2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader
Size 27.1MB
Sample260825-dz99rasvbv
SHA256 06f19e9cc91219586f53fd062b4c077071cf39c9d5de0ad751e1b26819989617
MD5 b4d0e107941bb8836dac56b76be07f9a
SHA1 11d1e3a8f96eda1ace4c5815a7b564999a3b92c5
SHA512 9fccb9587e28e910e6a7eff21e058311613116c0c788233b0528f29d632bcc98a4f9a548c79347a39c66a5e01fb215511339cb78d3ccdd9e5775ae25e7ed6dcb
SSDEEP 393216:mGOJDg/qhItVyWfPhbp19eLpZg/aO9XijX8cT:cJ6qhIvHhbp1XN9XijRT
TLSH
T17957DF02EA54817BD5AC833155AB1BF97B3A6E5593A44BC707A470783E703C0AF3B25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader

.exe 27.1MB

2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 5d016bda6c524ebb09becda43ec4c085
SHA256 06f19e9cc91219586f53fd062b4c077071cf39c9d5de0ad751e1b26819989617
MD5 b4d0e107941bb8836dac56b76be07f9a
SHA1 11d1e3a8f96eda1ace4c5815a7b564999a3b92c5
SHA512 9fccb9587e28e910e6a7eff21e058311613116c0c788233b0528f29d632bcc98a4f9a548c79347a39c66a5e01fb215511339cb78d3ccdd9e5775ae25e7ed6dcb
SSDEEP 393216:mGOJDg/qhItVyWfPhbp19eLpZg/aO9XijX8cT:cJ6qhIvHhbp1XN9XijRT
TLSH
T17957DF02EA54817BD5AC833155AB1BF97B3A6E5593A44BC707A470783E703C0AF3B25B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5189

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

d:\build\ob\bora-18278582\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrUnloadDll NtProtectVirtualMemory NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrLoadDll RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_b4d0e107941bb8836dac56b76be07f9a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

ntdll

generic