2026-08-08_4305d9ae42668ef49e48700c22b7edd0_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_4305d9ae42668ef49e48700c22b7edd0_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 12.0MB
Sample260808-xmg7zsshqf
SHA256 1fb90b8f12e4d1c56dbbe2fd680d775f4958e1b400b6fbdd108c5f6e974977dd
MD5 4305d9ae42668ef49e48700c22b7edd0
SHA1 97921c930c8044d93112ab69c979bd6f80bb6f1b
SHA512 aa53cdd8eabadfa1cea55adc36a11bdecadaeff8b528fd28933391eb4ef58340ca7ba7255a3e054000ed6de756c27dffda2dd704ef28a7443c08b3d0d8df9c2e
SSDEEP 98304:7ulGKSyLi48Nm1xfxmI5g5SkkybRCzF22WvlB/nMhP81nVLN3Fen13y:qlGKSyLH8Q/fxmIZVhPyrF
TLSH
T17DC6B782E84399B5F5273E721A0AC37B463B21355931FDC5B2F4A988A712DEB0775338
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_4305d9ae42668ef49e48700c22b7edd0_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-08_4305d9ae42668ef49e48700c22b7edd0_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 12.0MB

2026-08-08_4305d9ae42668ef49e48700c22b7edd0_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 2c12c2a702c2320d1ceae7807fdec8f7
SHA256 1fb90b8f12e4d1c56dbbe2fd680d775f4958e1b400b6fbdd108c5f6e974977dd
MD5 4305d9ae42668ef49e48700c22b7edd0
SHA1 97921c930c8044d93112ab69c979bd6f80bb6f1b
SHA512 aa53cdd8eabadfa1cea55adc36a11bdecadaeff8b528fd28933391eb4ef58340ca7ba7255a3e054000ed6de756c27dffda2dd704ef28a7443c08b3d0d8df9c2e
SSDEEP 98304:7ulGKSyLi48Nm1xfxmI5g5SkkybRCzF22WvlB/nMhP81nVLN3Fen13y:qlGKSyLH8Q/fxmIZVhPyrF
TLSH
T17DC6B782E84399B5F5273E721A0AC37B463B21355931FDC5B2F4A988A712DEB0775338
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThreadId VirtualAlloc ReadProcessMemory GetModuleHandleA LoadResource LockResource SizeofResource FindResourceA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc InitializeCriticalSectionEx GetLastError CloseHandle DecodePointer GetTempPathA WriteFile SetFilePointer LoadLibraryExA GetSystemDirectoryW CreateMutexA ReleaseMutex GetProcessAffinityMask SetConsoleTextAttribute GetConsoleScreenBufferInfo InitializeConditionVariable InitializeSRWLock InitOnceComplete InitOnceBeginInitialize MoveFileExA SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW CreateFileA GetCommandLineA GlobalAlloc GlobalUnlock GlobalLock GetLocaleInfoA GetSystemDefaultLCID GetUserDefaultLocaleName DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleW GetCurrentDirectoryA CreateDirectoryA GetFileAttributesA LocalFileTimeToFileTime ReadFile SetFileTime SystemTimeToFileTime Sleep GlobalMemoryStatusEx GetSystemDirectoryA GetWindowsDirectoryA GetNativeSystemInfo GetModuleFileNameA LoadLibraryW GetWindowsDirectoryW MultiByteToWideChar GetACP SetEvent WaitForSingleObject CreateEventA SetCurrentDirectoryA CopyFileA MoveFileA VirtualFree OutputDebugStringA GetFullPathNameA FormatMessageA LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime WakeConditionVariable WakeAllConditionVariable CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess RtlUnwind InterlockedFlushSList SetLastError VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetCurrentThread GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW HeapQueryInformation

user32

MessageBoxW MessageBoxA UnregisterClassA SetProcessDPIAware InvalidateRect MapVirtualKeyA ToAscii EnumDisplaySettingsA LoadCursorA GetDesktopWindow SetWindowLongA GetWindowLongA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos ShowCursor GetWindowRect GetClientRect SetWindowTextW EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow GetSystemMetrics ReleaseCapture SetCapture GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetSystemMenu RemoveMenu GetKeyNameTextW MapVirtualKeyW wsprintfA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PeekMessageW PostMessageA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow ShowWindow MoveWindow SetWindowPos GetFocus

dbghelp

MiniDumpWriteDump

urlmon

URLDownloadToFileA

dnsapi

DnsFree DnsQuery_A

wsock32

ntohs recv recvfrom select send ntohl setsockopt socket gethostbyname WSAStartup WSACleanup listen ioctlsocket htons inet_ntoa htonl getsockname getpeername sendto connect closesocket bind accept

winmm

timeBeginPeriod timeGetDevCaps timeKillEvent timeSetEvent timeEndPeriod timeGetTime

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCompileShader D3DXCreateEffectFromFileA D3DXMatrixMultiply D3DXMatrixTranspose D3DXMatrixOrthoOffCenterLH

dinput8

DirectInput8Create

gdi32

GetStockObject GetDeviceCaps AddFontResourceA RemoveFontResourceA

advapi32

RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize

d3dxof

DirectXFileCreate

fmod

_FSOUND_Sample_SetDefaults@20 _FSOUND_Sample_GetDefaults@20 _FSOUND_Close@0 _FSOUND_Update@0 _FSOUND_Sample_Load@20 _FSOUND_PlaySound@8 _FSOUND_PlaySoundEx@16 _FSOUND_StopSound@4 _FSOUND_SetFrequency@8 _FSOUND_SetVolume@8 _FSOUND_SetPan@8 _FSOUND_SetPaused@8 _FSOUND_3D_SetAttributes@12 _FSOUND_Sample_Free@4 _FSOUND_3D_Listener_SetAttributes@32 _FSOUND_3D_SetDopplerFactor@4 _FSOUND_3D_SetDistanceFactor@4 _FSOUND_3D_SetRolloffFactor@4 _FSOUND_Stream_Open@16 _FSOUND_Stream_Close@4 _FSOUND_Stream_Play@8 _FSOUND_Stream_Stop@4 _FSOUND_CD_Play@8 _FSOUND_CD_SetPlayMode@8 _FSOUND_CD_Stop@4 _FSOUND_CD_SetPaused@8 _FSOUND_CD_SetVolume@8 _FSOUND_Sample_SetMode@8 _FSOUND_Init@12 _FSOUND_IsPlaying@4 _FSOUND_SetHWND@4

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

891KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=62, id=259, version=33145,

count=218, id=261, version=33145,

count=49, id=260, version=33145,

count=8, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=94, id=261, version=35207,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=47, productName=Unmarked objects (old),

count=369, id=260, version=35228,

count=25, id=257, version=33145,

count=352, id=1, productName=Unmarked objects,

count=86, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,