d60574cece32b1eeedd82ce39230fb0e813d31948c1c2839782d47755e077e46

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.1MB
Sample260419-tfx33set7l
SHA256 d60574cece32b1eeedd82ce39230fb0e813d31948c1c2839782d47755e077e46
MD5 b42b2709223505a205fc9ca94617b439
SHA1 be8a3dae50c897ffdca7194f04a1213ea41100ed
SHA512 cedff0a1bfacba63ea7acacfcad3c0d168d057deb84baee6c1ae9db6cbbbd7fe145b6d2e57cf8c88be8a88c65e80c6476e276101223c3357bd312b62b569c2bf
SSDEEP 49152:L7YpdRmZ+xB26tQ0Rgdej4lfb2Z9tBvBxp2jEO8qBrN:wpdsoxB26pRgW4lfbmpB32jkw
TLSH
T100A5E00179D184B1E2330A315AACBAA091BCB53747B9E59FB3EC1E1D6E349C1B932357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
792	Logo1_.exe
1244	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
1244	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1244	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1244	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1244	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe
792	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 2444	5496	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	86
PID 5496 wrote to memory of 792	5496	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	87
PID 792 wrote to memory of 4812	792	Logo1_.exe	88
PID 4812 wrote to memory of 1648	4812	net.exe	91
PID 2444 wrote to memory of 1244	2444	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1047.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1244
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 bd80253fc82bb1acf327fca0083577d7e48bb3626836f2859d7fff216fb53f6b
MD5 982c8ef8f261523807a4375e4e781674
SHA1 2b8de449b8d955d22c20b0481170aae11bdf7d3b
SHA512 b8b8905e5cac6c97264b70cb156d2c51b3bf69e37a6b74341ae25f066dda7fc640e3b7bfe67938477a0c88100f31c103c4b058b7a1737aaabc1a5bafd1df0261
SSDEEP 3072:VftffjmNox6YCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:VVfjmNNYCk3ET+Tu3fC0zB+JHv
TLSH
T197C39D1335D084B2E4B2593109A5ED718A3EFD620A54DE6B33D41B3E0F31AD1DE2AD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 1449233962572ecd8129cfd298743500bbb9a5c7c898267b40f073aef35995a7
MD5 f81757b7fb790465ade51dfa51140120
SHA1 9e6094c0673d5543795b88aaf06bbd911f1f04e3
SHA512 6cad05a86c2b5ea50c0e70336bc842cfdc12c0286dd019b0e518a050963d2580f6fb93dd3d527c4277d0d18fe2ffdddbc75a359e6d50e189411aff53c2569523
SSDEEP 12288:L7+EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:L7F0Le5ji0hmxNrM
TLSH
T10AC41916F6748331D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1047.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1047.bat
Size 914B
SHA256 dc8e694bc4789726e2cca24a7b1a1c9840cf58a7d0b65bd87ab379db5f72f752
MD5 faa30b53f3227176b5eddf9c965c24fd
SHA1 d2bd17b65f34d957455db4eda3db1d3bf1d0eb4f
SHA512 7a205f51ba34a50d9c8984958daea11e60111dfbc13a53237e4917520705b32a91231f4f2e7cddb7c25291b8dfdc8740993875fa38873ff9049955795294a2b2
TLSH
T12211CA8B01AFCDF91314A01B87652EDED24455DF36172756BB34DE1E60D01CDA6F7602
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
Size 2.1MB
SHA256 6edc79a68d42c09cf81a929c4a2820c116c8abbac8807a40ecd7155d0aec0028
MD5 853208b319a0c6072210cd62b4de27ee
SHA1 332230139903a979c5ad7add128ffca7ea0c56cf
SHA512 6a7eedaa72f08c17dd388bb608f81ab7b14128cd8c3a0a5ba2def556c0c1f53204004ee864cac6328886d4a59585429b091033f805899b3b890814ae780a0c2f
SSDEEP 49152:MpdRmZ+xB26tQ0Rgdej4lfb2Z9tBvBxp2jEO8qBrN:MpdsoxB26pRgW4lfbmpB32jkw
TLSH
T14FA5E00179D184B1E2330A315AACBAA091BCB53747B9E59FB3EC1E1D6E349C1B932357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 0d75046e4d26c6b1980c038a31742917431020c1887341757abd1def2eebde44
MD5 55512b0e64d152d5ed8b13198ae76371
SHA1 2d0f675016a492cbbafd3d998d83607a23365009
SHA512 7820ccd674248e34b8499d25c56adec290be75fd46fead853c44c36eae75872a82ddfcc23c3dfa90ba2fda7523093a389897343bf620854949947b44c058271f
SSDEEP 768:P1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:dfgLdQAQfcfymNG+Kx
TLSH
T196C2D0642AC4227CD8350579CEDE9E21436C0E6F42DE5425F0BE777EEA50FA8110E89F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-914486190-3969805341-592249730-1000\_desktop.ini
Size 9B
SHA256 d69b4dd6bcf240546c9346e3a5b155ba851969e32a14653797847dca95c2d058
MD5 847b8baad0088e557fd3ed40314c37e0
SHA1 bd181b4f4c5d10a1e097ca9cdd97caf84a2dd8b3
SHA512 7a30c42adef24bf25b10743e25b038584d76e5118bf58fc9bea54ab63f00e08432ec54556e5c13916bea5c917d2ffb41e974bbefea1ac673125feaaa9af198ac
MD5 SHA1 SHA512

Submit Download

memory/792-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-493-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-1290-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-5079-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/792-5592-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1244-20-0x0000000001520000-0x0000000001603000-memory.dmp

Download

memory/5496-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5496-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download