2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 3.4MB
Sample260814-e5n45scq2w
SHA256 9ff93246d192108b5cfbb14bda97a20f4db6a480291e6788f3e64ecb5b5fb4ad
MD5 4bcc312b501c472370edad0959f93ab1
SHA1 0a63e2beee9a6485b760d61c8e619ce5165ae352
SHA512 d481a06791102e088449914b7c0e93ee7b0dac1c0b47f6772f6afcc15205f37981bf5266feb0cd007a662e35b19eb199a809da3735507a7a536ebe18bc3b50fa
SSDEEP 98304:11Dkm6NIRsE+ncLrdZXdgoh6yQ9J9Y6KVe37y5Ki:1WyR+nGZXdgoh6yQ9JlR7yZ
TLSH
T139F5AD1175804877CB124F317EAAFA79B1AFBE741A34448F12CAB5293F735826025F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 3.4MB

2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH c0c64e1e96d8ea98a90dffd815a01fcd
SHA256 9ff93246d192108b5cfbb14bda97a20f4db6a480291e6788f3e64ecb5b5fb4ad
MD5 4bcc312b501c472370edad0959f93ab1
SHA1 0a63e2beee9a6485b760d61c8e619ce5165ae352
SHA512 d481a06791102e088449914b7c0e93ee7b0dac1c0b47f6772f6afcc15205f37981bf5266feb0cd007a662e35b19eb199a809da3735507a7a536ebe18bc3b50fa
SSDEEP 98304:11Dkm6NIRsE+ncLrdZXdgoh6yQ9J9Y6KVe37y5Ki:1WyR+nGZXdgoh6yQ9JlR7yZ
TLSH
T139F5AD1175804877CB124F317EAAFA79B1AFBE741A34448F12CAB5293F735826025F9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

35:8b:84:cb:81:f1:75:fa:9c:24:52:b8:e7:e8:e1:16:38:cb:29:3f:e3:76:3f:79:d2:96:a2:65:7c:c5:f6:e2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Chains

Nov 21, 2018

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

ce:2e:bc:95:47:34:33:48:c1:3c:d4:99:d7:57:a3:b9:fd:0a:1e:9d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Chains

Nov 21, 2018

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Serial Number

59:04:09:57:f2:08:43:30:2b:a5:2a:a1:f6:ab:ce:ef

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 2, 2016 - Dec 21, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Serial Number

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2018 - Sep 11, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

1383825

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\dd\vctools\vc7libs\ship\atlmfc\VMwareToolsUpgraderNT\Release\VMwareToolsUpgraderNT.pdb

kernel32

SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation GetACP GetStdHandle GetFileType SetStdHandle HeapQueryInformation FindFirstFileExW GetOEMCP CreateThread VirtualQuery VirtualAlloc GetCommandLineW GetCommandLineA GetModuleHandleExW RtlUnwind GetCPInfo GetStringTypeW LCMapStringW QueryPerformanceFrequency OutputDebugStringW FindNextFileW FreeLibraryAndExitThread GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent IsValidCodePage GetTempFileNameW GetWindowsDirectoryW GetProfileIntW SearchPathW SetErrorMode FindResourceExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx FileTimeToLocalFileTime lstrcmpiW DuplicateHandle UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindFirstFileW FindClose GetFileSize GetFileAttributesW VerifyVersionInfoW lstrcpyW VerSetConditionMask GetCurrentDirectoryW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc GlobalGetAtomNameW CopyFileW FormatMessageW MulDiv LocalFree GlobalSize ResumeThread SetThreadPriority CreateEventW SetEvent GlobalUnlock WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GlobalFree GetTickCount GetCurrentProcessId CompareStringA lstrcmpA GlobalLock GlobalAlloc GetVersionExW GetCurrentThread CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA GetModuleFileNameW FreeResource EncodePointer OutputDebugStringA GetThreadLocale GetTempPathW FindResourceW LoadResource LockResource SizeofResource CreateMutexW SetLastError ExitProcess GetCurrentThreadId GetFileAttributesExW CreateDirectoryW CreateProcessW MoveFileExW DeleteFileW WriteFile WaitForSingleObject FlushInstructionCache VirtualProtect UnmapViewOfFile MapViewOfFile CloseHandle CreateFileMappingW CreateFileW GetSystemDirectoryW GetModuleHandleW Sleep InitializeCriticalSection GetProcAddress LoadLibraryW GetSystemInfo GlobalMemoryStatusEx GetCurrentProcess WideCharToMultiByte CheckRemoteDebuggerPresent IsDebuggerPresent FreeLibrary GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection HeapFree MultiByteToWideChar ExitThread WriteConsoleW

