2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.8MB
Sample260712-tdxpjaew8v
SHA256 14948f93e98cdf4d474e0ad561f2255382e0f3bac0d1468e656cc145e29169df
MD5 daa007ccf7400cb852d98f8b4f9bdf8e
SHA1 1eeb21d83415b172b7b0203c47299d47b5b6f065
SHA512 be013cdc031cc3f40f421ee7b30dd16da07c70a7c2ea92b6335300e5955fa7d3b918c2ac13ac0c2e4ebd2c4c96e3cc5a5d5971a7641fd27d179a7c4e4052d467
SSDEEP 49152:D10PISv6BhEwtotaN90JhmXx5Unq8DBOtDmg27RnWGj:DWP6YaL0JhmXx6DBOtD527BWG
TLSH
T1A385BF23B543D036ED81017085BECFAA856EAA344B2514EB63D0796DB9F70E11A35B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 1.8MB

2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH a3166cd67aea9c1bce046ae95e536988
SHA256 14948f93e98cdf4d474e0ad561f2255382e0f3bac0d1468e656cc145e29169df
MD5 daa007ccf7400cb852d98f8b4f9bdf8e
SHA1 1eeb21d83415b172b7b0203c47299d47b5b6f065
SHA512 be013cdc031cc3f40f421ee7b30dd16da07c70a7c2ea92b6335300e5955fa7d3b918c2ac13ac0c2e4ebd2c4c96e3cc5a5d5971a7641fd27d179a7c4e4052d467
SSDEEP 49152:D10PISv6BhEwtotaN90JhmXx5Unq8DBOtDmg27RnWGj:DWP6YaL0JhmXx6DBOtD527BWG
TLSH
T1A385BF23B543D036ED81017085BECFAA856EAA344B2514EB63D0796DB9F70E11A35B3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

PostThreadMessageA GetForegroundWindow SetWinEventHook UnhookWinEvent TranslateMessage DispatchMessageA DefWindowProcA RegisterClassExA CreateWindowExA GetWindowThreadProcessId EnumChildWindows GetMessageA

kernel32

SetEvent CloseHandle CreateEventA OpenEventA Sleep GetCurrentProcessId CreateThread ProcessIdToSessionId GetModuleHandleA CreateDirectoryA LCMapStringEx WaitForSingleObject IsValidCodePage CreateNamedPipeA CancelIoEx SetNamedPipeHandleState DisconnectNamedPipe OpenProcess QueryFullProcessImageNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionEx InitOnceExecuteOnce GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WakeAllConditionVariable IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess InitializeSListHead RaiseException RtlUnwind InterlockedPushEntrySList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc ReadFile ReadConsoleW CreateFileW WriteConsoleW DecodePointer CreateDirectoryW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointer SetFileTime MoveFileExW GetCurrentDirectoryW FindFirstFileW GetComputerNameW SetThreadPriority GetExitCodeThread GetTimeZoneInformation CreateEventW InitializeCriticalSection InitializeConditionVariable CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateFileA SetHandleInformation ConnectNamedPipe

shell32

SHGetFolderPathA SHGetSpecialFolderPathA

shlwapi

PathFileExistsA

secur32

GetUserNameExA

mswsock

AcceptEx

ws2_32

connect ioctlsocket getsockname htonl listen recv send setsockopt socket WSAPoll WSAIoctl WSARecv WSASend getaddrinfo freeaddrinfo inet_pton WSAStartup accept htons bind WSAGetLastError select __WSAFDIsSet WSACleanup closesocket

advapi32

RegCloseKey RegOpenKeyExA SystemFunction036 RegSetValueExA RegQueryValueExA RegCreateKeyExA

Name

.text

Size

850KB

Virtual Size

850KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

314KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

604KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_daa007ccf7400cb852d98f8b4f9bdf8e_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_smoke-loader

user32

kernel32

shell32

shlwapi

secur32

mswsock

ws2_32

advapi32

generic