2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader
Size 2.0MB
Sample260910-xd26ssw1et
SHA256 3769f56b6e767ef24f5715446f316de8c83acab920cd2ebbb4e3b6d2bfd201ed
MD5 28a4d479075d1d21ab6cc34c6b63b918
SHA1 0775133fe044a3ea6f7bb5c16af635c6ccd85ea3
SHA512 56dd3e69e9a7b2b76b1eb8c11dd0daeba98125f855a09af80c02da9f52ce493fdfba55e24c5af3d0513ddb80f22fd54694dcce146cd5bdebe355a7e91ddefa48
SSDEEP 49152:J2Lb5aH3tRORoi3azgGJtB76OB+kn3Hnx:ckHdROl3azhN+k
TLSH
T111959F30B943C1B2E4A212F089ACAFE89569E9B01B3756CB17D41F6D0D305D36F39A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 2.0MB

2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 9686f59e7add86005b38da8ebfa18dde
SHA256 3769f56b6e767ef24f5715446f316de8c83acab920cd2ebbb4e3b6d2bfd201ed
MD5 28a4d479075d1d21ab6cc34c6b63b918
SHA1 0775133fe044a3ea6f7bb5c16af635c6ccd85ea3
SHA512 56dd3e69e9a7b2b76b1eb8c11dd0daeba98125f855a09af80c02da9f52ce493fdfba55e24c5af3d0513ddb80f22fd54694dcce146cd5bdebe355a7e91ddefa48
SSDEEP 49152:J2Lb5aH3tRORoi3azgGJtB76OB+kn3Hnx:ckHdROl3azhN+k
TLSH
T111959F30B943C1B2E4A212F089ACAFE89569E9B01B3756CB17D41F6D0D305D36F39A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

826444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvControlSvc.pdb

kernel32

SetEndOfFile SetFilePointer CreateProcessW GetSystemDirectoryW LoadLibraryW GetVersionExW GetNativeSystemInfo LoadLibraryA GetConsoleOutputCP GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW CreatePipe ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSection CreateThread SetUnhandledExceptionFilter RtlCaptureContext GetSystemTimeAsFileTime GetSystemTime QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetCurrentProcessId WaitNamedPipeW CreateFileW WaitForMultipleObjects ResumeThread TerminateThread SetThreadPriority GetCurrentThreadId CancelIoEx GetOverlappedResult SetHandleInformation WriteFile ReadFile ResetEvent GetOEMCP GetACP WideCharToMultiByte ExpandEnvironmentStringsW GetLocaleInfoW GetComputerNameW VerifyVersionInfoW VerSetConditionMask OpenProcess GetExitCodeProcess SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler CloseHandle MoveFileExW LocalFree GetModuleHandleW GetFileSize SetPriorityClass GetCurrentProcess CreateDirectoryW GetCommandLineW GetStdHandle MulDiv GetProcAddress GetTempPathW LeaveCriticalSection EnterCriticalSection MultiByteToWideChar SystemTimeToFileTime CreateSemaphoreW OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore SetEvent SetLastError lstrcmpiW lstrcmpW DeviceIoControl GetLastError WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer FileTimeToSystemTime Sleep GetLocalTime InitializeCriticalSectionEx

advapi32

RegSetValueExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetKeySecurity RegOpenKeyExW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyExW FreeSid AllocateAndInitializeSid AddAccessDeniedAce EventUnregister EventRegister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW EventWriteTransfer RegQueryValueExW RegOpenKeyW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce EqualSid AddAccessAllowedAce

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize

oleaut32

VariantInit SafeArrayUnlock SafeArrayDestroy VariantClear SysAllocString SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysFreeString

ws2_32

getsockopt closesocket getnameinfo WSACleanup ntohl htons htonl shutdown socket ntohs

iphlpapi

ConvertInterfaceGuidToLuid GetAdaptersAddresses

wininet

InternetConnectW InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetOpenW InternetCrackUrlW

msi

ord205

fwpuclnt

FwpmFilterUnsubscribeChanges0 FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerGetByKey0 FwpmSubLayerSubscribeChanges0 FwpmSubLayerUnsubscribeChanges0 FwpmFilterAdd0 FwpmFilterSubscribeChanges0 FwpmFilterDeleteById0 FwpmFilterGetByKey0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_28a4d479075d1d21ab6cc34c6b63b918_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

msi

fwpuclnt

rpcrt4

generic