strela | 2026-03-17_013071f5c89396af002cb7ef79302700_amadey_darkgate_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-17_013071f5c89396af002cb7ef79302700_amadey_darkgate_elex_remcos_smoke-loader
Size 840KB
Sample260317-slecgsev5p
SHA256 6685ec671819824da75b1573733f1392d346ee225b90497c39287308801ae35f
MD5 013071f5c89396af002cb7ef79302700
SHA1 48e7b654968a4de44cd5587101c8cdc698f65928
SHA512 576669ca6c9f0c5efef97cff47d93230d7000167acf781c8a72f3894be0f89bf0e35f4bc8e0a834bd7dfb43d926a58dbf0881d15ad98ca930f4ee860fe7da537
SSDEEP 12288:ISvE/gg9lK9kdI9iTZCzzLH5vyEAzIze7WfIzOy5IRQ2CzlaqmHJQRP7BVbp9:tTom5yE7ze7CU5AQ2Czl0QbX
TLSH
T16605AE2276D1D036C17322318BA9B73259BFFD305961650BA7D84B2D2EB0BE19E3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

strela

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
sample	family_strela

Strela family
strela

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-17_013071f5c89396af002cb7ef79302700_amadey_darkgate_elex_remcos_smoke-loader

File Explorer

2026-03-17_013071f5c89396af002cb7ef79302700_amadey_darkgate_elex_remcos_smoke-loader

.exe 840KB

2026-03-17_013071f5c89396af002cb7ef79302700_amadey_darkgate_elex_remcos_smoke-loader

IMPHASH c1b0b2109beac1f4d7970aa213c0cd79
SHA256 6685ec671819824da75b1573733f1392d346ee225b90497c39287308801ae35f
MD5 013071f5c89396af002cb7ef79302700
SHA1 48e7b654968a4de44cd5587101c8cdc698f65928
SHA512 576669ca6c9f0c5efef97cff47d93230d7000167acf781c8a72f3894be0f89bf0e35f4bc8e0a834bd7dfb43d926a58dbf0881d15ad98ca930f4ee860fe7da537
SSDEEP 12288:ISvE/gg9lK9kdI9iTZCzzLH5vyEAzIze7WfIzOy5IRQ2CzlaqmHJQRP7BVbp9:tTom5yE7ze7CU5AQ2Czl0QbX
TLSH
T16605AE2276D1D036C17322318BA9B73259BFFD305961650BA7D84B2D2EB0BE19E3534B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Strela Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

342891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\4773\source\Running\Release_Static\Update.pdb

user32

IsWindowVisible SetMenuDefaultItem GetSysColor CharNextW ClientToScreen InvalidateRgn RedrawWindow SetCapture IsChild GetDlgItem SetForegroundWindow TrackPopupMenu SetWindowContextHelpId SendDlgItemMessageW CreateWindowExW EndDialog MapDialogRect GetSubMenu LoadMenuW LoadImageW SetPropW LoadIconW MoveWindow GetCursorPos GetClassNameW GetParent ReleaseCapture DestroyWindow GetDesktopWindow DestroyAcceleratorTable SetFocus GetFocus IsWindow GetClassInfoExW LoadCursorW RegisterClassExW CreateAcceleratorTableW GetWindowTextW GetWindowTextLengthW RegisterWindowMessageW CopyRect GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints SetWindowPos KillTimer SetTimer ShowWindow EndPaint BeginPaint ScreenToClient GetClientRect UnregisterClassA SetWindowTextW SendMessageW DestroyMenu ModifyMenuW IsMenu PostQuitMessage GetWindowRect PostMessageW CallWindowProcW GetWindowLongW SetWindowLongW DefWindowProcW GetDC ReleaseDC FillRect GetWindowRgn AllowSetForegroundWindow SystemParametersInfoW AttachThreadInput GetWindowThreadProcessId GetForegroundWindow SetActiveWindow IsIconic GetPropW TrackMouseEvent DialogBoxParamW IsRectEmpty InvalidateRect GetActiveWindow CreateDialogIndirectParamW DispatchMessageW TranslateMessage GetMessageW UpdateWindow wsprintfW RemovePropW

