2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc

General

Target
2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc
Size 16.4MB
Sample260916-p2d5waba53
SHA256 a2b5ea55c9d6612083397a79c51a1593b8cc8d915525ea658497a6527b0cab71
MD5 4addb05d4acc58431c24b23f50cbb8d4
SHA1 4322ac6ca667d290fd7897bb22adc27e01247a1f
SHA512 04bfbab1635b8f4ce6b8f8a5ccd1fcacd0628ed88589fef3ebf3155a9bdbe9ee8c8964cd1db200e9930d6a55283a046a2d0ea0dbac667bce3224fbcd2402409a
SSDEEP 393216:WJJhllNUHGcgUVluK7aMIbUwF1VERmj2b:E16HvfVlu4nIY092b
TLSH
T1C607F100FAC300B1F8A7147146ABB22F5B28A5528718DDD7F58C5AC9EF23AF16D3175A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc

.exe 16.4MB
downloader_req.pyc

574B

2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH 0a6e6a1e3cba00906d9b8fea0b706cf9
SHA256 a2b5ea55c9d6612083397a79c51a1593b8cc8d915525ea658497a6527b0cab71
MD5 4addb05d4acc58431c24b23f50cbb8d4
SHA1 4322ac6ca667d290fd7897bb22adc27e01247a1f
SHA512 04bfbab1635b8f4ce6b8f8a5ccd1fcacd0628ed88589fef3ebf3155a9bdbe9ee8c8964cd1db200e9930d6a55283a046a2d0ea0dbac667bce3224fbcd2402409a
SSDEEP 393216:WJJhllNUHGcgUVluK7aMIbUwF1VERmj2b:E16HvfVlu4nIY092b
TLSH
T1C607F100FAC300B1F8A7147146ABB22F5B28A5528718DDD7F58C5AC9EF23AF16D3175A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12803

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError SetConsoleCtrlHandler DuplicateHandle CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW GetCommandLineA HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer RtlUnwind HeapCreate GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress WriteFile SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle IsProcessorFeaturePresent CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_4addb05d4acc58431c24b23f50cbb8d4_amadey_darkgate_elex_glassworm_karagany_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc

kernel32

shlwapi

generic

downloader_req.pyc