2026-07-16_72e653636045804bc59bb8c2b5c9bdb7_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_72e653636045804bc59bb8c2b5c9bdb7_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 3.9MB
Sample260716-2cp73afs8l
SHA256 7c9874c4df87bcfa0a337856f8e2a675f3e4a4c080ef89075de5f3ad505b05dc
MD5 72e653636045804bc59bb8c2b5c9bdb7
SHA1 d1f68cfb9edf2ecb1e643be2f57cc60e28bbc7fa
SHA512 113b399f27c6bb72bb150cc2bfc6252b545ce7716f3aa69093b88957076c146646906490a77c5641c7ad5558115cce419ed65f8ed80c0cf41104057616aa6eb4
SSDEEP 98304:W1sfejM1teM6w4sig1Ltg1IDSV1HiMRQ/ymS0uu:W9M1tev0e2uXe/YBu
TLSH
T11716DFF965CC4039E592307099AA77EB49E9EDF037F074D39284FF6949301F12A3626A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-16_72e653636045804bc59bb8c2b5c9bdb7_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 3.9MB

2026-07-16_72e653636045804bc59bb8c2b5c9bdb7_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH ac7a4ff5ddca86eaa190aacda690cdd9
SHA256 7c9874c4df87bcfa0a337856f8e2a675f3e4a4c080ef89075de5f3ad505b05dc
MD5 72e653636045804bc59bb8c2b5c9bdb7
SHA1 d1f68cfb9edf2ecb1e643be2f57cc60e28bbc7fa
SHA512 113b399f27c6bb72bb150cc2bfc6252b545ce7716f3aa69093b88957076c146646906490a77c5641c7ad5558115cce419ed65f8ed80c0cf41104057616aa6eb4
SSDEEP 98304:W1sfejM1teM6w4sig1Ltg1IDSV1HiMRQ/ymS0uu:W9M1tev0e2uXe/YBu
TLSH
T11716DFF965CC4039E592307099AA77EB49E9EDF037F074D39284FF6949301F12A3626A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

1e:91:13:70:0f:92:3b:30:c8:3c:12:d0:2a:a2:30:a2:20:80:3a:01:65:b9:ad:73:7c:50:57:05:8e:5b:8e:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310114MA1GWA6R46,CN=Shanghai Baizhi Network Technology Co.\, Ltd.,O=Shanghai Baizhi Network Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e59889e5ae9ae58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 1, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

c1:28:8f:b3:77:01:63:95:d2:5e:49:53:34:cc:d5:d5:98:7e:68:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 1, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0e:42:7d:e0:3b:67:1d:c4:64:de:f6:c3:8b:ee:92:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 16, 2023 - Aug 15, 2026

Minor OS version

Major OS version

Entry point

636185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\build\trunk_en_android14_脚本\simulator\bin\ldrecordcontrol.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency FindNextFileW GlobalFree GetProcessHeap HeapAlloc HeapFree GetCurrentProcess SetLastError GetDriveTypeW TerminateThread CreateThread GetFileSizeEx MoveFileExW DeleteFileW GetTempPathW FreeLibrary GetStdHandle CreateProcessW TerminateProcess GetStartupInfoW InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter MulDiv GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx FlushFileBuffers CreateMutexW GetConsoleMode ReadConsoleW GetTimeZoneInformation GetFullPathNameW SetStdHandle FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW SetEndOfFile LoadLibraryA GetModuleHandleA GetSystemDirectoryA FormatMessageW GetExitCodeThread SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetPrivateProfileStringW GetACP ExitProcess FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW FreeResource ReadFile GetFileSize FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW GetCPInfo GetStringTypeW LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer InitializeCriticalSectionEx SleepEx MoveFileExA GetEnvironmentVariableA GlobalUnlock WaitForMultipleObjects SetFilePointer WriteFile GlobalLock VerifyVersionInfoW CreateFileA GetCurrentThreadId GlobalAlloc GetLocalTime GetConsoleOutputCP GetSystemInfo GetExitCodeProcess GetProcAddress LoadLibraryW GetVersionExW OpenMutexW GetLastError GetModuleFileNameW CloseHandle Sleep GetUserDefaultUILanguage GetTickCount WideCharToMultiByte DeleteCriticalSection SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection LeaveCriticalSection IsDebuggerPresent EnterCriticalSection

user32

InvalidateRgn CreateAcceleratorTableW MoveWindow GetWindowTextLengthW GetWindowTextW GetSysColor ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret LoadImageW GetPropW SetPropW GetSystemMetrics EnableWindow GetClassInfoExW RegisterClassExW RegisterClassW CallWindowProcW DefWindowProcW LoadCursorW OffsetRect SetCursor wvsprintfW SetRect DrawTextW PostQuitMessage ShowWindow SetWindowTextW GetDC GetDesktopWindow GetMessageW FindWindowExW TranslateMessage DispatchMessageW SendMessageW PostMessageW CreateWindowExW IsWindow DestroyWindow SetWindowPos IsWindowVisible IsIconic CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetWindowRect GetCursorPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow IsZoomed SetWindowRgn FillRect MonitorFromWindow GetMonitorInfoW CharPrevW GetGUIThreadInfo

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptImportKey CryptDestroyKey CryptEncrypt

shell32

ShellExecuteW SHGetPathFromIDListW ShellExecuteExW SHGetSpecialFolderLocation ord165

d2d1

ord1

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmGetContext ImmReleaseContext

msimg32

AlphaBlend

comctl32

_TrackMouseEvent ord17

wininet

InternetGetConnectedState InternetCrackUrlW InternetOpenW InternetConnectW HttpSendRequestW InternetReadFile HttpQueryInfoW InternetCloseHandle HttpOpenRequestW

msi

ord173 ord217

iphlpapi

GetAdaptersInfo

ntdll

VerSetConditionMask

gdi32

GetDeviceCaps GdiFlush ExtTextOutW SetWindowOrgEx CreateRoundRectRgn CreateSolidBrush GetObjectW CreatePatternBrush GetTextMetricsW TextOutW MoveToEx GetObjectA CreateDIBSection SetTextColor StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC SelectObject CreatePenIndirect SetStretchBltMode

ole32

CoCreateGuid OleLockRunning CoUninitialize CoInitialize CLSIDFromProgID CLSIDFromString CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

shlwapi

PathFileExistsW

ws2_32

select __WSAFDIsSet WSAIoctl socket setsockopt htonl htons getsockname getpeername connect bind accept WSAStartup WSACleanup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent listen freeaddrinfo recvfrom sendto ioctlsocket gethostname recv getaddrinfo getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect

gdiplus

GdipGetPropertyItem GdipGetPropertyItemSize GdipAlloc GdipFree GdipLoadImageFromFile GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectI GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipGetImageGraphicsContext GdipImageSelectActiveFrame GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDeleteFontFamily GdipImageGetFrameCount GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipCreateBitmapFromScan0 GdipCreateFontFromDC

bcrypt

BCryptGenRandom

wldap32

ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord301 ord200 ord30 ord79 ord35 ord33 ord32

crypt32

CertFreeCertificateContext CryptStringToBinaryA CertFreeCertificateChain PFXImportCertStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertAddCertificateContextToStore CertFindExtension CertGetCertificateChain CertGetNameStringA CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx

normaliz

IdnToUnicode IdnToAscii

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_72e653636045804bc59bb8c2b5c9bdb7_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

advapi32

shell32

d2d1

imm32

msimg32

comctl32

wininet

msi

iphlpapi

ntdll

gdi32

ole32

oleaut32

shlwapi

ws2_32

gdiplus

bcrypt

wldap32

crypt32

normaliz

generic