2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader
Size 2.0MB
Sample260703-s8ddpscs7v
SHA256 f27abc9e8c63023a134b514dc170da15c3e83bc694e5aea4600156efd7d2cb25
MD5 9b24ad00b75b68bd9f914858050719d3
SHA1 c587547db13c29d5f697ebb6d623c2f11f4ee930
SHA512 d9d2955460635604e982fc38de818cebf8bd452af981fe9738ba9f42bdd51a6e3649dc92cd481654eb046f3f9e3db27c4c018696da36c5b7144d091d5969239d
SSDEEP 49152:k2Lb5aH3tRORoi3azgGJtB76jAQgAT76sQuE:bkHdROl3azhbqGsQr
TLSH
T1F595AE307943C1B2E4A252F08AB8AFB89569E9B0173756CB13D42F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 2.0MB

2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 9686f59e7add86005b38da8ebfa18dde
SHA256 f27abc9e8c63023a134b514dc170da15c3e83bc694e5aea4600156efd7d2cb25
MD5 9b24ad00b75b68bd9f914858050719d3
SHA1 c587547db13c29d5f697ebb6d623c2f11f4ee930
SHA512 d9d2955460635604e982fc38de818cebf8bd452af981fe9738ba9f42bdd51a6e3649dc92cd481654eb046f3f9e3db27c4c018696da36c5b7144d091d5969239d
SSDEEP 49152:k2Lb5aH3tRORoi3azgGJtB76jAQgAT76sQuE:bkHdROl3azhbqGsQr
TLSH
T1F595AE307943C1B2E4A252F08AB8AFB89569E9B0173756CB13D42F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

826444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvControlSvc.pdb

kernel32

SetEndOfFile SetFilePointer CreateProcessW GetSystemDirectoryW LoadLibraryW GetVersionExW GetNativeSystemInfo LoadLibraryA GetConsoleOutputCP GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW CreatePipe ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSection CreateThread SetUnhandledExceptionFilter RtlCaptureContext GetSystemTimeAsFileTime GetSystemTime QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetCurrentProcessId WaitNamedPipeW CreateFileW WaitForMultipleObjects ResumeThread TerminateThread SetThreadPriority GetCurrentThreadId CancelIoEx GetOverlappedResult SetHandleInformation WriteFile ReadFile ResetEvent GetOEMCP GetACP WideCharToMultiByte ExpandEnvironmentStringsW GetLocaleInfoW GetComputerNameW VerifyVersionInfoW VerSetConditionMask OpenProcess GetExitCodeProcess SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler CloseHandle MoveFileExW LocalFree GetModuleHandleW GetFileSize SetPriorityClass GetCurrentProcess CreateDirectoryW GetCommandLineW GetStdHandle MulDiv GetProcAddress GetTempPathW LeaveCriticalSection EnterCriticalSection MultiByteToWideChar SystemTimeToFileTime CreateSemaphoreW OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore SetEvent SetLastError lstrcmpiW lstrcmpW DeviceIoControl GetLastError WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer FileTimeToSystemTime Sleep GetLocalTime InitializeCriticalSectionEx

advapi32

RegSetValueExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetKeySecurity RegOpenKeyExW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyExW FreeSid AllocateAndInitializeSid AddAccessDeniedAce EventUnregister EventRegister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW EventWriteTransfer RegQueryValueExW RegOpenKeyW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce EqualSid AddAccessAllowedAce

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize

oleaut32

VariantInit SafeArrayUnlock SafeArrayDestroy VariantClear SysAllocString SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysFreeString

ws2_32

getsockopt closesocket getnameinfo WSACleanup ntohl htons htonl shutdown socket ntohs

iphlpapi

ConvertInterfaceGuidToLuid GetAdaptersAddresses

wininet

InternetConnectW InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetOpenW InternetCrackUrlW

msi

ord205

fwpuclnt

FwpmFilterUnsubscribeChanges0 FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerSubscribeChanges0 FwpmSubLayerUnsubscribeChanges0 FwpmFilterAdd0 FwpmFilterSubscribeChanges0 FwpmFilterDeleteById0 FwpmFilterGetByKey0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_9b24ad00b75b68bd9f914858050719d3_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

msi

fwpuclnt

rpcrt4

generic