2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar
Size 3.6MB
Sample260531-rtccescv3r
SHA256 06597a8c4667a97b41b4f1d7ba8535c859747b161a91446302447ca8d6c8febe
MD5 f7ba67cf0e40b4b22fa7c0c23780427d
SHA1 91ae24e8c2b3472dd3fca03eb8f083b8a35279bd
SHA512 10484486a72c858865431ad0d7eab29a270da27c3f9d12e11917201203be0cce7c2f4adafa016a212563b595f1ab87483a6ee7ea9ede43bb895b6c5a97f3a0a3
SSDEEP 49152:SuvFXNkEp6vrRokpownNTBecY/uLnHFLHkJEqeW4SkZP4sz9Mb8V2mY:SSNnpQrRokpxbDGfkZcOm
TLSH
T1FA062B19FEB44E32D072C23185A1BB5DA5363C1197324A8B22857E9EFEB2FC18535736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar

File Explorer

2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar

.exe 3.6MB

2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar

IMPHASH 8e382beb8f618c29dede8f29725989ad
SHA256 06597a8c4667a97b41b4f1d7ba8535c859747b161a91446302447ca8d6c8febe
MD5 f7ba67cf0e40b4b22fa7c0c23780427d
SHA1 91ae24e8c2b3472dd3fca03eb8f083b8a35279bd
SHA512 10484486a72c858865431ad0d7eab29a270da27c3f9d12e11917201203be0cce7c2f4adafa016a212563b595f1ab87483a6ee7ea9ede43bb895b6c5a97f3a0a3
SSDEEP 49152:SuvFXNkEp6vrRokpownNTBecY/uLnHFLHkJEqeW4SkZP4sz9Mb8V2mY:SSNnpQrRokpxbDGfkZcOm
TLSH
T1FA062B19FEB44E32D072C23185A1BB5DA5363C1197324A8B22857E9EFEB2FC18535736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\onenote\x86\ship\0\onelev.pdb

kernel32

lstrlenW RaiseException InitializeCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject GetModuleFileNameW Sleep EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCurrentThreadId CreateThread CreateEventW SetEvent GetCommandLineW LoadLibraryA FreeLibrary LocalAlloc HeapSize HeapReAlloc HeapDestroy GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange LoadLibraryW HeapAlloc HeapFree GetTempPathA GetTempFileNameA CreateProcessA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetACP GetLocaleInfoA GetThreadLocale IsDebuggerPresent

user32

DispatchMessageW TranslateMessage CharUpperW CharNextW UnregisterClassA GetMessageW PostThreadMessageW

msvcr80

_cexit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ __getmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s vswprintf_s wcsrchr memset calloc memmove_s memcpy_s malloc realloc ??2@YAPAXI@Z __CxxFrameHandler3 ??_U@YAPAXI@Z ??_V@YAXPAX@Z wcscat_s wcsncpy_s wcscpy_s _CxxThrowException free ??3@YAXPAX@Z _exit

netapi32

NetShareAdd

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_f7ba67cf0e40b4b22fa7c0c23780427d_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_stop_vidar

kernel32

user32

msvcr80

netapi32

secur32

generic