2026-05-22_13d4afbc2373a756f42f36f9b20edb67_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_13d4afbc2373a756f42f36f9b20edb67_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.9MB
Sample260522-cjbktact8n
SHA256 4d6d3734107076b7cf1de25a559c610dd629c8ab899513f89892d4b1c907ac3a
MD5 13d4afbc2373a756f42f36f9b20edb67
SHA1 453161932cfd1745088f3067b37d7e77187c9a8a
SHA512 00a2141e0a100bebe2b3e9c02b69fce7142f2bc54f2dc3c1e0d920ba2630c7b9909d15eefccda0abb2dc9a233f555ee3a9fbb1b37c6bebb439362c11cb72ce1b
SSDEEP 49152:oFifG/vnuaU7yfURrYrpV/05tvf6IGeuJOP:oFifMfuaU7YyrY1V85tvf6ITP
TLSH
T12E957D11794044BFC2130A30D94DFE7DFBACA5B90B7D59F303E09A982A617528B3B56B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-22_13d4afbc2373a756f42f36f9b20edb67_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 1.9MB

2026-05-22_13d4afbc2373a756f42f36f9b20edb67_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH d97d1bd5ed9a67113e7ec13cfcaa0bfb
SHA256 4d6d3734107076b7cf1de25a559c610dd629c8ab899513f89892d4b1c907ac3a
MD5 13d4afbc2373a756f42f36f9b20edb67
SHA1 453161932cfd1745088f3067b37d7e77187c9a8a
SHA512 00a2141e0a100bebe2b3e9c02b69fce7142f2bc54f2dc3c1e0d920ba2630c7b9909d15eefccda0abb2dc9a233f555ee3a9fbb1b37c6bebb439362c11cb72ce1b
SSDEEP 49152:oFifG/vnuaU7yfURrYrpV/05tvf6IGeuJOP:oFifMfuaU7YyrY1V85tvf6ITP
TLSH
T12E957D11794044BFC2130A30D94DFE7DFBACA5B90B7D59F303E09A982A617528B3B56B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

bd:76:26:35:e1:7e:91:e7:ca:00:da:a5:d4:f5:24:83:cf:e5:18:93:d8:d7:02:49:9d:ce:b7:45:f3:50:20:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Digital First Holdings\, LLC,O=Digital First Holdings\, LLC,L=Atlanta,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c1b7765626d61737465722e64694063616e64657363656e742e636f6d

Chains

Mar 10, 2026

CN=Digital First Holdings\, LLC,O=Digital First Holdings\, LLC,L=Atlanta,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c1b7765626d61737465722e64694063616e64657363656e742e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Digital First Holdings\, LLC,O=Digital First Holdings\, LLC,L=Atlanta,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c1b7765626d61737465722e64694063616e64657363656e742e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Digital First Holdings\, LLC,O=Digital First Holdings\, LLC,L=Atlanta,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c1b7765626d61737465722e64694063616e64657363656e742e636f6d

Serial Number

09:b7:50:55:ee:b2:a6:98:23:e3:f5:22:07:d9:c5:a2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2025 - Sep 19, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1289132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\drivergit\tcDriver\pwecsblog\Release\pwecsblog.pdb

kernel32

GetDriveTypeW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx MoveFileExW DeleteFileW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc FindFirstFileExW FreeEnvironmentStringsW ExitProcess GetFileType SetStdHandle QueryPerformanceFrequency GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread HeapQueryInformation GetFullPathNameW VirtualQuery VirtualAlloc GetSystemInfo RtlUnwind RaiseException OutputDebugStringW GetStringTypeW FindNextFileW IsValidCodePage SetEnvironmentVariableW CreateFileW GetCurrentDirectoryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentStringsW GetTempFileNameA SearchPathA GetProfileIntA GetTickCount64 GetTempPathA VerifyVersionInfoA VerSetConditionMask GetWindowsDirectoryA FindResourceExW lstrcpyA GetACP GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetFileTime GetFileSizeEx GetFileAttributesExA GetFileAttributesA GetVersionExA GlobalFindAtomA FindResourceA lstrcmpW GlobalDeleteAtom LoadLibraryExW GetSystemDirectoryW EncodePointer ResumeThread SetThreadPriority lstrcmpiA LoadLibraryA GetCurrentProcess DuplicateHandle GetVolumeInformationA WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetFullPathNameA GetFileSize FlushFileBuffers CreateFileA GlobalAddAtomA GlobalFlags FreeLibrary GetCurrentProcessId LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection CompareStringA GlobalGetAtomNameA lstrcmpA LoadLibraryW GetModuleHandleW GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetProcAddress GetModuleHandleA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime CopyFileA FormatMessageA MulDiv LocalFree GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc MultiByteToWideChar CreateMutexA ReleaseMutex GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree Sleep OpenFileMappingA CreateThread WaitForSingleObject CreateEventA CloseHandle SetEvent OpenEventA CreateDirectoryA SetCurrentDirectoryA GetModuleFileNameA GetCurrentDirectoryA GetCurrentThreadId GetLocalTime WideCharToMultiByte SetLastError GetLastError FindResourceW LoadResource LockResource SizeofResource GetStdHandle WriteConsoleW

