2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader
Size 40.0MB
Sample260828-m2afkshj71
SHA256 dd85c1ba0a1a91a20b6236c1ae5b0b27415d15dc8e65888bc9ea9096f0af6c05
MD5 a1f0e70913fcd214d0a73fe8ff28c62f
SHA1 fa45c5bb433eefeeb8119ba14f09416f188af18e
SHA512 c268aaff4d943a80f634f5de835a811bdd07db8e42f5ce679d9fcd200f270f32ba1e6a93dde673b532094c38f244e203be6fc3b66526497e0ee520949f6f396e
SSDEEP 786432:rxKEF3pIxeBFdqHEUJuL+qTWCqJjmw4UFFUP+iC9voYGduWlxTB4CZNk:rxKEF3Kxe5qkk6Wrjmw4UFFUPuvJqLrM
TLSH
T19F973312B4B09836D02152F0BA75B7559C6ABE789B2045CF7784323ECA307D2DB6BB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader

File Explorer

2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader

.exe 40.0MB

2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader

IMPHASH f385888b66f5fe7ad15557f242c9fcf8
SHA256 dd85c1ba0a1a91a20b6236c1ae5b0b27415d15dc8e65888bc9ea9096f0af6c05
MD5 a1f0e70913fcd214d0a73fe8ff28c62f
SHA1 fa45c5bb433eefeeb8119ba14f09416f188af18e
SHA512 c268aaff4d943a80f634f5de835a811bdd07db8e42f5ce679d9fcd200f270f32ba1e6a93dde673b532094c38f244e203be6fc3b66526497e0ee520949f6f396e
SSDEEP 786432:rxKEF3pIxeBFdqHEUJuL+qTWCqJjmw4UFFUP+iC9voYGduWlxTB4CZNk:rxKEF3Kxe5qkk6Wrjmw4UFFUPuvJqLrM
TLSH
T19F973312B4B09836D02152F0BA75B7559C6ABE789B2045CF7784323ECA307D2DB6BB17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\kantu_ai-dev\out\bin\Win32\Release\WXSetup.pdb

shlwapi

SHCreateStreamOnFileEx

shell32

SHCreateDirectoryExW SHFileOperationW SHGetPathFromIDListW ShellExecuteExW SHBrowseForFolderW SHGetFolderPathW CommandLineToArgvW ShellExecuteW SHChangeNotify

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance

advapi32

QueryServiceStatusEx RegCloseKey CryptAcquireContextW CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W RegDeleteKeyValueW RegCreateKeyExW DeleteService ControlService CryptCreateHash CryptHashData RegDeleteTreeW RegSetValueExW CryptDestroyHash StartServiceW RegOpenKeyExW CreateServiceW CryptReleaseContext RegQueryValueExW RegSetKeyValueW CryptGetHashParam OpenServiceW ChangeServiceConfigW

urlmon

URLDownloadToFileW

gdiplus

GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipFree GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingMode GdipGetImageWidth GdipDrawImageRectRectI GdipLoadImageFromStream GdiplusStartup

kernel32

GetProcessHeap HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SizeofResource WritePrivateProfileStringW GetCommandLineW GetCurrentProcess RemoveDirectoryW GetModuleFileNameW WaitForSingleObject GetFileAttributesW GetSystemDirectoryW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetSystemWow64DirectoryW GetPrivateProfileStringW Sleep GetLastError Process32NextW LockResource GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle CreateThread LoadResource FindResourceW GetLocalTime GlobalLock LocalFree MoveFileExW GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW QueryFullProcessImageNameW GetTickCount GlobalUnlock IsWow64Process GetExitCodeProcess FormatMessageW CreateFileW SetFileTime LocalFileTimeToFileTime VirtualAlloc VirtualFree GetProcAddress EnterCriticalSection WriteConsoleW DeleteCriticalSection FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GetSystemInfo FileTimeToLocalFileTime InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW QueryPerformanceCounter GetCurrentThreadId GetVersionExW ReadFile SetEndOfFile WriteFile CreateDirectoryW GetTempPathW SetLastError GetModuleHandleA CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc HeapFree GetFileType GetFileSizeEx ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW InitializeCriticalSectionAndSpinCount RaiseException RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx LeaveCriticalSection WaitForMultipleObjects FormatMessageA GetFileInformationByHandleEx AreFileApisANSI SetFilePointerEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle

user32

CharPrevExA CharUpperW GetWindowLongW GetWindowThreadProcessId GetWindowTextLengthW GetMessageW DefWindowProcW PostMessageW GetWindow GetWindowRect GetFocus DestroyWindow GetDC SetWindowPos MessageBoxW SetWindowRgn HideCaret FillRect CreateWindowExW ScreenToClient GetSystemMetrics SetWindowTextW RegisterClassExW SetCaretPos ShowWindow OpenClipboard DispatchMessageW SetTimer RedrawWindow CloseClipboard CreateCaret TrackMouseEvent SetFocus TranslateMessage GetClipboardData LoadCursorW DestroyCaret SetCapture SetCursor SetWindowLongW EnumWindows GetDlgItem UpdateLayeredWindow DrawTextW ShowCaret KillTimer PostQuitMessage PtInRect UpdateWindow ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW GetClientRect

gdi32

CreateCompatibleBitmap CreateSolidBrush DeleteObject SetBkMode SetTextColor GetTextExtentPoint32W DeleteDC CreateRectRgn GetStockObject CreateFontW PatBlt CreateCompatibleDC CreateDIBSection SelectObject BitBlt

oleaut32

SysAllocStringLen VariantCopy VariantClear SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_a1f0e70913fcd214d0a73fe8ff28c62f_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos_smoke-loader

shlwapi

shell32

ole32

advapi32

urlmon

gdiplus

kernel32

user32

gdi32

oleaut32

generic