2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader
Size 2.0MB
Sample260820-rpkg8sssgw
SHA256 d26757525451b078c34b290f998c39a761e36b85144ba3537b7ce8f0270e9bc6
MD5 dc78948db61e5071b68c52b9d93fb944
SHA1 7f2496a0f1b2d6cde2e3bbdc011389724f3b5824
SHA512 e52f6ca2de4101882a7463910082e39ff0d7bcd0dc5d84324408f3f2a7d3a0f6919a4232ee3ed7e1d48987d41b353e00a26909211324e081f43971de77450557
SSDEEP 49152:NxLb5aH3tRORoT3azgGJtB761fYvBHyO0s+2h:3kHdRO43azhzcOjh
TLSH
T173A5AF307943C1B2E4A212F09AAC6FB895A9E9B01B3756CB13D41F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 2.0MB

2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 9686f59e7add86005b38da8ebfa18dde
SHA256 d26757525451b078c34b290f998c39a761e36b85144ba3537b7ce8f0270e9bc6
MD5 dc78948db61e5071b68c52b9d93fb944
SHA1 7f2496a0f1b2d6cde2e3bbdc011389724f3b5824
SHA512 e52f6ca2de4101882a7463910082e39ff0d7bcd0dc5d84324408f3f2a7d3a0f6919a4232ee3ed7e1d48987d41b353e00a26909211324e081f43971de77450557
SSDEEP 49152:NxLb5aH3tRORoT3azgGJtB761fYvBHyO0s+2h:3kHdRO43azhzcOjh
TLSH
T173A5AF307943C1B2E4A212F09AAC6FB895A9E9B01B3756CB13D41F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

826444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvControlSvc.pdb

kernel32

SetEndOfFile SetFilePointer CreateProcessW GetSystemDirectoryW LoadLibraryW GetVersionExW GetNativeSystemInfo LoadLibraryA GetConsoleOutputCP GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW CreatePipe ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSection CreateThread SetUnhandledExceptionFilter RtlCaptureContext GetSystemTimeAsFileTime GetSystemTime QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetCurrentProcessId WaitNamedPipeW CreateFileW WaitForMultipleObjects ResumeThread TerminateThread SetThreadPriority GetCurrentThreadId CancelIoEx GetOverlappedResult SetHandleInformation WriteFile ReadFile ResetEvent GetOEMCP GetACP WideCharToMultiByte ExpandEnvironmentStringsW GetLocaleInfoW GetComputerNameW VerifyVersionInfoW VerSetConditionMask OpenProcess GetExitCodeProcess SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler CloseHandle MoveFileExW LocalFree GetModuleHandleW GetFileSize SetPriorityClass GetCurrentProcess CreateDirectoryW GetCommandLineW GetStdHandle MulDiv GetProcAddress GetTempPathW LeaveCriticalSection EnterCriticalSection MultiByteToWideChar SystemTimeToFileTime CreateSemaphoreW OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore SetEvent SetLastError lstrcmpiW lstrcmpW DeviceIoControl GetLastError WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer FileTimeToSystemTime Sleep GetLocalTime InitializeCriticalSectionEx

advapi32

RegSetValueExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetKeySecurity RegOpenKeyExW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyExW FreeSid AllocateAndInitializeSid AddAccessDeniedAce EventUnregister EventRegister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW EventWriteTransfer RegQueryValueExW RegOpenKeyW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce EqualSid AddAccessAllowedAce

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize

oleaut32

VariantInit SafeArrayUnlock SafeArrayDestroy VariantClear SysAllocString SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysFreeString

ws2_32

getsockopt closesocket getnameinfo WSACleanup ntohl htons htonl shutdown socket ntohs

iphlpapi

ConvertInterfaceGuidToLuid GetAdaptersAddresses

wininet

InternetConnectW InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetOpenW InternetCrackUrlW

msi

ord205

fwpuclnt

FwpmFilterUnsubscribeChanges0 FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerSubscribeChanges0 FwpmSubLayerUnsubscribeChanges0 FwpmFilterAdd0 FwpmFilterSubscribeChanges0 FwpmFilterDeleteById0 FwpmFilterGetByKey0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_dc78948db61e5071b68c52b9d93fb944_amadey_darkgate_elex_floxif_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

msi

fwpuclnt

rpcrt4

generic