2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 683KB
Sample260810-blj5assvds
SHA256 740c0375f470948b1d05bf916d4b08d14438e4e17d94bb6e6cd2e0a325fd2ce7
MD5 0a7a7b0882aa4ed1652c80054064b81a
SHA1 c6443af0374517e97fba8fcc102749e875855382
SHA512 14ca828775e7141cbcbe50a1085b8e3ef84f3bcd29c822d1ede820e1ae232e585e1f6b15281be8f4018aeba649eafbdbc732f309d1eea7492310704f18cc4dd7
SSDEEP 12288:pyLY4vBLM8dZChLQ/JhNE0BPLJp4o9lr23:MLY4vBYDLINE0dJz
TLSH
T19AE49E2276C4C03AE2732230593C97989A7AF8714F77499B63C016AD5A389D2DF31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 683KB

2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 50b04dd9e5315951477a3d2d782dc921
SHA256 740c0375f470948b1d05bf916d4b08d14438e4e17d94bb6e6cd2e0a325fd2ce7
MD5 0a7a7b0882aa4ed1652c80054064b81a
SHA1 c6443af0374517e97fba8fcc102749e875855382
SHA512 14ca828775e7141cbcbe50a1085b8e3ef84f3bcd29c822d1ede820e1ae232e585e1f6b15281be8f4018aeba649eafbdbc732f309d1eea7492310704f18cc4dd7
SSDEEP 12288:pyLY4vBLM8dZChLQ/JhNE0BPLJp4o9lr23:MLY4vBYDLINE0dJz
TLSH
T19AE49E2276C4C03AE2732230593C97989A7AF8714F77499B63C016AD5A389D2DF31B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

285268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoTaskMemAlloc CoInitialize CoUninitialize CoCreateGuid StringFromGUID2 IIDFromString CoTaskMemFree CoTaskMemRealloc CoCreateInstance

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

GetMessageA TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA MsgWaitForMultipleObjectsEx IsWindowUnicode MessageBoxW MessageBoxA LoadStringA SendMessageTimeoutW CharNextA GetMessageW

kernel32

HeapSize HeapFree HeapAlloc SetStdHandle CreateDirectoryW GetFullPathNameW DeleteFileW WriteConsoleW GetModuleFileNameW GetStdHandle GetCommandLineA GetConsoleMode GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW VirtualQuery VirtualProtect VirtualAlloc GetCommandLineW DecodePointer RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpiA FindResourceA SetDllDirectoryA MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte DeleteFileA GetTickCount LocalFree ExitProcess Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetModuleHandleExA CreateDirectoryA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA RemoveDirectoryA SetFileAttributesA CloseHandle SetLastError DeviceIoControl HeapReAlloc CopyFileA MoveFileExA GetEnvironmentVariableA WriteFile WaitForSingleObject TerminateProcess GetSystemDirectoryA GetWindowsDirectoryA LockResource GetTempPathA GetCurrentProcess GetNativeSystemInfo GetSystemWow64DirectoryA GetModuleHandleExW ReadFile SetHandleInformation CreatePipe PeekNamedPipe GetExitCodeProcess CreateProcessA FlushFileBuffers SetEndOfFile SetFilePointerEx LoadLibraryExW OpenMutexA LoadLibraryW MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA QueryPerformanceCounter CreateFileW InitializeCriticalSection EnterCriticalSection LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx ReadConsoleW GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW OutputDebugStringW InitializeCriticalSectionEx LeaveCriticalSection RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent IsDebuggerPresent

comctl32

InitCommonControlsEx

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorA RegQueryInfoKeyW RegQueryValueExA RegEnumValueA SetFileSecurityA RegSetValueExA RegEnumKeyExA

oleaut32

VarUI4FromStr SysFreeString GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoA

msi

ord204 ord117 ord115 ord91 ord160 ord159 ord189 ord67 ord168 ord137 ord141 ord8 ord44 ord31

Name

.text

Size

470KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_0a7a7b0882aa4ed1652c80054064b81a_amadey_blankgrabber_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader

ole32

shell32

user32

kernel32

comctl32

advapi32

oleaut32

shlwapi

version

msi

generic