2026-07-02_0487d8ebe43e5b1071032c226b2b1c31_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_0487d8ebe43e5b1071032c226b2b1c31_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 12.1MB
Sample260702-jtnrfset5s
SHA256 b300bd228d6042f2971c289506db5e70e17a7074a538144be47e5e04f56f5711
MD5 0487d8ebe43e5b1071032c226b2b1c31
SHA1 28899c28b5e0e3214c0b69dbb622b3b9941a8987
SHA512 83c8ba4bff5cc8c7f7535bc4382e82be30fd29c1ddac3b6d15d65cff773272096089d437600d785f730a42f55100e275f6736488c77fba45d0839d8835f4c442
SSDEEP 196608:Bt63Ix4DU4942VG3C+Gi/AHwFYEv9eyV4IYATckv:u3IE4aL+GwAHwFYEv9eyV4A
TLSH
T169D60941E84299B5F5172E721A1AD3BB067F21304B35FDC3B2E46488AB12DEB077477A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_0487d8ebe43e5b1071032c226b2b1c31_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-02_0487d8ebe43e5b1071032c226b2b1c31_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 12.1MB

2026-07-02_0487d8ebe43e5b1071032c226b2b1c31_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH e5f046e00ade8ed12026d9660b34f064
SHA256 b300bd228d6042f2971c289506db5e70e17a7074a538144be47e5e04f56f5711
MD5 0487d8ebe43e5b1071032c226b2b1c31
SHA1 28899c28b5e0e3214c0b69dbb622b3b9941a8987
SHA512 83c8ba4bff5cc8c7f7535bc4382e82be30fd29c1ddac3b6d15d65cff773272096089d437600d785f730a42f55100e275f6736488c77fba45d0839d8835f4c442
SSDEEP 196608:Bt63Ix4DU4942VG3C+Gi/AHwFYEv9eyV4IYATckv:u3IE4aL+GwAHwFYEv9eyV4A
TLSH
T169D60941E84299B5F5172E721A1AD3BB067F21304B35FDC3B2E46488AB12DEB077477A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

173840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Stefan\Desktop\Blitz3D-TSS-Private\_release\bin\runtime.pdb

kernel32

GetProcessHeap HeapAlloc HeapFree HeapSize InitializeCriticalSectionEx DeleteCriticalSection GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceA LockResource HeapReAlloc LoadResource SetEndOfFile SetStdHandle HeapQueryInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW GetModuleHandleA HeapDestroy GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx SetEnvironmentVariableW SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount VirtualAlloc GetUserDefaultLCID ExitProcess SetLastError InterlockedFlushSList AddVectoredExceptionHandler GetLastError DecodePointer InterlockedPushEntrySList RtlUnwind OutputDebugStringA DebugBreak InitializeSListHead GetStartupInfoW TerminateProcess IsValidLocale GetCommandLineA SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent RaiseException OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer CreateFileW CloseHandle Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetVersionExW IsWow64Process GetModuleFileNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv MultiByteToWideChar GetLocaleInfoA GetSystemDefaultLCID GetUserDefaultLocaleName K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleFileNameExW K32GetModuleInformation DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA FreeLibrary GetProcAddress LoadLibraryA GetCurrentDirectoryA CreateDirectoryA CreateFileA GetFileAttributesA LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime WriteFile SystemTimeToFileTime GetTempPathA RemoveVectoredExceptionHandler GlobalMemoryStatusEx GetSystemDirectoryA GetWindowsDirectoryA GetNativeSystemInfo GetWindowsDirectoryW WideCharToMultiByte GetACP SetEvent WaitForSingleObject CreateEventA FindNextFileW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileW GetFileAttributesW RemoveDirectoryW CopyFileW MoveFileW LoadLibraryW GetModuleHandleW ReleaseSemaphore CreateSemaphoreW SetThreadPriority InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeConditionVariable SleepConditionVariableSRW InitializeConditionVariable WakeAllConditionVariable GetFullPathNameW FormatMessageA GetStringTypeW LocalFree GetLocaleInfoEx FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetExitCodeThread ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared GetTickCount64 EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks FileTimeToSystemTime

