2026-07-15_e3f37827630a652e2882049ff3162e01_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_e3f37827630a652e2882049ff3162e01_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 5.2MB
Sample260715-k5pcssf18l
SHA256 7d5a8d6b956965494d6a59db69204561576667878b6f7033991b63acd5588572
MD5 e3f37827630a652e2882049ff3162e01
SHA1 db4f46f037615169f967870c8a483558832fe05c
SHA512 b52c75489ee952a9a30f60458826429caed2e1b356ca8357bfbe68a0a812f4c86b66248ab2f4772e8101b6adf5226177caab6bbfa1137afd41fab92bb5a3e902
SSDEEP 98304:Hkzob09TPwUFM5VqDbvYgJPflOlWZXH9s6vHpS3wUIIehL3lmWg:HkK0NdgVqLSWw
TLSH
T10B46AF207905C071DDD212B9997CBFEF95AD99301B6559D3B3C82E6E8E602C23F32987
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_e3f37827630a652e2882049ff3162e01_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-15_e3f37827630a652e2882049ff3162e01_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 5.2MB

2026-07-15_e3f37827630a652e2882049ff3162e01_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 591d53d721a44755f39e4d3bc76d26c5
SHA256 7d5a8d6b956965494d6a59db69204561576667878b6f7033991b63acd5588572
MD5 e3f37827630a652e2882049ff3162e01
SHA1 db4f46f037615169f967870c8a483558832fe05c
SHA512 b52c75489ee952a9a30f60458826429caed2e1b356ca8357bfbe68a0a812f4c86b66248ab2f4772e8101b6adf5226177caab6bbfa1137afd41fab92bb5a3e902
SSDEEP 98304:Hkzob09TPwUFM5VqDbvYgJPflOlWZXH9s6vHpS3wUIIehL3lmWg:HkK0NdgVqLSWw
TLSH
T10B46AF207905C071DDD212B9997CBFEF95AD99301B6559D3B3C82E6E8E602C23F32987
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2671538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\M2\MK\MKMT2\.Source-Binario\Srcs\Client\bin\Release\metin2client.pdb

kernel32

CreateFileA GetCurrentDirectoryA WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize OutputDebugStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetTickCount GetCurrentDirectoryW ReadProcessMemory GetCurrentProcessId DeleteFileA GetCurrentProcess GetVolumeInformationA GetLastError FindNextFileA FindFirstFileA FindClose MultiByteToWideChar SetFileAttributesA GetACP IsValidCodePage HeapReAlloc SetStdHandle DeleteFileW GetTimeZoneInformation CreateProcessW GetExitCodeProcess GetFileSizeEx SetConsoleCtrlHandler SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetDriveTypeW GetModuleHandleExW GetFileAttributesA ResumeThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount Module32Next InterlockedPushEntrySList RaiseException RtlUnwind GetThreadTimes GetCurrentThread SetLastError WaitNamedPipeW PeekNamedPipe GetModuleFileNameW GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter FindResourceW FindResourceA SizeofResource LoadResource LockResource IsProcessorFeaturePresent InterlockedDecrement GetProcessHeap HeapValidate InterlockedIncrement GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SleepConditionVariableSRW WakeAllConditionVariable ReleaseMutex CreateMutexA OpenEventA ExitProcess CreateThread MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleA GlobalFree lstrlenA CreateFileMappingA GetPrivateProfileStringA WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW FreeLibraryAndExitThread MoveFileA CopyFileW CreateDirectoryExW GetModuleHandleW DeviceIoControl Module32First Process32Next Process32First CreateToolhelp32Snapshot GetSystemInfo OpenProcess SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AreFileApisANSI GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW CreateFileW CreateDirectoryW SetCurrentDirectoryW GetLocaleInfoEx LocalFree GetStringTypeW FormatMessageA GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx QueryPerformanceCounter CopyFileA CreateSemaphoreA ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock GetVersionExA GetSystemDirectoryA WriteFile SetFilePointer ReadFile GetCurrentThreadId SetUnhandledExceptionFilter GetFileSize OutputDebugStringA GetTempFileNameA GetTempPathA RemoveDirectoryA CreateDirectoryA AllocConsole GlobalAlloc CloseHandle LoadLibraryA GetProcAddress InterlockedFlushSList FreeLibrary

