2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 1.2MB
Sample260710-2y3ehsgw9x
SHA256 614bcd0eaddc6164bd387f71100e884c8c614685c73f740655983e2f873ec3ef
MD5 0fec0f2393bbe417bbb6c68a245293a3
SHA1 a681f84d12815e57dfbe6ff7b98b38382985e56a
SHA512 4d093643e1a15b82e823aeb0daf2b2cc96fd3147d17628bea81cc6c19a163a630cd32243b25158f19fcb0311de70732200d6ad5e1cb634449bf1fe6aaf246cba
SSDEEP 6144:NBKa3DT4SGNLIK/cGKblj7G5AOzuFqUrzdQn:+JSMLb/cGKduJerzdQn
TLSH
T183456E32046ADE5FFD1FE0F9C32912F21AB50DB9DA4CD1A366E0BD7A75B05462420FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 1.2MB

2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH bd03f9ff72c0bfdb52e6e9819a88038d
SHA256 614bcd0eaddc6164bd387f71100e884c8c614685c73f740655983e2f873ec3ef
MD5 0fec0f2393bbe417bbb6c68a245293a3
SHA1 a681f84d12815e57dfbe6ff7b98b38382985e56a
SHA512 4d093643e1a15b82e823aeb0daf2b2cc96fd3147d17628bea81cc6c19a163a630cd32243b25158f19fcb0311de70732200d6ad5e1cb634449bf1fe6aaf246cba
SSDEEP 6144:NBKa3DT4SGNLIK/cGKblj7G5AOzuFqUrzdQn:+JSMLb/cGKduJerzdQn
TLSH
T183456E32046ADE5FFD1FE0F9C32912F21AB50DB9DA4CD1A366E0BD7A75B05462420FA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115221

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\sourcecode\workspace\oa_client_201601_84th_sp1_release2\updater\preRelease_20161207\bin\Win32.Release\tlupdater.pdb

ws2_32

WSACleanup WSAGetLastError setsockopt htons getsockopt recv connect socket send gethostbyname closesocket WSAStartup

log4cxx

??1MessageBuffer@helpers@log4cxx@@QAE@XZ ?configure@PropertyConfigurator@log4cxx@@SAXABVFile@2@@Z ?isEnabledFor@Logger@log4cxx@@QBE_NABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@@Z ?getLogger@Logger@log4cxx@@SA?AV?$ObjectPtrT@VLogger@log4cxx@@@helpers@2@QBD@Z ??1?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@UAE@XZ ??1?$ObjectPtrT@VLevel@log4cxx@@@helpers@log4cxx@@UAE@XZ ??0LocationInfo@spi@log4cxx@@QAE@QBD0H@Z ?forcedLog@Logger@log4cxx@@QBEXABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVLocationInfo@spi@2@@Z ?toLevel@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@H@Z ??1File@log4cxx@@QAE@XZ ??0File@log4cxx@@QAE@PBD@Z ?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVCharMessageBuffer@23@@Z ??6MessageBuffer@helpers@log4cxx@@QAEAAVCharMessageBuffer@12@PAD@Z ??0MessageBuffer@helpers@log4cxx@@QAE@XZ

kernel32

LockResource GlobalAlloc HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress GlobalLock DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary CreateFileMappingW MapViewOfFile lstrcmpiW GlobalUnlock lstrcmpW MulDiv LoadLibraryExW WriteConsoleW SetFilePointerEx FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleCP GetFileType GetACP GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter TerminateThread GetLastError MultiByteToWideChar HeapSize UnmapViewOfFile GetCurrentThreadId WaitForSingleObject InitializeCriticalSectionEx CreateMutexW LeaveCriticalSection GetModuleFileNameW EnterCriticalSection SetLastError HeapFree SizeofResource UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetStringTypeW LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount IsDebuggerPresent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer CreateFileW WriteFile GetTickCount WideCharToMultiByte OutputDebugStringW GetVersionExW GetCurrentProcessId K32EnumProcesses GetLogicalDriveStringsW OpenProcess K32GetProcessImageFileNameW TerminateProcess QueryDosDeviceW CreateDirectoryW DeleteFileW CopyFileW

user32

SetForegroundWindow GetWindowRect GetWindowThreadProcessId AttachThreadInput LoadBitmapW SetWindowRgn LoadIconW DrawTextW AdjustWindowRectEx GetMenu GetSystemMetrics GetCapture GetDlgCtrlID IsWindowEnabled SystemParametersInfoW PtInRect UpdateWindow EnableWindow GetWindowTextW EndPaint BeginPaint GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW GetWindow GetFocus DestroyWindow GetDC SetWindowPos MessageBoxW FillRect CreateWindowExW ScreenToClient SendMessageW UnregisterClassW SetWindowTextW RegisterClassExW wsprintfA GetActiveWindow IsWindow InvalidateRgn RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild EndDialog GetForegroundWindow MoveWindow CreateAcceleratorTableW SetFocus CharNextW LoadCursorW GetClassNameW SetCapture SetWindowLongW GetClientRect GetDlgItem GetDesktopWindow GetClassInfoExW GetParent RegisterWindowMessageW DialogBoxParamW ReleaseCapture InvalidateRect ReleaseDC PostMessageW KillTimer SetTimer GetSysColor

gdi32

SetBkMode SetTextColor GetTextExtentPointW SetViewportOrgEx CreateRectRgn CreateFontIndirectW StretchBlt BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC GetObjectW DeleteObject CreateSolidBrush

advapi32

RegQueryValueExW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegDeleteValueW

ole32

CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal OleInitialize CoTaskMemRealloc CLSIDFromString OleLockRunning CoUninitialize StringFromGUID2 CoTaskMemAlloc CoInitialize OleUninitialize CoGetClassObject CoCreateInstance

oleaut32

SysStringLen SysAllocString SysAllocStringLen VariantClear OleCreateFontIndirect SysFreeString LoadTypeLi VariantInit LoadRegTypeLi VarUI4FromStr

shlwapi

StrCmpW

comctl32

ImageList_Destroy InitCommonControlsEx _TrackMouseEvent ImageList_GetIconSize

shell32

ShellExecuteW SHGetSpecialFolderPathW

msimg32

TransparentBlt AlphaBlend

Name

.text

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

920KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_0fec0f2393bbe417bbb6c68a245293a3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

ws2_32

log4cxx

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

comctl32

shell32

msimg32

generic