2026-08-27_37c89a43f2aeb5c37952b434a713d1e3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_37c89a43f2aeb5c37952b434a713d1e3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 11.2MB
Sample260827-ycejsadj3w
SHA256 fc038c0cd7a33c7a8b5bdc4aa1e205251277ea91bddf3a2cadc1a59d4041a66d
MD5 37c89a43f2aeb5c37952b434a713d1e3
SHA1 57860e0a88b4e7f527611abe12d737c5d18189dc
SHA512 4ff0c2e3130faf62e8871fb3f734de3931c95e3d9065202e3b6099dce91065c44bfd8be33052a885f42b2663a97403e7f8f3213035b2e19db0dfac0a32f24a8c
SSDEEP 98304:dZmMPjUsDZlcyzfCYzYgVSWBtJe0bCrBNBGfHaRtVDyBLvHmaHRsKk1zFmu4xkF4:jmMbUs9llzfCYzcLRtUvGaH
TLSH
T1EDC6E942E88399B1F5172E721A16C37B463B21345A31FDC6F6E4B988A722DDB0775338
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_37c89a43f2aeb5c37952b434a713d1e3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-27_37c89a43f2aeb5c37952b434a713d1e3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 11.2MB

2026-08-27_37c89a43f2aeb5c37952b434a713d1e3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 16c8b2da9c0682f867552e4ff8997877
SHA256 fc038c0cd7a33c7a8b5bdc4aa1e205251277ea91bddf3a2cadc1a59d4041a66d
MD5 37c89a43f2aeb5c37952b434a713d1e3
SHA1 57860e0a88b4e7f527611abe12d737c5d18189dc
SHA512 4ff0c2e3130faf62e8871fb3f734de3931c95e3d9065202e3b6099dce91065c44bfd8be33052a885f42b2663a97403e7f8f3213035b2e19db0dfac0a32f24a8c
SSDEEP 98304:dZmMPjUsDZlcyzfCYzYgVSWBtJe0bCrBNBGfHaRtVDyBLvHmaHRsKk1zFmu4xkF4:jmMbUs9llzfCYzcLRtUvGaH
TLSH
T1EDC6E942E88399B1F5172E721A16C37B463B21345A31FDC6F6E4B988A722DDB0775338
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PeekNamedPipe GetDriveTypeW GetModuleHandleA GetModuleFileNameA ReadProcessMemory VirtualAlloc GetCurrentThreadId SystemTimeToTzSpecificLocalTime ExitProcess GetCurrentProcessId GetCurrentProcess FileTimeToSystemTime InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetLastError CloseHandle DecodePointer WriteFile SetFilePointer FindResourceA SizeofResource LockResource DeleteCriticalSection LoadResource LoadLibraryExA GetSystemDirectoryW CreateMutexA ReleaseMutex GetProcessAffinityMask SetConsoleTextAttribute GetConsoleScreenBufferInfo InitializeConditionVariable InitializeSRWLock InitOnceComplete InitOnceBeginInitialize MoveFileExA SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW CreateFileA GetCommandLineA GetTickCount64 GlobalAlloc GlobalUnlock GlobalLock GetLocaleInfoA GetSystemDefaultLCID GetUserDefaultLocaleName K32GetProcessMemoryInfo DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleW GetCurrentDirectoryA CreateDirectoryA GetFileAttributesA LocalFileTimeToFileTime ReadFile SetFileTime SystemTimeToFileTime GetTempPathA Sleep GlobalMemoryStatusEx GetSystemDirectoryA GetWindowsDirectoryA GetNativeSystemInfo LoadLibraryW GetWindowsDirectoryW MultiByteToWideChar GetACP SetEvent WaitForSingleObject CreateEventA SetCurrentDirectoryA CopyFileA MoveFileA VirtualFree OutputDebugStringA FormatMessageA LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess RtlUnwind InterlockedFlushSList SetLastError VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetCurrentThread GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW HeapQueryInformation

user32

MessageBoxW MessageBoxA UnregisterClassA SetProcessDPIAware InvalidateRect MapVirtualKeyA ToAscii EnumDisplaySettingsA LoadCursorA GetDesktopWindow SetWindowLongA GetWindowLongA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos ShowCursor GetWindowRect GetClientRect SetWindowTextW EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow GetSystemMetrics ReleaseCapture SetCapture GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetSystemMenu RemoveMenu GetKeyNameTextW MapVirtualKeyW wsprintfA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PeekMessageW PostMessageA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow ShowWindow MoveWindow SetWindowPos GetFocus

dbghelp

MiniDumpWriteDump

urlmon

URLDownloadToFileA

dnsapi

DnsQuery_A DnsFree

freeimage

_FreeImage_GetWidth@4 _FreeImage_GetFileType@8 _FreeImage_DeInitialise@0 _FreeImage_Initialise@4 _FreeImage_GetBPP@4 _FreeImage_GetScanLine@8 _FreeImage_Unload@4 _FreeImage_GetFIFFromFilename@4 _FreeImage_GetHeight@4 _FreeImage_GetColorType@4 _FreeImage_IsTransparent@4 _FreeImage_ConvertTo32Bits@4 _FreeImage_Load@12

wsock32

ntohs recv recvfrom select send ntohl setsockopt socket gethostbyname WSAStartup WSACleanup listen ioctlsocket htons inet_ntoa htonl getsockname getpeername sendto connect closesocket bind accept

winmm

timeBeginPeriod timeGetDevCaps timeKillEvent timeSetEvent timeEndPeriod timeGetTime

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCompileShader D3DXCreateEffectFromFileA D3DXMatrixMultiply D3DXMatrixTranspose D3DXMatrixOrthoOffCenterLH

dinput8

DirectInput8Create

gdi32

RemoveFontResourceA AddFontResourceA GetDeviceCaps GetStockObject

advapi32

RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize

d3dxof

DirectXFileCreate

fmod

_FSOUND_Sample_SetMode@8 _FSOUND_Sample_SetDefaults@20 _FSOUND_Sample_GetDefaults@20 _FSOUND_Close@0 _FSOUND_Update@0 _FSOUND_PlaySound@8 _FSOUND_PlaySoundEx@16 _FSOUND_StopSound@4 _FSOUND_SetFrequency@8 _FSOUND_SetVolume@8 _FSOUND_SetPan@8 _FSOUND_SetPaused@8 _FSOUND_3D_SetAttributes@12 _FSOUND_Sample_Load@20 _FSOUND_3D_Listener_SetAttributes@32 _FSOUND_3D_SetDopplerFactor@4 _FSOUND_3D_SetDistanceFactor@4 _FSOUND_3D_SetRolloffFactor@4 _FSOUND_Stream_Open@16 _FSOUND_Stream_Close@4 _FSOUND_Stream_Play@8 _FSOUND_Stream_Stop@4 _FSOUND_CD_Play@8 _FSOUND_CD_SetPlayMode@8 _FSOUND_CD_Stop@4 _FSOUND_CD_SetPaused@8 _FSOUND_CD_SetVolume@8 _FSOUND_Sample_Free@4 _FSOUND_Init@12 _FSOUND_IsPlaying@4 _FSOUND_SetHWND@4

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

881KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=61, id=259, version=33145,

count=215, id=261, version=33145,

count=49, id=260, version=33145,

count=8, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=94, id=261, version=35207,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=47, productName=Unmarked objects (old),

count=329, id=260, version=35228,

count=25, id=257, version=33145,

count=2, id=221, productName=VS2013 build 21005, version=21005,

count=365, id=1, productName=Unmarked objects,

count=73, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,