2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader

General

Target
2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader
Size 1.4MB
Sample260729-tg63daba86
SHA256 9b25274f0b3a7593d6c026624b16d0533416758c3d1e1ec0349f79af1c848728
MD5 2a55790706327c40dec74cea84af140d
SHA1 845f01ae5ec7838330f3a203436f6077c336e423
SHA512 f6c0d2cd4d0a16f01246cc14e36a978401f0131170efbd0bb268da9654361f39dc77967bb5e60b7e535157169486c3464ea60936eae11d01747ca56aba67a1ac
SSDEEP 12288:uWpUhPQFrUo+03/DipGE3zKKIK4UvZ4ldRNwnSa9TB63UNbzK:uWvWL0vbJKN42A7wnNTB8
TLSH
T14465B541536304A7E1613974C46A7B880664BFF93DA3E63AFD54700AFA72BC644336BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader

File Explorer

2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader

.exe 1.4MB

2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader

IMPHASH 75e7fb7458b2e2dd8c3b4d1f0020fc10
SHA256 9b25274f0b3a7593d6c026624b16d0533416758c3d1e1ec0349f79af1c848728
MD5 2a55790706327c40dec74cea84af140d
SHA1 845f01ae5ec7838330f3a203436f6077c336e423
SHA512 f6c0d2cd4d0a16f01246cc14e36a978401f0131170efbd0bb268da9654361f39dc77967bb5e60b7e535157169486c3464ea60936eae11d01747ca56aba67a1ac
SSDEEP 12288:uWpUhPQFrUo+03/DipGE3zKKIK4UvZ4ldRNwnSa9TB63UNbzK:uWvWL0vbJKN42A7wnNTB8
TLSH
T14465B541536304A7E1613974C46A7B880664BFF93DA3E63AFD54700AFA72BC644336BE
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9451

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb

kernel32

GetEnvironmentVariableW GetProcessIoCounters FreeLibrary SetDllDirectoryW VerSetConditionMask GetCurrentProcess SetEnvironmentVariableW GetModuleHandleW WideCharToMultiByte LoadLibraryW GetFileAttributesW VerifyVersionInfoA GetModuleFileNameW MultiByteToWideChar FlushInstructionCache GetProcAddress VirtualProtectEx VirtualAllocEx GetModuleHandleA LoadLibraryExA ExpandEnvironmentStringsW LoadLibraryExW SetFilePointerEx ReadFile CreateFileW CloseHandle IsDebuggerPresent RaiseException GetLastError GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapSize RtlUnwind HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree HeapAlloc SetStdHandle OutputDebugStringW GetStringTypeW CompareStringW LCMapStringW GetConsoleCP GetConsoleMode HeapReAlloc SetEnvironmentVariableA ReadConsoleW FlushFileBuffers WriteConsoleW SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_2a55790706327c40dec74cea84af140d_darkgate_elex_luca-stealer_maze_njrat_rhadamanthys_smoke-loader

kernel32

generic