2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

General

Target
2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader
Size 2.2MB
Sample260804-jb4d7afc44
SHA256 5f5d61be2aa8afefb4c31dbd8891eb17a4d7b07872eb9257e0c1f243d4ec4133
MD5 44830218d2a6aed979abff430a846786
SHA1 62fc967493d0a63fc56a581562722d911eececc3
SHA512 7b832869b3ba23d79bc80804aa0c6fde47145f65a134510c0dd6110eec5bfd2b7380affe025dab3bb1d46f141367809b0d0650d390b3e665729e564b022655b8
SSDEEP 49152:uM+zUygwwzXXuGVRVirw7g+jzTV2oiKYlzLinFpb5+Pl6bJTIZ5jdgp:voUBfZYlzLiDslgJTIZ5Bgp
TLSH
T1F6B57C725292F525C6B880F0DEE4DA6CCDEDACE4EBFA30E3B584257668F4890CD6C511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

.exe 2.2MB

2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

IMPHASH acdb634666a13a92f0cf2b1536394ec9
SHA256 5f5d61be2aa8afefb4c31dbd8891eb17a4d7b07872eb9257e0c1f243d4ec4133
MD5 44830218d2a6aed979abff430a846786
SHA1 62fc967493d0a63fc56a581562722d911eececc3
SHA512 7b832869b3ba23d79bc80804aa0c6fde47145f65a134510c0dd6110eec5bfd2b7380affe025dab3bb1d46f141367809b0d0650d390b3e665729e564b022655b8
SSDEEP 49152:uM+zUygwwzXXuGVRVirw7g+jzTV2oiKYlzLinFpb5+Pl6bJTIZ5jdgp:voUBfZYlzLiDslgJTIZ5Bgp
TLSH
T1F6B57C725292F525C6B880F0DEE4DA6CCDEDACE4EBFA30E3B584257668F4890CD6C511
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

62445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\csgo_pcbeta_win32\build\src\launcher_main\Release\csgo.pdb

user32

MessageBoxW wsprintfW wsprintfA

advapi32

RegOpenKeyExW RegGetValueW

kernel32

SetEvent ResetEvent IsProcessorFeaturePresent FindFirstFileW GetFileSizeEx GetCommandLineW FindNextFileW GetModuleFileNameW GetEnvironmentVariableW GetEnvironmentVariableA FindClose WaitForSingleObject CreateFileW UnmapViewOfFile MultiByteToWideChar FormatMessageW GetLastError CloseHandle GetProcAddress CreateFileMappingA LocalFree ExitProcess CreateProcessW MapViewOfFile LoadLibraryExW GetExitCodeProcess VirtualProtect SetLastError WriteFile VirtualAlloc SetFilePointer GetSystemDirectoryW GetModuleHandleA GetSystemInfo AddVectoredExceptionHandler GetWindowsDirectoryW GetCurrentProcessId GetSystemTimeAsFileTime VirtualQuery EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetExitCodeThread CreateFileA CreateThread WideCharToMultiByte WriteProcessMemory GetCurrentProcess CreateMutexA ReleaseMutex VirtualAllocEx DeleteCriticalSection FlushInstructionCache LocalAlloc GetFileInformationByHandle LoadLibraryA CreateFileMappingW InitializeSListHead QueryPerformanceCounter GetCurrentThreadId IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW TerminateProcess InterlockedPushEntrySList RaiseException EncodePointer RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW GetStdHandle GetModuleFileNameA GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType GetStringTypeW SetFilePointerEx GetConsoleMode WaitForSingleObjectEx FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc WriteConsoleW DecodePointer QueryPerformanceFrequency CreateEventW

Name

.text

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

524KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

657KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_44830218d2a6aed979abff430a846786_amadey_darkgate_elex_luca-stealer_magniber_mespinoza_njrat_remcos_smoke-loader

user32

advapi32

kernel32

generic