.exe 17.6MB

2026-11-09_80e2e374e45cb2df1bfb4495e9d8d908_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

IMPHASH 321fdba5a9ca1bd2e86be2624bd37432
SHA256 466c05aaa5b20af73a67a0169628cc199a7590b6ecd325e9e204b90d8fe9654f
MD5 80e2e374e45cb2df1bfb4495e9d8d908
SHA1 531b966ac22de412fd4a2efd7f7d16fa1fc49666
SHA512 4db849b3a74542aed75ee5c6802518412a58c4553610aa083b59818adba7324dca6d4b26669d17734880803371dc8659e92cb10aceea80d733055573501275db
SSDEEP 393216:ayJzRNhCmUSIuEeoMT1Si8o5qhYI8413s9RQwx2lsVX9BfmqkX4uWxN:dJtCpSIupgdRhi/Q/lsVX9BfmqC4uWxN
TLSH
T107072322B5D18431C23342325D18B6AB9CBDBDB01B7491DB73E9362D5A704D2BA7B393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

40:c5:bb:b8:2e:d4:59:77:19:cf:5f:47:06:fe:4c:b4:58:eb:e0:7a:34:c3:0b:e9:41:9a:1e:22:1c:26:c3:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Chains

Mar 9, 2021

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ba:74:b7:ac:bf:25:56:67:51:71:f2:f6:99:58:2d:c3:e6:4d:70:ee

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Chains

Mar 9, 2021

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Serial Number

01:bc:40:60:04:8d:7a:68:63:4c:89:bb:68:b8:99:63

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 20, 2019 - Dec 23, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=北京布丁跑跑科技有限公司,OU=IT研发部,O=北京布丁跑跑科技有限公司,ST=北京市,C=CN

Serial Number

05:29:eb:a4:d9:8a:b8:39:3a:22:78:29:ba:46:50:81

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 20, 2019 - Dec 23, 2022

Minor OS version

Major OS version

Entry point

170006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW WriteFile SizeofResource LoadResource LockResource SetCurrentDirectoryW MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleHandleW GetLastError GetCurrentProcessId GetCurrentDirectoryW FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime GetDriveTypeW ExpandEnvironmentStringsW GetTempPathW WaitForMultipleObjects GetSystemDirectoryA SleepEx ResetEvent SetEvent lstrlenA CreateFileMappingW UnmapViewOfFile MapViewOfFile GetFileSizeEx GetFileInformationByHandle InterlockedCompareExchange CreateEventW LocalFree LocalAlloc WideCharToMultiByte OutputDebugStringA Sleep InterlockedDecrement InterlockedIncrement CreateFileW WritePrivateProfileStringW DeleteFileW GlobalAlloc GlobalLock GlobalUnlock PeekNamedPipe MultiByteToWideChar GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalFree GetExitCodeProcess WaitForSingleObject CreateProcessW DecodePointer HeapDestroy HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemInfo FormatMessageW GetVersionExW GetPrivateProfileStringW FindClose CreateDirectoryW FindFirstFileW FindNextFileW MoveFileExW FileTimeToSystemTime ReleaseMutex CreateMutexW GetTickCount AreFileApisANSI FlushInstructionCache HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FreeResource GetFullPathNameW GetLocalTime GetVersionExA GetSystemTime GetModuleHandleA RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetStringTypeW CompareStringW LCMapStringW GetFileType GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA OutputDebugStringW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetTimeZoneInformation FlushFileBuffers WriteConsoleW SetEndOfFile ReadFile GetFileSize CreateThread QueryDosDeviceW GetWindowsDirectoryW LoadLibraryW GetLogicalDriveStringsW lstrcmpiW CloseHandle OpenProcess LoadLibraryA lstrlenW SetLastError GetProcessHeap HeapFree HeapAlloc VirtualFree VirtualAlloc GetProcAddress IsProcessorFeaturePresent FreeLibrary

user32

GetCursorPos ScreenToClient GetClassNameW DestroyIcon LoadBitmapW CreateIconFromResource LoadImageW CharNextW GetMessageW TranslateMessage DispatchMessageW PeekMessageW ClientToScreen SetRect EnableMenuItem GetSysColor SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetSystemMetrics IsWindowVisible DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow IsMenu IsWindowEnabled CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetMenuContextHelpId InvalidateRect GetWindowRect GetClientRect GetActiveWindow GetDlgItem CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetWindowLongW GetFocus SetFocus PtInRect EqualRect IsRectEmpty UnionRect CopyRect SetCursor KillTimer SetTimer DestroyWindow DestroyCursor LoadCursorW IntersectRect LoadStringW GetKeyState UnregisterClassW GetIconInfo DrawIconEx OffsetRect InflateRect ReleaseDC GetDC SendMessageW ShowWindow SetWindowPos SetWindowTextW IsWindow EndPaint BeginPaint UpdateWindow ReleaseCapture SetForegroundWindow FindWindowW SetCapture GetCapture IsZoomed IsIconic SetLayeredWindowAttributes AnimateWindow PostQuitMessage PostMessageW TrackMouseEvent MonitorFromWindow GetMonitorInfoW GetWindow GetParent SetWindowLongW SystemParametersInfoW MapWindowPoints

advapi32

RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW ImpersonateLoggedOnUser RevertToSelf DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW SetSecurityDescriptorDacl OpenProcessToken GetTokenInformation SetTokenInformation InitializeSecurityDescriptor

shell32

SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderPathW SHBrowseForFolderW ShellExecuteW

ole32

OleLockRunning CLSIDFromString CoCreateGuid CLSIDFromProgID CreateBindCtx OleInitialize OleUninitialize CreateStreamOnHGlobal CoCreateInstance

shlwapi

PathFileExistsW StrToIntExW

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

crypt32

CryptMsgClose CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgGetParam

gdiplus

GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipGetImageEncoders GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipBitmapLockBits GdipCreateBitmapFromFile GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile

imm32

ImmAssociateContext ImmGetContext ImmDestroyContext ImmCreateContext ImmReleaseContext

gdi32

GetStockObject Rectangle SetViewportOrgEx GetObjectW CreateFontIndirectW SetBkMode GetViewportOrgEx StretchBlt CreateSolidBrush GetCurrentObject EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor DeleteDC DeleteObject ExtCreateRegion IntersectClipRect SelectClipRgn SelectObject SetGraphicsMode SetWorldTransform GetDeviceCaps CreateBitmap EnumFontsW BitBlt CreateDIBSection CreateCompatibleDC GdiFlush GetTextFaceW ExtTextOutW GetTextMetricsW SetTextAlign

oleaut32

SysAllocString SysFreeString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ws2_32

ntohs setsockopt WSASetLastError htonl inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport htons __WSAFDIsSet select recvfrom sendto accept listen ioctlsocket gethostname getsockopt getsockname getpeername connect recv bind socket closesocket WSAGetLastError send getservbyname WSAStartup WSACleanup

usp10

ScriptShape ScriptFreeCache ScriptItemize

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

470KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15.0MB

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=23013,

count=37, id=241, version=40116,

count=199, id=243, version=40116,

count=39, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=199, version=41118,

count=27, id=259, version=24123,

count=87, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=453, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=65, id=261, version=24123,

count=39, id=260, version=24123,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=470, id=1, productName=Unmarked objects,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,