2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop
Size 3.1MB
Sample260415-rhvdvsbt71
SHA256 d9b99e5c481cd130bc8607ef2860c96411c4eb09a066ee1354da64a6ef701a45
MD5 8b5147983491a88a8aacecb073899442
SHA1 663565b0359d8fe4a4b18f7da19a5f2f48252b00
SHA512 304aba868910df1a474ff10b36890591d71715b72cb04a92b23fb19ff7c3324ec79ac5dddd125169c26f9f43d2cb3aab64c01e99f4e8a3830f541c9a4cb84c55
SSDEEP 49152:/rRokpdhKPgssSt2gi8xmN3Aek03noj45wlDTk:/rRok/hv7StYeUJF3noxDw
TLSH
T155E53A0366D4D232D5BA26707DF4D2625DE67DE04932895F33847FAE4876E80ABE1323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

.exe 3.1MB

2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 1ec127ea761dfdd549d649168a21dc6a
SHA256 d9b99e5c481cd130bc8607ef2860c96411c4eb09a066ee1354da64a6ef701a45
MD5 8b5147983491a88a8aacecb073899442
SHA1 663565b0359d8fe4a4b18f7da19a5f2f48252b00
SHA512 304aba868910df1a474ff10b36890591d71715b72cb04a92b23fb19ff7c3324ec79ac5dddd125169c26f9f43d2cb3aab64c01e99f4e8a3830f541c9a4cb84c55
SSDEEP 49152:/rRokpdhKPgssSt2gi8xmN3Aek03noj45wlDTk:/rRok/hv7StYeUJF3noxDw
TLSH
T155E53A0366D4D232D5BA26707DF4D2625DE67DE04932895F33847FAE4876E80ABE1323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

GetModuleFileNameExW

msi

ord70

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

kernel32

SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetVolumeInformationW GetFullPathNameW GetModuleFileNameW InterlockedDecrement FreeLibrary lstrlenA GetCurrentProcessId LeaveCriticalSection WriteFile EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetFileSizeEx GetFileTime GlobalFlags GetCurrentThreadId GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW HeapReAlloc RtlUnwind RaiseException SetStdHandle GetFileType HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA ReadFile LoadLibraryW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock WideCharToMultiByte DeleteFileW MoveFileW LocalAlloc FindClose lstrcmpW FindFirstFileW lstrcmpA SetFileAttributesW CreateFileW CopyFileW CreateThread LocalFree CloseHandle CreateToolhelp32Snapshot Process32NextW LockResource Process32FirstW GetLocalTime GetProcAddress SetLastError GetLongPathNameW GetLastError GetTempPathW lstrlenW MultiByteToWideChar GetFileAttributesW GetExitCodeProcess GetVersionExW FormatMessageW SizeofResource Sleep OpenProcess GetPrivateProfileStringW GetProcessHeap GetCurrentThread GetModuleHandleW WaitForSingleObject HeapFree GetCurrentProcess HeapAlloc CreateProcessW LoadResource FindResourceW TlsGetValue

user32

EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage DestroyMenu DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu CheckMenuItem SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow GetFocus ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId SendMessageW GetParent MessageBoxW GetForegroundWindow SetWindowTextW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow GetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW FindWindowW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetTopWindow GetSubMenu GetMenuItemCount UnhookWindowsHookEx CharUpperW GetSystemMetrics GetMenuState GetMenuItemID

advapi32

IsValidSid CryptHashData ConvertSidToStringSidW CryptDestroyHash CryptCreateHash GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW CryptReleaseContext CryptAcquireContextW CryptGetHashParam RegSetValueExW RegCloseKey CheckTokenMembership GetLengthSid InitializeSid GetSidLengthRequired RegOpenKeyExW RegEnumValueW RegDeleteValueW DuplicateTokenEx LookupAccountSidW RegQueryInfoKeyW DuplicateToken CreateProcessAsUserW RegQueryValueExW RegCreateKeyExW CopySid GetTokenInformation RegCreateKeyW OpenThreadToken GetSidSubAuthority OpenProcessToken

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

shlwapi

PathIsUNCW PathFindFileNameW PathStripToRootW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

gdi32

SetViewportExtEx GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetWindowExtEx RestoreDC SaveDC SetMapMode GetClipBox SetTextColor SetBkColor DeleteObject GetDeviceCaps OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible ScaleViewportExtEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

comdlg32

GetFileTitleW

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_8b5147983491a88a8aacecb073899442_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

psapi

msi

userenv

kernel32

user32

advapi32

shell32

ole32

shlwapi

crypt32

wintrust

oleacc

gdi32

winspool.drv

comdlg32

oleaut32

generic