General
- Target 2026-04-16_5a2b837ba45683f211beed01fe33fcd5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop
- Size 5.1MB
- Sample260416-qagmcsa13w
- SHA256 69548ffa4ba86774fa8db169196156843d1e0496738be79f0919074cd80afbef
- MD5 5a2b837ba45683f211beed01fe33fcd5
- SHA1 17bfd13042100c0cc236c27ef8ad5f4ecd4287f8
- SHA512 3fedfe921fc10364420e1b15cae516af250675c40a487daf17e529839944c1f2f91a2a9445cc2b943ea04b61b0816792fcb5d206f0094c0c09e4a63781eca626
- SSDEEP 98304:7UeCRPsNi9XwgwfoVsNi9XwgwfohjxAZWhv7StLjo:7vi9XwgwAwi9XwgwALvU/o
- TLSH T1E4467D12B3E08031E1B356309DB5B239A679BC305A36DA4F63949E8D7FF1AC19625733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_5a2b837ba45683f211beed01fe33fcd5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_5a2b837ba45683f211beed01fe33fcd5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-16_5a2b837ba45683f211beed01fe33fcd5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop
- Size 5.1MB
- SHA256 69548ffa4ba86774fa8db169196156843d1e0496738be79f0919074cd80afbef
- MD5 5a2b837ba45683f211beed01fe33fcd5
- SHA1 17bfd13042100c0cc236c27ef8ad5f4ecd4287f8
- SHA512 3fedfe921fc10364420e1b15cae516af250675c40a487daf17e529839944c1f2f91a2a9445cc2b943ea04b61b0816792fcb5d206f0094c0c09e4a63781eca626
- SSDEEP 98304:7UeCRPsNi9XwgwfoVsNi9XwgwfohjxAZWhv7StLjo:7vi9XwgwAwi9XwgwALvU/o
- TLSH T1E4467D12B3E08031E1B356309DB5B239A679BC305A36DA4F63949E8D7FF1AC19625733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory