2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat
Size 1.6MB
Sample260910-jpr83shq4x
SHA256 aa04dc529de664cfc7131be3560edd92d719fa5ac30447a30860e51f23cf7fe5
MD5 05671e3cadff5b632a97af74793983cc
SHA1 65af1a9053e26eb9c68a8b72cbbcd0c0368cf0f7
SHA512 5bd77e8959b70a2eb8b29ba857f148ace7d4dcea239352d337f2a8b28a9936b6b534edbb912c1f9e70c4fa14088ac05e3ebfc658ba9ef5efebc5c7c82af4a045
SSDEEP 24576:6oxKbbKXjKDGCvMyPC28y4oaX0S8E3GuNi5T0pGsO8Nyxknw4FYnshx8OfVe247:2lvMyPC2I0S8WJST0pGsO84x4x8EVep
TLSH
T11285CF21BA02E036DA4501F159ACDFB9976D6C350F2248D7B3C45B3E99B41C35B3AE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat

File Explorer

2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat

.exe 1.6MB

2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat

IMPHASH 173d2b5b89301501842f1a250db3318f
SHA256 aa04dc529de664cfc7131be3560edd92d719fa5ac30447a30860e51f23cf7fe5
MD5 05671e3cadff5b632a97af74793983cc
SHA1 65af1a9053e26eb9c68a8b72cbbcd0c0368cf0f7
SHA512 5bd77e8959b70a2eb8b29ba857f148ace7d4dcea239352d337f2a8b28a9936b6b534edbb912c1f9e70c4fa14088ac05e3ebfc658ba9ef5efebc5c7c82af4a045
SSDEEP 24576:6oxKbbKXjKDGCvMyPC28y4oaX0S8E3GuNi5T0pGsO8Nyxknw4FYnshx8OfVe247:2lvMyPC2I0S8WJST0pGsO84x4x8EVep
TLSH
T11285CF21BA02E036DA4501F159ACDFB9976D6C350F2248D7B3C45B3E99B41C35B3AE3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

573330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\atkexComSvc\Release\atkexComSvc.pdb

atkex

ord3 ord2

winmm

timeGetTime

dbghelp

SymFromAddr SymGetLineFromAddr64 SymInitialize

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW RtlCaptureStackBackTrace GetStdHandle DuplicateHandle SetEvent ReleaseMutex WaitForSingleObject CreateMutexW OpenMutexW CreateEventW GetCurrentProcess GetCurrentProcessId OpenProcess QueryFullProcessImageNameW GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next DeleteFileA SetFileAttributesA GetSystemInfo VirtualQuery LoadLibraryA SetDllDirectoryW GetCommandLineW DeleteFileW RaiseException CreateThread GetCurrentThreadId SetProcessMitigationPolicy lstrcpyW GetCurrentThread GetNativeSystemInfo SetThreadAffinityMask SetThreadPriority GetExitCodeThread SuspendThread ResumeThread GetFileAttributesW CreateDirectoryW IsDebuggerPresent ResetEvent K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW GetFullPathNameW GetCurrentDirectoryW PeekNamedPipe CloseHandle WriteFile ReadFile FlushFileBuffers CreateFileW CreateFileA WritePrivateProfileStringW WritePrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileStringA GetPrivateProfileIntW GetModuleFileNameA GetModuleHandleA OutputDebugStringW OutputDebugStringA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW FreeLibrary GetLastError GetTickCount lstrcmpW LocalFree LocalAlloc LoadLibraryW GetProcAddress Sleep MoveFileExW SetFilePointerEx GetFileSizeEx GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree SetEndOfFile FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapSize HeapAlloc HeapFree ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind InitializeSListHead GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx GetFirmwareEnvironmentVariableW InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent GetSystemTimeAsFileTime EncodePointer

user32

wsprintfW TranslateMessage DispatchMessageW GetMessageW CharUpperW MessageBoxW MessageBoxA LoadStringW GetUserObjectSecurity CharNextW PostThreadMessageW

advapi32

StartServiceW RegCreateKeyExW RegDeleteKeyW QueryServiceStatus RegOpenKeyExA RegNotifyChangeKeyValue BuildTrusteeWithSidW SetNamedSecurityInfoW GetNamedSecurityInfoW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid RegDeleteValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityInfo ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorDacl AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

SHFileOperationW SHGetFolderPathAndSubDirW SHGetFolderPathA

ole32

CoTaskMemRealloc CoTaskMemFree CoInitializeEx CoRegisterClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess StringFromGUID2 CoTaskMemAlloc CoCreateInstance CoRevokeClassObject CoUninitialize

oleaut32

SysStringLen SysStringByteLen SafeArrayCreate SysFreeString SysAllocStringByteLen SafeArrayDestroy SysAllocStringLen UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantCopy VariantClear VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocString

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CertGetNameStringW CryptQueryObject

shlwapi

PathIsDirectoryW PathFileExistsW ord217

Name

.text

Size

761KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_05671e3cadff5b632a97af74793983cc_akira_amadey_darkgate_elex_luca-stealer_njrat

atkex

winmm

dbghelp

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

shlwapi

generic