2026-04-22_74c295956128496f7447cc3b120eaa2f_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-22_74c295956128496f7447cc3b120eaa2f_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 1.7MB
Sample260422-seysjsdv8v
SHA256 387e584be39afefb68dc38ef2c5aa7737cf71da7e16ab9abae1979c2f8f84412
MD5 74c295956128496f7447cc3b120eaa2f
SHA1 9e3665e1a1cef7dfef2c98425d704905f076cc12
SHA512 6c6f430193174ac71a4832b3133e36f04262eaeb39b47c08e42fe0d4c8f5f1efc0c8b433115ae6a81599845c9a63e7bd3844a18c0a7f01a6a32f6653c2f7163a
SSDEEP 24576:3p1I/wY4Gv3vF1EYj4Q9uCXSn6MaiSVAz0ZOd5VJVt:3I/b4Gvt1EYjhuQMaiSVAd5b
TLSH
T14A8539E37202C372D58E8CB18D5CD6B5853D9D247B6E00D3A3D8BB5B6A314C23776A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-04-22_74c295956128496f7447cc3b120eaa2f_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 1.7MB

2026-04-22_74c295956128496f7447cc3b120eaa2f_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH a5e039dba0858bd55ca75f65dc889869
SHA256 387e584be39afefb68dc38ef2c5aa7737cf71da7e16ab9abae1979c2f8f84412
MD5 74c295956128496f7447cc3b120eaa2f
SHA1 9e3665e1a1cef7dfef2c98425d704905f076cc12
SHA512 6c6f430193174ac71a4832b3133e36f04262eaeb39b47c08e42fe0d4c8f5f1efc0c8b433115ae6a81599845c9a63e7bd3844a18c0a7f01a6a32f6653c2f7163a
SSDEEP 24576:3p1I/wY4Gv3vF1EYj4Q9uCXSn6MaiSVAz0ZOd5VJVt:3I/b4Gvt1EYjhuQMaiSVAd5b
TLSH
T14A8539E37202C372D58E8CB18D5CD6B5853D9D247B6E00D3A3D8BB5B6A314C23776A4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

6f:64:00:d4:70:6c:d3:a5:80:4c:eb:ce:1e:bd:91:58:02:93:fa:78:54:01:78:ef:56:16:33:2e:bd:c8:98:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Apr 9, 2026

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

29:a3:db:93:49:54:8f:02:1c:3f:e0:bd:24:96:83:bf

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 15, 2025 - Jan 15, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

698608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Systray.Application.pdb

crypt32

CertGetNameStringW CertCloseStore CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CryptMsgGetParam CryptMsgClose

kernel32

K32GetModuleFileNameExW WaitForSingleObject GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc GetProcAddress CreateMutexExW GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent CreateFileW GetCurrentProcess DuplicateHandle Sleep SetEvent LocalFree FormatMessageA CreateSemaphoreA CreateEventA WaitForMultipleObjects GetUserDefaultLocaleName CreateEventW OpenProcess LoadLibraryA FreeLibrary GetConsoleScreenBufferInfo SetConsoleTextAttribute SetLastError WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetModuleFileNameW GetFileAttributesA ReadFile WaitNamedPipeA PeekNamedPipe CreateFileA CreateMutexW GetTickCount64 LoadLibraryW HeapSize ReadConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileSizeEx DeleteFileW GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW GetConsoleMode HeapFree CreateSemaphoreExW GetModuleFileNameA ReleaseSemaphore GetStdHandle GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread ExitProcess VirtualQuery VirtualProtect QueryPerformanceCounter QueryPerformanceFrequency ResetEvent WaitForMultipleObjectsEx OpenEventA SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo GetModuleHandleA CreateWaitableTimerA WriteConsoleW GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFullPathNameW AreFileApisANSI MoveFileExW MultiByteToWideChar RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable GetExitCodeThread GetNativeSystemInfo GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW VirtualAlloc SetEndOfFile

user32

GetForegroundWindow GetSystemMetrics LoadImageW GetWindow GetMessageW GetLastInputInfo SendMessageW DispatchMessageW TranslateMessage PostQuitMessage RegisterWindowMessageW GetCursorPos GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW SetWindowLongW PostMessageW CreatePopupMenu SetMenuItemBitmaps TrackPopupMenu SetMenuDefaultItem DestroyMenu AppendMenuW SetForegroundWindow LoadStringW GetWindowThreadProcessId

gdi32

DeleteObject

advapi32

RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegGetValueW

shell32

Shell_NotifyIconW SHGetKnownFolderPath

ole32

CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc

Name

.text

Size

891KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

115KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

461KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-22_74c295956128496f7447cc3b120eaa2f_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

generic