stihat | 2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk
Size 9.9MB
Sample260808-dp572sbd64
SHA256 8dd00422a0f53ef8cb2e915df13b34986a25329623360380518fffa5dd7dfb8e
MD5 8b2e5eefeacab4d1173f87d745f04329
SHA1 5476b021869cc70e1e55795f7a130c781523ba25
SHA512 772f9f7c930b9bf798f7d9bf7ca5694f4f37ede34607974247622827975a1b34f5c8abedce4261e4210808627260b0ad5b5ae48c0abb25cd3feba52960b728bf
SSDEEP 98304:9E2R1IMo8WbGOIghnW8Dz1GHrHwe1auRa1J:9nzI3e8Dz1kxNs
TLSH
T11AA68C57B072A4B6E9D8453440F7FF2A3CF5F91102C2494DDA79226B4FB3868ADB01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm stihat

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 1 IoCs

resource	yara_rule
sample	family_stihat

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk

File Explorer

2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk

.exe 9.9MB

2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk

IMPHASH 12fcd3183e0fb67f1e38925ed5c0c47c
SHA256 8dd00422a0f53ef8cb2e915df13b34986a25329623360380518fffa5dd7dfb8e
MD5 8b2e5eefeacab4d1173f87d745f04329
SHA1 5476b021869cc70e1e55795f7a130c781523ba25
SHA512 772f9f7c930b9bf798f7d9bf7ca5694f4f37ede34607974247622827975a1b34f5c8abedce4261e4210808627260b0ad5b5ae48c0abb25cd3feba52960b728bf
SSDEEP 98304:9E2R1IMo8WbGOIghnW8Dz1GHrHwe1auRa1J:9nzI3e8Dz1kxNs
TLSH
T11AA68C57B072A4B6E9D8453440F7FF2A3CF5F91102C2494DDA79226B4FB3868ADB01B9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Stihat payload
Detects executables packed with ASPack
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

380800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA lstrcpyA WritePrivateProfileStringA WriteFile WinExec WaitForSingleObject VirtualQuery VirtualAlloc UnmapViewOfFile Sleep SizeofResource SetThreadLocale SetFilePointer SetFileAttributesA SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile MultiByteToWideChar MulDiv MoveFileA MapViewOfFile LockResource LocalFree LoadResource LoadLibraryA LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalReAlloc GlobalHandle GlobalLock GlobalFree GlobalFindAtomA GlobalDeleteAtom GlobalAlloc GlobalAddAtomA GetVersionExA GetVersion GetTickCount GetThreadLocale GetTempPathA GetSystemInfo GetSystemDirectoryA GetStringTypeA GetStdHandle GetShortPathNameA GetProcAddress GetPrivateProfileStringA GetModuleHandleA GetModuleFileNameA GetLogicalDriveStringsA GetLocaleInfoA GetLocalTime GetLastError GetFullPathNameA GetFileAttributesA GetExitCodeThread GetDriveTypeA GetDiskFreeSpaceA GetDateFormatA GetCurrentThreadId GetCurrentProcessId GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchange InterlockedDecrement FreeLibrary FormatMessageA FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoA EnterCriticalSection DeleteFileA DeleteCriticalSection CreateThread CreateFileA CreateEventA CopyFileA CompareStringA CloseHandle Sleep

user32

GetKeyboardType LoadStringA MessageBoxA CharNextA CreateWindowExA WindowFromPoint WinHelpA WaitMessage UpdateWindow UnregisterClassA UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoA ShowWindow ShowScrollBar ShowOwnedPopups ShowCursor SetWindowsHookExA SetWindowTextA SetWindowPos SetWindowPlacement SetWindowLongA SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropA SetParent SetMenuItemInfoA SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongA SetCapture SetActiveWindow SendMessageA ScrollWindow ScreenToClient RemovePropA RemoveMenu ReleaseDC ReleaseCapture RegisterClipboardFormatA RegisterClipboardFormatA RegisterClassA RedrawWindow PtInRect PostQuitMessage PostMessageA PeekMessageA OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjects MessageBoxA MessageBeep MapWindowPoints MapVirtualKeyA LoadStringA LoadKeyboardLayoutA LoadIconA LoadCursorA LoadBitmapA KillTimer IsZoomed IsWindowVisible IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsChild InvalidateRect IntersectRect InsertMenuItemA InsertMenuA InflateRect GetWindowThreadProcessId GetWindowTextA GetWindowRect GetWindowPlacement GetWindowLongA GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropA GetParent GetWindow GetMenuStringA GetMenuState GetMenuItemInfoA GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextA GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameA GetClassInfoA GetCapture GetActiveWindow FrameRect FindWindowA FillRect ExitWindowsEx EqualRect EnumWindows EnumThreadWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextA DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawEdge DispatchMessageA DestroyWindow DestroyMenu DestroyCursor DestroyCursor DeleteMenu DefWindowProcA DefMDIChildProcA DefFrameProcA CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CallWindowProcA CallNextHookEx BeginPaint CharNextA CharLowerBuffA CharLowerA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA RegFlushKey RegCreateKeyExA RegCloseKey SetSecurityInfo SetEntriesInAclA GetSecurityInfo

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo SysFreeString

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RestoreDC Rectangle RectVisible RealizePalette PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPointA GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectA CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA BitBlt

ole32

OleUninitialize OleInitialize CoCreateInstance CoUninitialize CoInitialize

comctl32

ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_GetImageCount ImageList_Destroy ImageList_Create

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA

Name

CODE

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SCY

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

shell32

generic