2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 991KB
Sample260804-xj31aafd64
SHA256 3a74ac2323b15d601e102897a99f5fc3c37b9a34655ec0814daf380a25cc422a
MD5 a845bfb2d247d0c7f441c420f4646c98
SHA1 7256164f0152ef5a2a76a0447f91fd860be46db7
SHA512 0d4bdb1282f81205dc3f72f174098253e396ddfd4bd8e84b1680a272a91d7988b67802c1cd0ac595597f691d9017a7accee1e543ddb41f6fab55f017d6dcec46
SSDEEP 24576:9ed19X4vqJU5gTXfGrGW4bKH0MZJjPrDWHTQS+FDPuGQe18:9OX4SJU56fmGW4bKH0MZJjrDKQtPu48
TLSH
T189253932FD538031C5A1103E5A2AF6677FAD6EE03BA109DB93C8372D5AB04CD1A79716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 991KB

2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 8f5aabf380ee15c77fa80459871539e9
SHA256 3a74ac2323b15d601e102897a99f5fc3c37b9a34655ec0814daf380a25cc422a
MD5 a845bfb2d247d0c7f441c420f4646c98
SHA1 7256164f0152ef5a2a76a0447f91fd860be46db7
SHA512 0d4bdb1282f81205dc3f72f174098253e396ddfd4bd8e84b1680a272a91d7988b67802c1cd0ac595597f691d9017a7accee1e543ddb41f6fab55f017d6dcec46
SSDEEP 24576:9ed19X4vqJU5gTXfGrGW4bKH0MZJjPrDWHTQS+FDPuGQe18:9OX4SJU56fmGW4bKH0MZJjrDKQtPu48
TLSH
T189253932FD538031C5A1103E5A2AF6677FAD6EE03BA109DB93C8372D5AB04CD1A79716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

374022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\7.Works\RAONK\K.Launcher\bin\raonklauncher.pdb

kernel32

SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection CloseHandle MulDiv lstrcmpW LoadLibraryW GetModuleFileNameW DecodePointer lstrcmpiW LoadLibraryExW GetModuleHandleW MultiByteToWideChar GetFileAttributesW GlobalSize WriteFile CreateFileW GetVersionExW ReadFile SetFilePointerEx SetFilePointer GetLocalTime WideCharToMultiByte VerSetConditionMask FindClose GetFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime CreateProcessW ExpandEnvironmentStringsW GetTempPathW GetWindowsDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW DeleteFileW FindFirstFileW FindNextFileW MoveFileW VerifyVersionInfoW GetNumberFormatW SetThreadLocale GetUserDefaultUILanguage GetUserDefaultLCID SetThreadUILanguage ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation SetConsoleCtrlHandler EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetCurrentThread GetACP GetStdHandle GetModuleFileNameA ExitProcess MoveFileExW CreateDirectoryW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep CreateEventW FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetExitCodeThread TerminateThread GetCurrentThreadId GetCurrentProcessId GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalAlloc GetProcAddress FreeLibrary InterlockedDecrement InterlockedIncrement FindResourceExW FindResourceW SizeofResource LoadResource RaiseException GetProcessHeap LockResource HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetCommandLineW WriteConsoleW

user32

CreateWindowExW IsWindow IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes MoveWindow SetWindowPos GetClassInfoExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW RegisterWindowMessageW GetSystemMetrics SetWindowContextHelpId MapWindowPoints MapDialogRect MonitorFromWindow GetMonitorInfoW SendMessageTimeoutW CopyRect SystemParametersInfoW MonitorFromPoint CallWindowProcW EnableWindow RegisterClipboardFormatW DialogBoxParamW DialogBoxIndirectParamW GetDlgItem CharNextW SetFocus GetFocus SetCapture ReleaseCapture SetTimer KillTimer CreateAcceleratorTableW DestroyAcceleratorTable GetDC ReleaseDC BeginPaint EndPaint InvalidateRect InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect ClientToScreen ScreenToClient GetSysColor FillRect GetClipboardData CloseClipboard OpenClipboard EnumChildWindows PtInRect EqualRect GetCursorPos GetWindowRect SetForegroundWindow GetAsyncKeyState EndDialog BringWindowToTop IsWindowVisible CreateDialogParamW GetClassInfoW RegisterClassW PeekMessageW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW LoadCursorW GetWindow GetClassNameW FindWindowW GetParent GetDesktopWindow SetWindowLongW GetWindowLongW

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetStockObject SelectObject GetObjectW BitBlt GetDeviceCaps

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegCloseKey RegEnumKeyExW RegDeleteValueW

shell32

DragFinish DragAcceptFiles SHGetMalloc ord155 SHGetPathFromIDListW DragQueryFileW SHGetSpecialFolderLocation SHBrowseForFolderW SHParseDisplayName ShellExecuteW FindExecutableW ShellExecuteExW SHGetSpecialFolderPathW SHCreateShellItem

ole32

CoCreateGuid CoTaskMemRealloc CoUninitialize CoInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear LoadTypeLi VarUI4FromStr OleCreateFontIndirect LoadRegTypeLi SysAllocString

shlwapi

ord219 ord176 StrFormatByteSizeW AssocQueryStringW PathIsDirectoryEmptyW PathCombineW

comctl32

InitCommonControlsEx

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRect GdipGraphicsClear GdipGetAllPropertyItems GdipGetPropertySize GdipImageRotateFlip GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipSetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipSaveImageToFile

Name

.text

Size

692KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_a845bfb2d247d0c7f441c420f4646c98_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

generic