user32

WindowFromPoint GetAsyncKeyState RealChildWindowFromPoint LoadCursorW GetSysColorBrush CopyImage InflateRect GetMenuItemInfoW DestroyMenu IsRectEmpty IntersectRect SetRect InvalidateRgn InvalidateRect CopyAcceleratorTableW ReleaseCapture SetCapture FillRect ClientToScreen ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW SetRectEmpty SendDlgItemMessageA RemoveMenu AppendMenuW InsertMenuW GetMenuState GetMenuStringW SetCursor ShowOwnedPopups GetCursorPos GetDesktopWindow GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW GetWindowThreadProcessId KillTimer SetTimer WaitMessage SystemParametersInfoW MessageBeep IsZoomed IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton DeleteMenu ShowWindow LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW NotifyWinEvent SetWindowLongW EqualRect GetSysColor GetSystemMenu ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ModifyMenuW ToUnicodeEx GetKeyboardLayout EnableWindow UnregisterClassW GetMessageW PostQuitMessage PostThreadMessageW RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenu GetMenuItemCount GetMenuItemID GetSubMenu SetMenu GetMenu BringWindowToTop LoadAcceleratorsW TranslateAcceleratorW LoadMenuW CreatePopupMenu InsertMenuItemW DestroyIcon LoadImageW UnpackDDElParam ReuseDDElParam SetParent MonitorFromPoint SetLayeredWindowAttributes GetCapture GetKeyState EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW TrackMouseEvent MoveWindow TranslateMessage DispatchMessageW LoadIconW SendMessageW IsIconic GetSystemMetrics GetClientRect DrawIcon UnionRect IsWindow GetDlgItem GetDlgCtrlID CharNextW CopyRect OffsetRect PtInRect GetWindowLongW GetParent GetWindow RegisterWindowMessageW PeekMessageW GetMessagePos GetMessageTime PostMessageW DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW IsMenu IsChild DestroyWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible SetFocus GetFocus GetKeyboardState MapVirtualKeyW CreateAcceleratorTableW DestroyAcceleratorTable CharUpperW MapWindowPoints SetWindowRgn EnumChildWindows LockWindowUpdate SetClassLongW GetNextDlgGroupItem GetKeyNameTextW GetWindowRgn GetComboBoxInfo DestroyCursor CreateMenu GetDoubleClickTime InvertRect HideCaret GetIconInfo GetUpdateRect SubtractRect MapVirtualKeyExW IsCharLowerW TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar IsClipboardFormatAvailable FrameRect CopyIcon SetMenuDefaultItem GetMenuDefaultItem EnableScrollBar UpdateLayeredWindow CharUpperBuffW SetCursorPos DrawFocusRect DrawFrameControl DrawEdge DrawIconEx GetClassLongW

gdi32

CreateRectRgn DeleteObject Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect CreatePatternBrush CreateFontIndirectW GetTextExtentPoint32W CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW CombineRgn GetDIBits PatBlt RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn OffsetRgn GetMapMode SetRectRgn DPtoLP EnumFontFamiliesExW CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline Rectangle CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries LPtoDP RoundRect ExtFloodFill SetPaletteEntries GetViewportOrgEx GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV CreatePen CreateHatchBrush CreateCompatibleDC BitBlt CreateDCW CopyMetaFileW CreateBitmap SetTextColor SetBkColor GetObjectW GetTextColor GetStockObject GetDeviceCaps GetBkColor GetRgnBox CreateSolidBrush DeleteDC

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyW RegOpenKeyExW RegEnumKeyExW RegEnumValueW RegQueryValueW RegCloseKey RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW

shell32

DragQueryFileW DragFinish SHAppBarMessage SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW SHGetDesktopFolder ShellExecuteW SHGetFileInfoW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathIsUNCW PathFindFileNameW

uxtheme

GetThemeColor GetThemeSysColor GetWindowTheme GetCurrentThemeName IsAppThemed GetThemePartSize DrawThemeText DrawThemeParentBackground DrawThemeBackground IsThemeBackgroundPartiallyTransparent OpenThemeData CloseThemeData

ole32

DoDragDrop OleGetClipboard OleLockRunning CoInitializeEx OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleFlushClipboard CoRegisterMessageFilter OleIsCurrentClipboard CoRevokeClassObject CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateInstance CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid CoUninitialize

oleaut32

SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy VariantInit VarBstrFromDate LoadTypeLi SysFreeString SysAllocString VariantClear VariantChangeType OleCreateFontIndirect SysAllocStringLen

oledlg

OleUIBusyW

gdiplus

GdiplusShutdown GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI

ws2_32

WSASetLastError WSACleanup WSAStartup

psapi

GetModuleInformation

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.VMware0

Size

997KB

Virtual Size

996KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_4bcc312b501c472370edad0959f93ab1_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

psapi

oleacc

imm32

winmm

generic