2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.3MB
Sample260604-ph9sfaev2x
SHA256 be6005de29c6beb532d5e63f907624326c0cfb53e2c29bcf77c5567d88830d4a
MD5 e4b37268efe5d412bc0de56ae45780df
SHA1 e486c6275db33ea7a1a6aef3e8c2db73e56876fd
SHA512 bcefe49573f532060a98565f021ea9b5154ee689824891a3c46cbf3cc12182c3b1017c72a9542d3f0fe3cffeb697e672f27cde2803d48e6ae47ee80980a613f0
SSDEEP 24576:VRB/kGqZXMfUgYPLdD3sZnnQ/tbw/2Mkjy6Fr7g0oM:VXkBMsgYPLdrsZnQ/lFTjN4
TLSH
T1F355BE11379AC03AE5B226B05939ABA5453ABC717F76CDCB23C4396D98302E15E34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 1.3MB

2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH a464f1c38df04ebd3cce2812ea1f5946
SHA256 be6005de29c6beb532d5e63f907624326c0cfb53e2c29bcf77c5567d88830d4a
MD5 e4b37268efe5d412bc0de56ae45780df
SHA1 e486c6275db33ea7a1a6aef3e8c2db73e56876fd
SHA512 bcefe49573f532060a98565f021ea9b5154ee689824891a3c46cbf3cc12182c3b1017c72a9542d3f0fe3cffeb697e672f27cde2803d48e6ae47ee80980a613f0
SSDEEP 24576:VRB/kGqZXMfUgYPLdD3sZnnQ/tbw/2Mkjy6Fr7g0oM:VXkBMsgYPLdrsZnQ/lFTjN4
TLSH
T1F355BE11379AC03AE5B226B05939ABA5453ABC717F76CDCB23C4396D98302E15E34B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

340944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wevtapi

EvtNext EvtClose EvtSubscribe EvtCreateRenderContext EvtRender

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

kernel32

WaitForSingleObject CreateMutexW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateProcessW OpenProcess GetTickCount GetTickCount64 FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW QueryFullProcessImageNameW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW LoadLibraryW ResetEvent CreateEventW LCMapStringEx GetVersionExW IsWow64Process LocalFree OpenMutexW GetProcessTimes ProcessIdToSessionId GetSystemTimeAsFileTime GetWindowsDirectoryW OpenFileMappingW MapViewOfFile UnmapViewOfFile LocaleNameToLCID SetThreadUILanguage WaitForMultipleObjectsEx CreateFileMappingW DebugBreak ReleaseSemaphore WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetModuleFileNameA GetModuleHandleExW WideCharToMultiByte ExpandEnvironmentStringsW FindFirstChangeNotificationW FindNextChangeNotification GetFileSizeEx GetFileTime MulDiv lstrcmpW SetEnvironmentVariableW GetFileAttributesW GetFileSize SetEndOfFile SetFilePointer WakeAllConditionVariable TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex GetStringTypeW QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList SleepConditionVariableSRW InitializeSListHead EncodePointer GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapAlloc HeapReAlloc HeapDestroy RaiseException DecodePointer ReadFile FindCloseChangeNotification DeleteFileW WritePrivateProfileStringW GetPrivateProfileStringW FormatMessageW GetCurrentThreadId SetLastError GetLastError CloseHandle IsDebuggerPresent WriteFile CreateFileW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetCPInfo WriteConsoleW VirtualProtect EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

GetWindowTextLengthW GetWindowTextW DrawTextW GetClassNameW EnumWindows IsIconic MonitorFromWindow SystemParametersInfoW LoadImageW GetWindow GetParent GetDesktopWindow FillRect GetSysColorBrush GetSysColor MapWindowPoints SetCursor GetWindowRect GetClientRect SetWindowTextW InvalidateRect ReleaseDC GetDlgCtrlID SetDlgItemTextW GetDlgItem IsWindowVisible IsWindow ChangeWindowMessageFilterEx GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetLastActivePopup GetWindowLongW GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu KillTimer SetTimer MsgWaitForMultipleObjectsEx CreateDialogParamW SetWindowPos ShowWindow CallWindowProcW PostQuitMessage DefWindowProcW SendMessageW UnregisterHotKey RegisterHotKey RegisterWindowMessageW GetDC LoadStringW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowW SetWindowLongW MessageBoxW MessageBoxA AllowSetForegroundWindow GetSystemMetrics EnableWindow CharNextW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW SetUserObjectInformationW RedrawWindow

gdi32

SelectObject DeleteObject CreatePen CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteDC Polygon

advapi32

FreeSid RegCreateKeyExW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW RegCloseKey CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW

shell32

Shell_NotifyIconW SetCurrentProcessExplicitAppUserModelID ShellExecuteW SHQueryUserNotificationState

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize StringFromGUID2 CoUninitialize CoTaskMemAlloc CoCreateGuid IIDFromString

oleaut32

VariantClear VariantInit VarUI4FromStr SysFreeString VarI4FromStr VarR8FromStr VarDateFromStr VarDecFromStr VarDecCmp SysAllocString

comctl32

ord345 ord381

uxtheme

SetWindowTheme

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials

Name

.text

Size

489KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

userenv

wevtapi

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

winhttp

generic