user32

LoadCursorW InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx LoadImageA IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamA OffsetRect SetRectEmpty CopyImage SystemParametersInfoA GetMenuItemInfoA DestroyMenu LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoA MonitorFromWindow WinHelpA GetScrollInfo SetScrollInfo LoadIconW LoadIconA GetTopWindow GetClassLongA EqualRect MapWindowPoints AdjustWindowRectEx GetClientRect RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow NotifyWinEvent SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu GetClassInfoExA GetClassInfoA CallWindowProcA GetMessageTime GetMessagePos RegisterWindowMessageA FrameRect SetWindowsHookExA GetCursorPos ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageA CharUpperA DestroyIcon DrawIcon UnionRect UpdateLayeredWindow PostMessageA GetMessageA TranslateMessage DispatchMessageA RegisterClassA GetScrollPos SetScrollPos RealChildWindowFromPoint GetClassNameA GetDesktopWindow PtInRect GetWindowRect IsDialogMessageA GetWindow SetWindowLongA SetWindowTextA GetFocus SetFocus GetDlgCtrlID SendDlgItemMessageA CheckDlgButton CreatePopupMenu GetMenuDefaultItem MapVirtualKeyA GetKeyNameTextA SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateA SetClassLongA SetWindowRgn SetParent DrawEdge DrawFrameControl IsZoomed LoadMenuW GetSystemMenu BringWindowToTop SetCursorPos GetForegroundWindow CreateWindowExA LockWindowUpdate ShowWindow PostQuitMessage DefWindowProcA GetMenuStringA GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuA AppendMenuA RemoveMenu DrawTextA DrawTextExA GrayStringA TabbedTextOutA GetDC GetWindowDC ReleaseDC BeginPaint EndPaint ClientToScreen ScreenToClient GetSysColor FillRect GetWindowTextA GetWindowTextLengthA UnhookWindowsHookEx GetSystemMetrics GetSysColorBrush LoadCursorA SendMessageA EnableWindow IsWindowEnabled MessageBoxA GetWindowLongA GetParent GetWindowThreadProcessId GetLastActivePopup CopyRect InflateRect IntersectRect IsWindow MoveWindow SetWindowPos GetDlgItem MonitorFromPoint LoadAcceleratorsA TranslateAcceleratorA LoadMenuA CopyIcon InsertMenuItemA UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageA WaitMessage GetKeyboardLayout IsCharLowerA MapVirtualKeyExA GetKeyboardState ToAsciiEx LoadAcceleratorsW CreateAcceleratorTableA DestroyAcceleratorTable CopyAcceleratorTableA SetRect DestroyCursor GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcA DefFrameProcA DrawMenuBar GetUpdateRect IsClipboardFormatAvailable CharUpperBuffA RegisterClipboardFormatA ModifyMenuA GetDoubleClickTime SetMenuDefaultItem CallNextHookEx

gdi32

GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign GetObjectA MoveToEx TextOutA ExtTextOutA SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateFontIndirectA CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetViewportExtEx GetTextMetricsA EnumFontFamiliesExA CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesA GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceA GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt DeleteDC GetDeviceCaps CreateDCA GetTextExtentPoint32A CopyMetaFileA

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

RegEnumKeyExA RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegDeleteValueA DeregisterEventSource ReportEventA RegisterEventSourceA RegCloseKey RegQueryValueExA RegOpenKeyA

shell32

SHGetFileInfoA ShellExecuteA SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetDesktopFolder DragQueryFileA DragFinish SHAppBarMessage SHBrowseForFolderA

shlwapi

PathIsUNCA PathFindFileNameA PathFindExtensionA PathRemoveFileSpecW StrFormatKBSizeA PathStripToRootA

uxtheme

DrawThemeParentBackground GetThemePartSize DrawThemeText OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeSysColor

ole32

OleTranslateAccelerator IsAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoDisconnectObject CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate LoadTypeLi VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysFreeString SysAllocStringByteLen

gdiplus

GdipGetImageHeight GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdiplusShutdown GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImagePixelFormat

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_13d4afbc2373a756f42f36f9b20edb67_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

generic