d60574cece32b1eeedd82ce39230fb0e813d31948c1c2839782d47755e077e46

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.1MB
Sample260419-tfx33set7l
SHA256 d60574cece32b1eeedd82ce39230fb0e813d31948c1c2839782d47755e077e46
MD5 b42b2709223505a205fc9ca94617b439
SHA1 be8a3dae50c897ffdca7194f04a1213ea41100ed
SHA512 cedff0a1bfacba63ea7acacfcad3c0d168d057deb84baee6c1ae9db6cbbbd7fe145b6d2e57cf8c88be8a88c65e80c6476e276101223c3357bd312b62b569c2bf
SSDEEP 49152:L7YpdRmZ+xB26tQ0Rgdej4lfb2Z9tBvBxp2jEO8qBrN:wpdsoxB26pRgW4lfbmpB32jkw
TLSH
T100A5E00179D184B1E2330A315AACBAA091BCB53747B9E59FB3EC1E1D6E349C1B932357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3992	Logo1_.exe
3976	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\lv-lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\TagAlbumDefinitions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3976	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
3976	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
3976	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
3976	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe
3992	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1912	1820	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	80
PID 1820 wrote to memory of 3992	1820	2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	81
PID 3992 wrote to memory of 2220	3992	Logo1_.exe	83
PID 2220 wrote to memory of 2980	2220	net.exe	85
PID 1912 wrote to memory of 3976	1912	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD31F.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3976
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 3f7e3edccbe7e66bfa912d4e8f8c8555f842908971bf0ad214a8c74d37103e32
MD5 fa59390772d0f1b6bd038e5afb0318d6
SHA1 a6d97bddd6b00d7fef18181560b8311d0d7442f8
SHA512 7325ac5f864f74f15aa7e44edf1b488f5ba20eee479a9fe8de88ec2cfc152ad540748ef31f38454da09117e4df46ab49bb11bb43c34463390b80f553b75dd4e2
SSDEEP 3072:VftffjmNoxiYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:VVfjmNZYCk3ET+Tu3fCUzB+JHI
TLSH
T1B3C39D1335D08472E4B2593109A5ED718A3EFD620A54DE6B33D41B3E0F31AD1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 1449233962572ecd8129cfd298743500bbb9a5c7c898267b40f073aef35995a7
MD5 f81757b7fb790465ade51dfa51140120
SHA1 9e6094c0673d5543795b88aaf06bbd911f1f04e3
SHA512 6cad05a86c2b5ea50c0e70336bc842cfdc12c0286dd019b0e518a050963d2580f6fb93dd3d527c4277d0d18fe2ffdddbc75a359e6d50e189411aff53c2569523
SSDEEP 12288:L7+EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:L7F0Le5ji0hmxNrM
TLSH
T10AC41916F6748331D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aD31F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aD31F.bat
Size 914B
SHA256 d3154d356f7779c1e69b97d4fd810b649b9c579f2cb2f42d1088e721ac45e5fc
MD5 c7b39393604f7ee1a3db9d868bb876f3
SHA1 26b90c8933851850a91bdb5da2c28afba91f444b
SHA512 38f9bffab45bb8a0494e9b5afe35d422e09b3c5e81794d8ac3c7e1e51f9a3e62f7378ec1b744c66265fb8476edda27e45696a2abaf7029878217d01e9464a8ac
TLSH
T17A11A78701AFCDE91314A01B86652EDED24455DE36172756AB34DE1E70D01CD66F7601
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_b42b2709223505a205fc9ca94617b439_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
Size 2.1MB
SHA256 6edc79a68d42c09cf81a929c4a2820c116c8abbac8807a40ecd7155d0aec0028
MD5 853208b319a0c6072210cd62b4de27ee
SHA1 332230139903a979c5ad7add128ffca7ea0c56cf
SHA512 6a7eedaa72f08c17dd388bb608f81ab7b14128cd8c3a0a5ba2def556c0c1f53204004ee864cac6328886d4a59585429b091033f805899b3b890814ae780a0c2f
SSDEEP 49152:MpdRmZ+xB26tQ0Rgdej4lfb2Z9tBvBxp2jEO8qBrN:MpdsoxB26pRgW4lfbmpB32jkw
TLSH
T14FA5E00179D184B1E2330A315AACBAA091BCB53747B9E59FB3EC1E1D6E349C1B932357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 0d75046e4d26c6b1980c038a31742917431020c1887341757abd1def2eebde44
MD5 55512b0e64d152d5ed8b13198ae76371
SHA1 2d0f675016a492cbbafd3d998d83607a23365009
SHA512 7820ccd674248e34b8499d25c56adec290be75fd46fead853c44c36eae75872a82ddfcc23c3dfa90ba2fda7523093a389897343bf620854949947b44c058271f
SSDEEP 768:P1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:dfgLdQAQfcfymNG+Kx
TLSH
T196C2D0642AC4227CD8350579CEDE9E21436C0E6F42DE5425F0BE777EEA50FA8110E89F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
Size 9B
SHA256 d69b4dd6bcf240546c9346e3a5b155ba851969e32a14653797847dca95c2d058
MD5 847b8baad0088e557fd3ed40314c37e0
SHA1 bd181b4f4c5d10a1e097ca9cdd97caf84a2dd8b3
SHA512 7a30c42adef24bf25b10743e25b038584d76e5118bf58fc9bea54ab63f00e08432ec54556e5c13916bea5c917d2ffb41e974bbefea1ac673125feaaa9af198ac
MD5 SHA1 SHA512

Submit Download

memory/1820-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1820-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-272-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-1225-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-5006-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-5509-0x0000000000400000-0x0000000000434000-memory.dmp

Download