user32

GetWindowLongA SetWindowLongA CharNextExA CharPrevExA RegisterClassA GetMenu SetWindowTextA GetWindowRect AdjustWindowRectEx LoadCursorA GetMessageA TranslateMessage DispatchMessageA GetKeyboardLayoutNameA GetKeyboardLayout OpenClipboard CloseClipboard MessageBoxA GetClipboardData CharNextW GetDC PeekMessageA UpdateWindow ChangeDisplaySettingsA ReleaseCapture SetCapture GetCapture ShowWindow ClientToScreen SetCursorPos LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState SystemParametersInfoA LoadIconA FindWindowA ScreenToClient GetCursorPos GetAsyncKeyState SetWindowPos FlashWindowEx PostQuitMessage DestroyWindow MoveWindow GetSystemMetrics LoadStringA IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA ReleaseDC BeginPaint EndPaint InvalidateRect GetClientRect FillRect SetRect OffsetRect SetFocus

gdi32

GetCharABCWidthsFloatW GetTextExtentPoint32W CreateFontIndirectA SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode SetDIBitsToDevice CreateDIBSection TextOutA GetDeviceCaps GetPixel GetStockObject EnumFontFamiliesExA CreateSolidBrush DeleteObject PatBlt SelectObject GetTextExtentPoint32A StretchBlt

advapi32

RegOpenKeyExA RegQueryValueExA CryptGenRandom CryptDestroyHash RegOpenKeyA RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey CryptHashData CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash

shell32

ShellExecuteA SetCurrentProcessExplicitAppUserModelID SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize CoUninitialize OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SafeArrayDestroy SysAllocString SafeArrayAccessData SafeArrayCreate SysFreeString VariantInit VariantClear CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod timeGetDevCaps

d3d8

Direct3DCreate8

python27

PyDict_New PyDict_SetItem PyComplex_FromCComplex PyErr_NoMemory PyEval_GetRestricted PyCode_New PyMarshal_ReadObjectFromString _PyLong_New _Py_EllipsisObject PyExc_StopIteration PyExc_EOFError PyExc_ValueError PyList_SetItem PyFloat_FromDouble PyCode_Addr2Line PyObject_AsCharBuffer PyImport_AddModule PyImport_GetMagicNumber Py_FlushLine PyEval_SetTrace PyRun_StringFlags Py_Finalize Py_Initialize Py_SetProgramName PyErr_Fetch Py_BuildValue _PyLong_FromByteArray PyTuple_Size PyModule_AddIntConstant PyLong_AsLong PyTuple_GetItem PyDict_GetItemString PyLong_FromLongLong PyInt_AsLong PyDict_Next PyDict_Size PyList_New PyList_Append PyObject_GetAttrString PyObject_SetAttrString PyObject_IsTrue PyInt_FromLong PyErr_SetString PyImport_ImportModule _Py_ZeroStruct _Py_TrueStruct PyExc_RuntimeError PyString_FromStringAndSize PyString_FromString PyArg_ParseTuple PyTuple_New PyTuple_SetItem PyModule_AddStringConstant PyString_InternFromString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyString_AsString PyErr_Clear PyUnicodeUCS2_DecodeUTF8 PyCode_Type Py_OptimizeFlag PyEval_EvalCode Py_InitModule4 PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check _Py_NoneStruct PyDict_SetItemString PyErr_Occurred PyModule_GetDict

imm32

ImmGetIMEFileNameA ImmNotifyIME ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGetProperty

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

devil

ilBindImage ilDeleteImages ilGenImages ilGetInteger ilLoad ilConvertImage ilCopyPixels ilEnable ilOriginFunc ilInit ilTexImage ilSetPixels ilSave ilShutDown

granny2

_GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyNewWorldPose@4 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyGetSourceModel@4 _GrannyFindTrackGroupForModel@12 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyBeginControlledAnimation@8 _GrannyEndControlledAnimation@4 _GrannySetTrackGroupTarget@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@16 _GrannyCopyMeshIndices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshVertices@12 _GrannySetTrackGroupLOD@16 _GrannyGetMeshVertexType@4

mss32

_AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_update_3D_position@8 _AIL_auto_update_3D_position@8 _AIL_set_sample_file@12 _AIL_mem_free_lock@4

speedtreert

?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ

dinput8

DirectInput8Create

ws2_32

inet_addr htons htonl WSACleanup WSAStartup WSAGetLastError ntohs send select recv ioctlsocket connect gethostbyname __WSAFDIsSet ntohl gethostname socket closesocket

ddraw

DirectDrawCreate

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

679KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

212KB

Virtual Size

684KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=264, version=35227,

count=49, id=259, version=33145,

count=220, id=261, version=33145,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=59, id=261, version=33523,

count=2, id=262, version=33145,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=5, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=1, id=260, version=35227,

count=44, id=260, version=33145,

count=29, id=257, version=33145,

count=590, id=1, productName=Unmarked objects,

count=107, id=261, version=35207,

count=307, id=261, version=35227,

count=1, id=255, version=35227,

count=1, id=151,

count=1, id=258, version=35227,