2026-08-07_f3c54de1f7d6bcab621f8ee791344989_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_f3c54de1f7d6bcab621f8ee791344989_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 11.1MB
Sample260807-gdpygayajd
SHA256 3becec36012c3d30b3c32a943d7272df539ec59156946ce17eba8f4f5e0737ff
MD5 f3c54de1f7d6bcab621f8ee791344989
SHA1 d4be3048e2a198f03ec30688ea82ec9259b86a49
SHA512 8de9d57371be2654bd74ceb05dd702f18dc50959fa82b6b44eaf1c4cee63a721f9c24be395119193cdbc49f2baa9f275936bbcb821f7744a5758f7b1ecfc152e
SSDEEP 98304:8ulGKSyLi48Nm1xfxmI5g5SkkybRCzF22WvlB/nMhPdUdjpqGR+Qf4v8vp:BlGKSyLH8Q/fxmIZVhP
TLSH
T1D3C6FA82E88399B1F5172E721A16C377463B21355A31FDC6F2E4A988A722DDB077533C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_f3c54de1f7d6bcab621f8ee791344989_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-07_f3c54de1f7d6bcab621f8ee791344989_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 11.1MB

2026-08-07_f3c54de1f7d6bcab621f8ee791344989_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 2c12c2a702c2320d1ceae7807fdec8f7
SHA256 3becec36012c3d30b3c32a943d7272df539ec59156946ce17eba8f4f5e0737ff
MD5 f3c54de1f7d6bcab621f8ee791344989
SHA1 d4be3048e2a198f03ec30688ea82ec9259b86a49
SHA512 8de9d57371be2654bd74ceb05dd702f18dc50959fa82b6b44eaf1c4cee63a721f9c24be395119193cdbc49f2baa9f275936bbcb821f7744a5758f7b1ecfc152e
SSDEEP 98304:8ulGKSyLi48Nm1xfxmI5g5SkkybRCzF22WvlB/nMhPdUdjpqGR+Qf4v8vp:BlGKSyLH8Q/fxmIZVhP
TLSH
T1D3C6FA82E88399B1F5172E721A16C377463B21355A31FDC6F2E4A988A722DDB077533C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThreadId VirtualAlloc ReadProcessMemory GetModuleHandleA LoadResource LockResource SizeofResource FindResourceA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc InitializeCriticalSectionEx GetLastError CloseHandle DecodePointer GetTempPathA WriteFile SetFilePointer LoadLibraryExA GetSystemDirectoryW CreateMutexA ReleaseMutex GetProcessAffinityMask SetConsoleTextAttribute GetConsoleScreenBufferInfo InitializeConditionVariable InitializeSRWLock InitOnceComplete InitOnceBeginInitialize MoveFileExA SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW CreateFileA GetCommandLineA GlobalAlloc GlobalUnlock GlobalLock GetLocaleInfoA GetSystemDefaultLCID GetUserDefaultLocaleName DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleW GetCurrentDirectoryA CreateDirectoryA GetFileAttributesA LocalFileTimeToFileTime ReadFile SetFileTime SystemTimeToFileTime Sleep GlobalMemoryStatusEx GetSystemDirectoryA GetWindowsDirectoryA GetNativeSystemInfo GetModuleFileNameA LoadLibraryW GetWindowsDirectoryW MultiByteToWideChar GetACP SetEvent WaitForSingleObject CreateEventA SetCurrentDirectoryA CopyFileA MoveFileA VirtualFree OutputDebugStringA GetFullPathNameA FormatMessageA LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime WakeConditionVariable WakeAllConditionVariable CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess RtlUnwind InterlockedFlushSList SetLastError VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetCurrentThread GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW HeapQueryInformation

user32

MessageBoxW MessageBoxA UnregisterClassA SetProcessDPIAware InvalidateRect MapVirtualKeyA ToAscii EnumDisplaySettingsA LoadCursorA GetDesktopWindow SetWindowLongA GetWindowLongA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos ShowCursor GetWindowRect GetClientRect SetWindowTextW EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow GetSystemMetrics ReleaseCapture SetCapture GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetSystemMenu RemoveMenu GetKeyNameTextW MapVirtualKeyW wsprintfA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PeekMessageW PostMessageA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow ShowWindow MoveWindow SetWindowPos GetFocus

dbghelp

MiniDumpWriteDump

urlmon

URLDownloadToFileA

dnsapi

DnsFree DnsQuery_A

wsock32

ntohs recv recvfrom select send ntohl setsockopt socket gethostbyname WSAStartup WSACleanup listen ioctlsocket htons inet_ntoa htonl getsockname getpeername sendto connect closesocket bind accept

winmm

timeBeginPeriod timeGetDevCaps timeKillEvent timeSetEvent timeEndPeriod timeGetTime

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCompileShader D3DXCreateEffectFromFileA D3DXMatrixMultiply D3DXMatrixTranspose D3DXMatrixOrthoOffCenterLH

dinput8

DirectInput8Create

gdi32

GetStockObject GetDeviceCaps AddFontResourceA RemoveFontResourceA

advapi32

RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize

d3dxof

DirectXFileCreate

fmod

_FSOUND_Sample_SetDefaults@20 _FSOUND_Sample_GetDefaults@20 _FSOUND_Close@0 _FSOUND_Update@0 _FSOUND_Sample_Load@20 _FSOUND_PlaySound@8 _FSOUND_PlaySoundEx@16 _FSOUND_StopSound@4 _FSOUND_SetFrequency@8 _FSOUND_SetVolume@8 _FSOUND_SetPan@8 _FSOUND_SetPaused@8 _FSOUND_3D_SetAttributes@12 _FSOUND_Sample_Free@4 _FSOUND_3D_Listener_SetAttributes@32 _FSOUND_3D_SetDopplerFactor@4 _FSOUND_3D_SetDistanceFactor@4 _FSOUND_3D_SetRolloffFactor@4 _FSOUND_Stream_Open@16 _FSOUND_Stream_Close@4 _FSOUND_Stream_Play@8 _FSOUND_Stream_Stop@4 _FSOUND_CD_Play@8 _FSOUND_CD_SetPlayMode@8 _FSOUND_CD_Stop@4 _FSOUND_CD_SetPaused@8 _FSOUND_CD_SetVolume@8 _FSOUND_Sample_SetMode@8 _FSOUND_Init@12 _FSOUND_IsPlaying@4 _FSOUND_SetHWND@4

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

891KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=62, id=259, version=33145,

count=218, id=261, version=33145,

count=49, id=260, version=33145,

count=8, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=94, id=261, version=35207,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=47, productName=Unmarked objects (old),

count=369, id=260, version=35228,

count=25, id=257, version=33145,

count=352, id=1, productName=Unmarked objects,

count=86, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,