user32

SetProcessDPIAware MessageBoxW MessageBoxA UnregisterClassA GetForegroundWindow RegisterRawInputDevices MapVirtualKeyA ToAscii CharLowerW CharUpperW GetRawInputData EnumDisplaySettingsA LoadImageA SetWindowLongA GetWindowLongA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos ShowCursor InvalidateRect SetForegroundWindow UpdateWindow GetSystemMetrics ReleaseCapture SetCapture GetFocus MoveWindow DestroyWindow CreateWindowExA RegisterClassA DefWindowProcA PostMessageA SendMessageA PeekMessageW DispatchMessageW TranslateMessage GetMessageW wsprintfA GetKeyNameTextW LoadCursorA GetParent GetDesktopWindow MapWindowPoints GetWindowRect GetClientRect SetWindowTextW ReleaseDC GetDC DrawTextW RemoveMenu GetSystemMenu EnableWindow IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard DefDlgProcW SendDlgItemMessageA SetDlgItemTextW RegisterClassW IsWindow ShowWindow SetWindowPos IsWindowVisible DialogBoxIndirectParamW EndDialog GetDlgItem

bass

BASS_ChannelPause BASS_ChannelStop BASS_ChannelPlay BASS_ChannelIsActive BASS_StreamCreateFile BASS_SampleLoad BASS_GetInfo BASS_Free BASS_Init BASS_SetConfig BASS_Start BASS_Set3DFactors BASS_Set3DPosition BASS_Apply3D BASS_ChannelSet3DPosition BASS_SampleGetChannel BASS_SampleSetInfo BASS_SampleGetInfo BASS_SampleFree BASS_Pause BASS_ChannelSetAttribute

dbghelp

SymCleanup SymGetOptions SymSetOptions StackWalk64 SymGetModuleBase64 SymInitialize SymFromAddr MiniDumpWriteDump SymFunctionTableAccess64 SymGetLineFromAddr64

ws2_32

WSAGetLastError WSACleanup WSAStartup gethostbyname socket setsockopt sendto send select recvfrom recv accept bind closesocket connect ioctlsocket getpeername getsockname htonl htons inet_addr listen ntohl ntohs

urlmon

URLDownloadToFileA

dnsapi

DnsFree DnsQuery_A

dwmapi

DwmSetWindowAttribute

d3dcompiler_47

D3DGetBlobPart D3DReflect D3DCompileFromFile D3DCompile

winmm

timeGetDevCaps timeGetTime timeKillEvent timeSetEvent timeBeginPeriod timeEndPeriod

dinput8

DirectInput8Create

d3d9

Direct3DCreate9Ex

d3d11

D3D11CreateDevice

d3dx9_43

D3DXCreateEffectFromFileA D3DXSaveSurfaceToFileA D3DXLoadSurfaceFromMemory D3DXLoadSurfaceFromSurface D3DXCreateLine D3DXMatrixInverse D3DXMatrixMultiply

gdi32

CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject GetTextMetricsW GetStockObject AddFontResourceA RemoveFontResourceA CreateFontW

advapi32

RegEnumValueW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize

d3dxof

DirectXFileCreate

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

941KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

106KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=49, id=259, version=33145,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=253, version=35207,

count=28, id=259, version=35207,

count=18, id=260, version=35207,

count=108, id=261, version=35207,

count=22, id=260, version=35226,

count=6, id=261, version=35723,

count=22, productName=Unmarked objects (old),

count=96, id=260, version=35222,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=35, id=260, version=33145,

count=75, id=261, version=35216,

count=6, id=260, version=35216,

count=2, id=156, version=21202,

count=1, id=262, version=33145,

count=207, id=261, version=33145,

count=33, id=257, version=33145,

count=375, id=1, productName=Unmarked objects,

count=91, id=261, version=35226,

count=1, id=256, version=35226,

count=1, id=255, version=35226,

count=1, id=151,

count=1, id=258, version=35226,