2026-08-09_29c6b2bc8b46742227679428af7b43ec_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_29c6b2bc8b46742227679428af7b43ec_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader
Size 1.6MB
Sample260809-mcx6cadn2t
SHA256 f994efa959f6ec284e134fd0491e31f5d214584af8abe09904adaba67e78b2d1
MD5 29c6b2bc8b46742227679428af7b43ec
SHA1 4cc0db9f9392a442112a7f4875ed0de3259b9874
SHA512 9468e807f7d1009625ae81780bb12c9a32056c7b4c8d7ac619b80104b52f200e46d2cceb2ee8f1422174cff63ceea1ed33fc24e3bdbe372f6d3cd4ee1cf2e4f0
SSDEEP 49152:jdB6sKczt73LItgoCAWWWWWWWWWWWWWWWWWWWWWWWWJWWWWWWWWWBNRgdU:58sJ7bIuJAWWWWWWWWWWWWWWWWWWWWWH
TLSH
T1E985AE92FE929072E493117145BE6B7618BD7E3087A980DBB3D06D2849700D37A3F76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_29c6b2bc8b46742227679428af7b43ec_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

.exe 1.6MB

2026-08-09_29c6b2bc8b46742227679428af7b43ec_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

IMPHASH 72aa3ac188204b191a188f3b1560ed92
SHA256 f994efa959f6ec284e134fd0491e31f5d214584af8abe09904adaba67e78b2d1
MD5 29c6b2bc8b46742227679428af7b43ec
SHA1 4cc0db9f9392a442112a7f4875ed0de3259b9874
SHA512 9468e807f7d1009625ae81780bb12c9a32056c7b4c8d7ac619b80104b52f200e46d2cceb2ee8f1422174cff63ceea1ed33fc24e3bdbe372f6d3cd4ee1cf2e4f0
SSDEEP 49152:jdB6sKczt73LItgoCAWWWWWWWWWWWWWWWWWWWWWWWWJWWWWWWWWWBNRgdU:58sJ7bIuJAWWWWWWWWWWWWWWWWWWWWWH
TLSH
T1E985AE92FE929072E493117145BE6B7618BD7E3087A980DBB3D06D2849700D37A3F76B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f6:8b:88:0c:72:18:fd:c7:03:16:9f:50:2a:5d:bb:59:af:02:1c:e4:e8:c0:b9:40:7f:7e:3f:44:ab:09:e5:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Orient Webcasting Co.\, Ltd.,O=Shanghai Orient Webcasting Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:d7:af:1e:13:3e:af:9a:7e:18:d9:bb:96:c0:12:88

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - Mar 28, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

883644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers GetLocalTime AllocConsole GetStdHandle GetCommandLineW CreateEventA ReleaseSemaphore SetThreadPriority SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapCreate TryEnterCriticalSection AreFileApisANSI CreateMutexW ReleaseMutex SetUnhandledExceptionFilter Sleep SetLastError LeaveCriticalSection EnterCriticalSection GetModuleHandleW OpenProcess GetExitCodeProcess WaitForSingleObject FormatMessageW GetCurrentProcessId GetModuleFileNameW GetFileAttributesExW ReadFile GetFileSize CloseHandle WriteFile CreateFileW GetTempPathW MoveFileExW DeleteFileW GetFileAttributesW FindClose FindNextFileW GetCurrentProcess GetProcAddress LoadLibraryW GetCurrentThreadId GetSystemInfo GetVersionExW GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection InitializeCriticalSectionAndSpinCount DecodePointer RaiseException WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW GetTickCount TerminateProcess LocalFree GlobalFree GlobalAlloc SetFilePointerEx ReadConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW CreateProcessA WriteConsoleW GetTimeZoneInformation GetConsoleMode GetConsoleCP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent SetEvent GetCPInfo GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer DosDateTimeToFileTime DuplicateHandle GetFileType GlobalUnlock CreateDirectoryW GetLastError GlobalLock InterlockedDecrement InterlockedIncrement CreateSemaphoreA MulDiv FindResourceW SizeofResource LoadResource ExitProcess LockResource FreeResource GetACP VerifyVersionInfoW VerSetConditionMask DeviceIoControl SetFileTime GetFileTime GetCurrentDirectoryW FreeLibrary GetUserDefaultLangID GetSystemDefaultLangID

user32

LoadIconW KillTimer MessageBoxW SetTimer GetMonitorInfoW MonitorFromWindow GetCursorPos PostQuitMessage FindWindowW SendMessageW PostMessageW SetForegroundWindow GetForegroundWindow DrawTextW FillRect SetRect GetDesktopWindow OpenClipboard CloseClipboard wsprintfW GetKeyState RegisterClassW InvalidateRgn CreateAcceleratorTableW MoveWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW GetSysColor ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret CreateCaret EmptyClipboard GetMessageW TranslateMessage DispatchMessageW CreateWindowExW IsWindow DestroyWindow UpdateLayeredWindow SetWindowPos IsZoomed SetFocus GetFocus SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetWindowRect ScreenToClient MapWindowPoints UnionRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow PeekMessageW DefWindowProcW CallWindowProcW CharPrevW RegisterClassExW GetClassInfoExW ShowWindow MsgWaitForMultipleObjects EnableWindow SetPropW GetPropW LoadCursorW SetCursor InflateRect OffsetRect IsIconic SetWindowRgn CharNextW IntersectRect WindowFromPoint GetWindowRgn SetClipboardData

comdlg32

GetSaveFileNameW

advapi32

OpenProcessToken CreateServiceW OpenSCManagerW DeleteService ControlService StartServiceW QueryServiceStatusEx CloseServiceHandle OpenServiceW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW GetTokenInformation

shell32

CommandLineToArgvW ShellExecuteExW Shell_NotifyIconW

shlwapi

PathFileExistsW ord219 SHGetValueW PathRemoveFileSpecW SHDeleteValueW SHSetValueW

gdiplus

GdipDeleteBrush GdipCreateLineBrushI GdipSetTextRenderingHint GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreateSolidFill GdipCreatePen1 GdipCloneBrush GdipSetPenMode GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipMeasureString GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipLoadImageFromStream GdipLoadImageFromStreamICM GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipDeleteGraphics GdipDeletePen GdipDrawArcI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipCreateFromHDC

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

psapi

GetProcessImageFileNameW EnumProcesses GetModuleFileNameExW

winmm

timeEndPeriod timeSetEvent timeKillEvent

comctl32

_TrackMouseEvent ord17

gdi32

TextOutW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC GetTextMetricsW CreateDIBSection GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateDCW GetDIBits GetObjectA GetDeviceCaps PtInRegion CombineRgn MoveToEx SelectObject CreateRectRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal RevokeDragDrop RegisterDragDrop CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString VariantInit

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=188, id=243, version=40116,

count=32, id=242, version=40116,

count=39, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=261, version=23013,

count=25, id=259, version=24123,

count=59, id=261, version=24123,

count=36, id=260, version=24123,

count=1, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=47, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=480, id=1, productName=Unmarked objects,

count=33, id=265, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,