2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader
Size 2.0MB
Sample260703-by7fcshy4x
SHA256 dce0b8cd496dfc7b81cdb1d1520593469194eb749ef9056697c782ec6acef2f8
MD5 47168d860c0c4000847f86a9ad413503
SHA1 7d2259848b01db64212a75153dd0c64b89559011
SHA512 86587342c15a6bb1aa46a82143f49044781adf6a8db599fdb09fedd1be2b741cbc123407c2aa6f79e1b54f52e1e0e74f8539a5311c583bcda67344991d5b49e8
SSDEEP 49152:l2Lb5aH3tRORox3azgGJtB76Jx4x8EVep:YkHdROq3azh+ix8EVy
TLSH
T1E295AF307943C1B2E4A212F18AB86FB89569E9B05B3756CB13D42F2D0D305D36F39A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 2.0MB

2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 9686f59e7add86005b38da8ebfa18dde
SHA256 dce0b8cd496dfc7b81cdb1d1520593469194eb749ef9056697c782ec6acef2f8
MD5 47168d860c0c4000847f86a9ad413503
SHA1 7d2259848b01db64212a75153dd0c64b89559011
SHA512 86587342c15a6bb1aa46a82143f49044781adf6a8db599fdb09fedd1be2b741cbc123407c2aa6f79e1b54f52e1e0e74f8539a5311c583bcda67344991d5b49e8
SSDEEP 49152:l2Lb5aH3tRORox3azgGJtB76Jx4x8EVep:YkHdROq3azh+ix8EVy
TLSH
T1E295AF307943C1B2E4A212F18AB86FB89569E9B05B3756CB13D42F2D0D305D36F39A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

826444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvControlSvc.pdb

kernel32

SetEndOfFile SetFilePointer CreateProcessW GetSystemDirectoryW LoadLibraryW GetVersionExW GetNativeSystemInfo LoadLibraryA GetConsoleOutputCP GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW CreatePipe ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSection CreateThread SetUnhandledExceptionFilter RtlCaptureContext GetSystemTimeAsFileTime GetSystemTime QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetCurrentProcessId WaitNamedPipeW CreateFileW WaitForMultipleObjects ResumeThread TerminateThread SetThreadPriority GetCurrentThreadId CancelIoEx GetOverlappedResult SetHandleInformation WriteFile ReadFile ResetEvent GetOEMCP GetACP WideCharToMultiByte ExpandEnvironmentStringsW GetLocaleInfoW GetComputerNameW VerifyVersionInfoW VerSetConditionMask OpenProcess GetExitCodeProcess SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler CloseHandle MoveFileExW LocalFree GetModuleHandleW GetFileSize SetPriorityClass GetCurrentProcess CreateDirectoryW GetCommandLineW GetStdHandle MulDiv GetProcAddress GetTempPathW LeaveCriticalSection EnterCriticalSection MultiByteToWideChar SystemTimeToFileTime CreateSemaphoreW OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore SetEvent SetLastError lstrcmpiW lstrcmpW DeviceIoControl GetLastError WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer FileTimeToSystemTime Sleep GetLocalTime InitializeCriticalSectionEx

advapi32

RegSetValueExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetKeySecurity RegOpenKeyExW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyExW FreeSid AllocateAndInitializeSid AddAccessDeniedAce EventUnregister EventRegister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW EventWriteTransfer RegQueryValueExW RegOpenKeyW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce EqualSid AddAccessAllowedAce

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize

oleaut32

VariantInit SafeArrayUnlock SafeArrayDestroy VariantClear SysAllocString SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysFreeString

ws2_32

getsockopt closesocket getnameinfo WSACleanup ntohl htons htonl shutdown socket ntohs

iphlpapi

ConvertInterfaceGuidToLuid GetAdaptersAddresses

wininet

InternetConnectW InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetOpenW InternetCrackUrlW

msi

ord205

fwpuclnt

FwpmFilterUnsubscribeChanges0 FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerSubscribeChanges0 FwpmSubLayerUnsubscribeChanges0 FwpmFilterAdd0 FwpmFilterSubscribeChanges0 FwpmFilterDeleteById0 FwpmFilterGetByKey0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

msi

fwpuclnt

rpcrt4

generic