2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 24.4MB
Sample260602-b1jgbacs4n
SHA256 2e8e4c92cddb54b5c94d3b547d4311fc25baf7a46a751317877feefd37b08826
MD5 09f591173eb9a6e2b7db2dc00c9f0ca9
SHA1 328dcc51e64d73ce2ffe79c931da1e2400114ecc
SHA512 eb62a2a32b5e9e0675a9b1417e4fbfe44be218ea17494b76eec59b55207c149f3f597aa3d8d29d541bf0ff30edc025986edec866c9f907f159ad9de91c68f594
SSDEEP 196608:BFpRoBMDfKcPBs16VCFIIcWtNZIxzIP8H9ECCFoGOzd+xBI28v:vDts16VCFNZ8MP+9Ez6cz8
TLSH
T181477C55F4C540BFC22AE234DC12CB0E025D2FB9CE9C4A5B7869B92D3971C8641AEF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Custom signature

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 24.4MB

2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

SHA256 2e8e4c92cddb54b5c94d3b547d4311fc25baf7a46a751317877feefd37b08826
MD5 09f591173eb9a6e2b7db2dc00c9f0ca9
SHA1 328dcc51e64d73ce2ffe79c931da1e2400114ecc
SHA512 eb62a2a32b5e9e0675a9b1417e4fbfe44be218ea17494b76eec59b55207c149f3f597aa3d8d29d541bf0ff30edc025986edec866c9f907f159ad9de91c68f594
SSDEEP 196608:BFpRoBMDfKcPBs16VCFIIcWtNZIxzIP8H9ECCFoGOzd+xBI28v:vDts16VCFNZ8MP+9Ez6cz8
TLSH
T181477C55F4C540BFC22AE234DC12CB0E025D2FB9CE9C4A5B7869B92D3971C8641AEF5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22859864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

413KB

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

38KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

14.7MB

Virtual Size

14.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

158KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

102KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_09f591173eb9a6e2b7db2dc00c9f0ca9_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

generic