2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 1.2MB
Sample260708-fgplfaby4r
SHA256 de7a3972431ed93fd7a39db60b719c1186989a68dcc55d61a058f87d8bf35074
MD5 29d47d078391e5e011423bf0635dc359
SHA1 58fe3c8e4ff77a0f650ce9153086c62507cda6c0
SHA512 618465ef9f83200cdeb08f7a69fba24e338588d242adee5e6cbcf9bee3766ec48defc7cbe86a17472a82fb626d7a410bd49c40e76f02cfb110bacda1ff53c1ee
SSDEEP 24576:/i26F/PDGckPZPi2D4GCS0gq/jX9NvEdH:/i/bPkx5CS0P/JNiH
TLSH
T105558D3139828025DDE210F286FCBA7941ADA6700B7655C763C807EEDA609D27F36F97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 1.2MB

2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 2d6eebba488785a253f5cc371c14666b
SHA256 de7a3972431ed93fd7a39db60b719c1186989a68dcc55d61a058f87d8bf35074
MD5 29d47d078391e5e011423bf0635dc359
SHA1 58fe3c8e4ff77a0f650ce9153086c62507cda6c0
SHA512 618465ef9f83200cdeb08f7a69fba24e338588d242adee5e6cbcf9bee3766ec48defc7cbe86a17472a82fb626d7a410bd49c40e76f02cfb110bacda1ff53c1ee
SSDEEP 24576:/i26F/PDGckPZPi2D4GCS0gq/jX9NvEdH:/i/bPkx5CS0P/JNiH
TLSH
T105558D3139828025DDE210F286FCBA7941ADA6700B7655C763C807EEDA609D27F36F97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project\qqpinyin\trunk\Product\QQInput\Win32\QQWubi_2_4\client\Release\QQWBDictMerge.pdb

shell32

SHFileOperationW ShellExecuteW SHCreateDirectoryExW SHGetSpecialFolderPathW

kernel32

SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCurrentProcess TerminateProcess GetFileTime GetFileSize CreateDirectoryW WriteFile ReadFile SetEndOfFile SetFilePointer MultiByteToWideChar WideCharToMultiByte FreeLibrary GetLogicalDrives DeviceIoControl GetDriveTypeW GetVersionExW VirtualQuery GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentThread GetCurrentThreadId IsDebuggerPresent GetLocalTime FormatMessageW lstrcpyW lstrcatW lstrlenW IsBadWritePtr InterlockedDecrement InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree ProcessIdToSessionId CreateToolhelp32Snapshot Process32FirstW CreateFileW ReleaseMutex WaitForSingleObject MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW ReleaseSemaphore CreateMutexW OpenMutexW CreateSemaphoreW OpenSemaphoreW GlobalAlloc GlobalFree ExpandEnvironmentStringsW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW GetPrivateProfileStructW WritePrivateProfileStructW GetFullPathNameW MapViewOfFileEx GetCPInfo GetModuleHandleExW GetDiskFreeSpaceExW LockFile Sleep UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW GetFileType GetTimeZoneInformation LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList WriteConsoleW ReadConsoleW FlushFileBuffers SetFilePointerEx RtlUnwind GetConsoleMode GetConsoleCP CreateThread WaitForSingleObjectEx OutputDebugStringA SetConsoleCtrlHandler SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetTempFileNameW GetTempPathW FindResourceExW FindResourceW GetCommandLineW GetModuleHandleW GetModuleFileNameW LoadLibraryW GetTickCount CloseHandle FindClose SizeofResource LoadResource GetLastError GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress LockResource PeekNamedPipe SystemTimeToTzSpecificLocalTime ExitProcess Process32NextW IsDBCSLeadByte GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetStringTypeW GetLocaleInfoW LCMapStringW SetStdHandle GetFullPathNameA GetCurrentDirectoryW SetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID CompareStringW EncodePointer TlsFree TlsSetValue IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetStdHandle GetModuleFileNameA TlsGetValue QueryPerformanceFrequency SetLastError CreateEventW SwitchToThread TlsAlloc

user32

wvsprintfW AttachThreadInput ShowWindow UnregisterClassW IsIconic mouse_event GetForegroundWindow SetForegroundWindow SetWindowPos GetWindowRect SetCursorPos GetCursorPos GetWindowLongW GetWindowThreadProcessId MonitorFromPoint GetMonitorInfoW MessageBoxW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW GetSecurityDescriptorSacl GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority OpenThreadToken IsTextUnicode LookupAccountSidW GetTokenInformation OpenProcessToken ConvertSidToStringSidW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW LookupAccountNameW RegSetValueExW RegOpenKeyW RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyExW RegCloseKey

ole32

CoCreateInstance CoInitialize CoTaskMemFree StringFromGUID2 CoCreateGuid CoUninitialize

oleaut32

SysFreeString SysAllocString GetErrorInfo SetErrorInfo CreateErrorInfo VariantInit VariantClear VariantChangeType

shlwapi

PathFileExistsW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

netapi32

NetWkstaTransportEnum Netbios NetApiBufferFree

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

ws2_32

htonl ntohl

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Shared

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_29d47d078391e5e011423bf0635dc359_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

shell32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

version

netapi32

wtsapi32

ws2_32

generic