2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 3.6MB
Sample260730-d6plmayeph
SHA256 9258a4335c97ce2fa71a865fa3a6c11d4066fb5f3073b0f7efed9e4dbd44021b
MD5 4077b29d14d79c80284569e23e268f45
SHA1 faa30cffb5cbbbdb723b919c01f4e2cd91dcdc85
SHA512 74072cb9ea82022e508e739f93d9e4f8757f2b00ba06f461c97f8e54e98dced8569e31dd49b04dfbe8468d2995fc9dafcdc0454c82093776490e1e0037abbc06
SSDEEP 49152:RaapY/J1HB7tIa2ZmHfeLAGyX9RFEVFIbod/EjQMKMZ288J+KVBtvtMtedpxzwCM:tpggaUm/eoXnmVFtd/2KTjZ
TLSH
T1CC067D30BB06887BE5C312B55E7CB76A85299F320B715CC393E47A6D1E611C22733A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 3.6MB

2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 4b099b64675d52fffe8adbc41c69d595
SHA256 9258a4335c97ce2fa71a865fa3a6c11d4066fb5f3073b0f7efed9e4dbd44021b
MD5 4077b29d14d79c80284569e23e268f45
SHA1 faa30cffb5cbbbdb723b919c01f4e2cd91dcdc85
SHA512 74072cb9ea82022e508e739f93d9e4f8757f2b00ba06f461c97f8e54e98dced8569e31dd49b04dfbe8468d2995fc9dafcdc0454c82093776490e1e0037abbc06
SSDEEP 49152:RaapY/J1HB7tIa2ZmHfeLAGyX9RFEVFIbod/EjQMKMZ288J+KVBtvtMtedpxzwCM:tpggaUm/eoXnmVFtd/2KTjZ
TLSH
T1CC067D30BB06887BE5C312B55E7CB76A85299F320B715CC393E47A6D1E611C22733A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

1e:25:7d:75:8c:54:d1:c3:69:25:de:38:7a:d1:64:22:55:23:23:c2:f2:13:09:87:ff:2f:bd:50:08:28:42:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Jul 14, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

648464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb

rpcrt4

RpcStringBindingComposeW UuidCreate UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcObjectSetType RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall NdrAsyncClientCall NdrAsyncServerCall RpcStringBindingParseW NdrClientCall2 NdrServerCall2 RpcServerUnregisterIf RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcStringFreeW RpcBindingFromStringBindingW RpcBindingFree

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSetProperty BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptOpenAlgorithmProvider

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

shell32

ord165 SHGetKnownFolderPath

ntdll

RtlNtStatusToDosError RtlGetLastNtStatus NtClose NtSetInformationThread NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext VerSetConditionMask NtSystemDebugControl RtlDllShutdownInProgress NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlUnwind

kernel32

GetModuleFileNameA DebugBreak GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx ResetEvent GetTickCount64 SetLastError OutputDebugStringW IsDebuggerPresent Sleep SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime TerminateThread ResumeThread GetTickCount SetThreadPriority GetCurrentProcess LocalFree RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime LocalAlloc InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessTimes ReadProcessMemory GetThreadId CreateProcessW TerminateProcess GetExitCodeProcess GetPriorityClass ProcessIdToSessionId K32GetProcessMemoryInfo InitializeCriticalSectionEx LoadLibraryW CompareFileTime QueryFullProcessImageNameW FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime TlsAlloc TlsGetValue TlsSetValue FreeLibrary LoadLibraryExW GetModuleHandleExW ExpandEnvironmentStringsW GetFileAttributesW GetSystemDirectoryW SetErrorMode VirtualProtect HeapReAlloc GlobalMemoryStatusEx GetEnvironmentVariableW GetThreadPriority GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose CreateDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FormatMessageA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetCurrentThreadId FormatMessageW CompareStringW GetCurrentThread HeapFree GetProcessHeap HeapAlloc GetModuleFileNameW VerifyVersionInfoW SetConsoleCtrlHandler SetDllDirectoryW GetProcAddress GetModuleHandleW WaitForSingleObject GetProcessId GetNamedPipeServerProcessId GetFileTime CreateFileW MultiByteToWideChar ContinueDebugEvent DebugActiveProcessStop GetFileAttributesExW GetSystemTimeAsFileTime OpenThread DebugBreakProcess SetEvent WaitForDebugEvent DebugSetProcessKillOnExit DebugActiveProcess WideCharToMultiByte VirtualQueryEx GetThreadContext K32GetProcessImageFileNameW K32GetModuleBaseNameW K32EnumProcessModules OpenProcess WaitForMultipleObjects GetLastError CreateEventW CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetStdHandle HeapSize HeapQueryInformation WriteConsoleW UnregisterWaitEx ReadDirectoryChangesW WaitForThreadpoolWaitCallbacks AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetLocaleInfoEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent RegisterWaitForSingleObject WakeConditionVariable InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer FlsFree SwitchToThread WaitForSingleObjectEx GetNativeSystemInfo GetProcessHandleCount K32EnumProcesses RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter LCMapStringEx GetSystemInfo FlushInstructionCache CheckRemoteDebuggerPresent FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess GetCommandLineW GetCommandLineA GetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait LoadLibraryExA K32GetPerformanceInfo SetEnvironmentVariableW CreateThread

user32

RegisterWindowMessageW LoadStringW PeekMessageW SetWindowLongW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo SendMessageW PostMessageW GetSystemMetrics RegisterClassExW GetClassInfoExW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfig2W ChangeServiceConfig2W StartServiceCtrlDispatcherW OpenSCManagerW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegDeleteKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW FreeSid RegOpenKeyExW CheckTokenMembership DuplicateToken StartServiceW AllocateAndInitializeSid ConvertSecurityDescriptorToStringSecurityDescriptorW GetFileSecurityW ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf EqualSid OpenProcessToken GetTokenInformation EventUnregister EventRegister EventWriteTransfer RegCloseKey QueryServiceStatus OpenThreadToken CloseServiceHandle ControlService ChangeServiceConfigW CreateServiceW DeleteService OpenServiceW SetThreadToken

ole32

CoTaskMemFree CoCreateGuid

powrprof

CallNtPowerInformation

fltlib

FilterSendMessage FilterGetMessage FilterReplyMessage FilterLoad FilterConnectCommunicationPort

shlwapi

PathAppendW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

693KB

Virtual Size

693KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

407KB

Virtual Size

438KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

rpcrt4

bcrypt

wtsapi32

shell32

ntdll

kernel32

user32

advapi32

ole32

powrprof

fltlib

shlwapi

version

generic