kernel32

SetFilePointerEx LocalFree LocalAlloc ReleaseMutex HeapDestroy HeapAlloc FindClose FindNextFileW FindFirstFileW MultiByteToWideChar FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesW SetLastError lstrlenW FreeLibrary LoadLibraryW TlsAlloc InitializeCriticalSection GetLocalTime TerminateThread GetExitCodeThread FlushFileBuffers SetFilePointer GetCurrentThreadId TlsGetValue WideCharToMultiByte GetCurrentProcessId GetModuleFileNameW lstrlenA TlsSetValue TlsFree GetFileTime GetPrivateProfileStringW HeapFree SetFileAttributesW WritePrivateProfileStringW HeapReAlloc HeapSize GetProcessHeap InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree InterlockedPopEntrySList EncodePointer DecodePointer RtlUnwind ExitThread CreateThread GetFullPathNameW GetSystemTimeAsFileTime GetTimeFormatW GetDateFormatW GetCommandLineW HeapSetInformation GetStartupInfoW LCMapStringW FreeResource GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess lstrcpynW DeleteFileW GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetStringTypeW GetTimeZoneInformation HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW CopyFileW FindResourceExW FindResourceW LoadResource FlushInstructionCache GetCurrentProcess LockResource SizeofResource WriteFile GlobalLock GlobalUnlock MulDiv lstrcmpW GlobalFree CreateEventW ResumeThread GlobalAlloc GetFileSize SetHandleCount GetFileType QueryPerformanceCounter InterlockedIncrement InterlockedDecrement CompareStringW FatalAppExitA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetConsoleCtrlHandler Sleep CreateMutexW GetConsoleCP GetConsoleMode GetCurrentDirectoryW SetCurrentDirectoryW GetDriveTypeW ReadFile GetModuleHandleW GetProcAddress GetFullPathNameA SetStdHandle DisableThreadLibraryCalls GetPrivateProfileIntW CreateFileW DeleteCriticalSection SetEnvironmentVariableA SuspendThread SetThreadContext GetThreadContext InitializeCriticalSectionAndSpinCount GetLastError LeaveCriticalSection EnterCriticalSection lstrcmpiW RaiseException GetSystemDirectoryW LoadLibraryExW GlobalHandle VirtualAlloc VirtualProtect VirtualQuery GetCurrentThread CreateFileA OutputDebugStringW SetEndOfFile GetExitCodeProcess IsBadReadPtr lstrcatW WaitForMultipleObjects SetEvent WaitForSingleObject RemoveDirectoryW GetTickCount CreateDirectoryW OpenProcess GetVolumeInformationW GetLongPathNameW GetTempPathW TerminateProcess GetVersion CloseHandle ResetEvent QueryDosDeviceW GetLogicalDriveStringsW InterlockedCompareExchange InterlockedExchange SwitchToThread WriteConsoleW GetStdHandle

advapi32

RegCloseKey RegQueryValueExW OpenProcessToken GetTokenInformation GetUserNameW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

ws2_32

gethostbyname htons htonl ntohl ntohs

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpOpen WinHttpSetOption WinHttpConnect WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest

wininet

InternetOpenW InternetCloseHandle InternetGetConnectedState

gdi32

CreateRectRgn CreateDIBSection DeleteObject CreateSolidBrush SelectObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC StretchBlt SetStretchBltMode BitBlt GetDeviceCaps EnumFontFamiliesExW CreateDCW GetObjectW GetStockObject PtInRegion

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW Shell_NotifyIconW SHFileOperationW CommandLineToArgvW

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc OleInitialize CoGetClassObject CoTaskMemFree CoTaskMemRealloc CoUninitialize CoInitialize CoCreateGuid OleLockRunning StringFromGUID2 OleUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocStringLen SysFreeString VariantInit VariantClear OleCreateFontIndirect SysAllocString SysStringLen VariantTimeToSystemTime LoadRegTypeLi LoadTypeLi VarUI4FromStr SystemTimeToVariantTime VarUdateFromDate OleLoadPicture

gdiplus

GdipAddPathEllipseI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipFillRegion GdipSetSmoothingMode GdipSetInterpolationMode GdipCreateSolidFill GdipSetImageAttributesWrapMode GdipSetImageAttributesColorMatrix GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipLoadImageFromStreamICM GdipDrawString GdipDeleteFont GdipSetTextRenderingHint GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeleteRegion GdipDeleteGraphics GdipTranslatePathGradientTransform GdipSetPathGradientCenterPointI GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientCenterColor GdipDeletePath GdipCreatePath GdipDeleteStringFormat GdipCreateStringFormat GdipFree GdipDeleteBrush GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipCreatePathGradientFromPath GdipCreateFont GdipCreateFromHDC GdipDrawImageRectRectI GdipCreateRegionRectI GdipCloneBrush GdipCloneImage GdipSetClipRectI GdipSetClipRegion GdipGetClip GdipCreateRegion GdiplusShutdown GdiplusStartup GdipDrawLineI GdipSetStringFormatTrimming GdipDeletePen GdipCreatePen1 GdipCreateTexture2I GdipLoadImageFromStream GdipTranslateTextureTransform

shlwapi

PathAppendW PathFindExtensionW PathRemoveBackslashW PathFindFileNameW PathRemoveFileSpecW UrlUnescapeW wnsprintfW PathFileExistsW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

psapi

EnumProcesses GetProcessImageFileNameW GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

rpcrt4

UuidCreateSequential RpcStringFreeA UuidToStringA

imagehlp

UnMapAndLoad MapAndLoad