2026-09-24_7ac332c5a0c39938f670fea8153a09aa_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_7ac332c5a0c39938f670fea8153a09aa_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 3.4MB
Sample260925-he4npasbma
SHA256 c2f94305e1826ff8634e833ecb4e4e0df04e0947e97ddc2f0f7cec2e567cf0fc
MD5 7ac332c5a0c39938f670fea8153a09aa
SHA1 7768effa413dd6789dbf72aacd54ceac54edb474
SHA512 8944275d82b3a4fb796d54c1e037e4f4530ba8eeb0a35109bb6383c134cad2075c5871298163e49b9a2f80d9d2d07451c883933e8babd3f064b61a5f054fa8dd
SSDEEP 49152:IFo7zcSHGD/uBySWdKgpvh7Srq9e7gPu67J7pwKk6FDvr/5u8VMA1I:UqzDHGD/uByzdKI7GeTu6N
TLSH
T14AF5AF14B576C0B1D08151B07419BBBBB229A924073711F393D41EAFEEE42E11EF66FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_7ac332c5a0c39938f670fea8153a09aa_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-24_7ac332c5a0c39938f670fea8153a09aa_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 3.4MB

2026-09-24_7ac332c5a0c39938f670fea8153a09aa_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH af91af94dcab2c3b26a1350f83849a6e
SHA256 c2f94305e1826ff8634e833ecb4e4e0df04e0947e97ddc2f0f7cec2e567cf0fc
MD5 7ac332c5a0c39938f670fea8153a09aa
SHA1 7768effa413dd6789dbf72aacd54ceac54edb474
SHA512 8944275d82b3a4fb796d54c1e037e4f4530ba8eeb0a35109bb6383c134cad2075c5871298163e49b9a2f80d9d2d07451c883933e8babd3f064b61a5f054fa8dd
SSDEEP 49152:IFo7zcSHGD/uBySWdKgpvh7Srq9e7gPu67J7pwKk6FDvr/5u8VMA1I:UqzDHGD/uByzdKI7GeTu6N
TLSH
T14AF5AF14B576C0B1D08151B07419BBBBB229A924073711F393D41EAFEEE42E11EF66FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

656128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapSize CreateDirectoryW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetCurrentDirectoryW GetTimeZoneInformation GetFileAttributesExW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW ReadConsoleW GetFileType SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetStdHandle GetModuleFileNameW SetEndOfFile GetFullPathNameW GetDriveTypeW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree SetFileAttributesA TlsGetValue TlsAlloc SetLastError RaiseException RtlUnwind CreateFileW HeapValidate GetSystemTime SwitchToThread GetProcessHeap HeapFree HeapAlloc GetTickCount InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer LocalFree GetModuleHandleW WriteConsoleW FindFirstFileA FindNextFileA FindClose GetModuleHandleA VirtualProtect LoadLibraryA GetCurrentProcess GetSystemTimeAsFileTime FlsFree FlsSetValue FlsGetValue FlsAlloc TlsSetValue Sleep FormatMessageA GetCurrentThreadId TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CreateDirectoryA GetModuleFileNameA GetFileSize GetSystemInfo CreateFileMappingA MapViewOfFile UnmapViewOfFile CloseHandle CreateFileA SetUnhandledExceptionFilter OutputDebugStringA GetLastError SetFilePointer WriteFile ReadFile FreeLibrary GetVersionExA GetSystemDirectoryA GetProcAddress WideCharToMultiByte MultiByteToWideChar GlobalLock GlobalUnlock lstrlenW CompareStringA GetLocaleInfoA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection

user32

IsIconic GetAsyncKeyState PostQuitMessage GetCursorPos ScreenToClient FindWindowA LoadIconA SetWindowPos SystemParametersInfoA FlashWindowEx GetKeyState GetKeyboardLayout DestroyCursor ShowCursor SetCursor ClientToScreen SetCursorPos SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow GetCapture GetSystemMetrics MessageBoxA CharPrevExA CharNextExA CharNextW CloseClipboard LoadImageA GetDC ReleaseDC GetWindowLongA DefWindowProcA GetClipboardData OpenClipboard DispatchMessageA TranslateMessage GetMessageA PeekMessageA RegisterClassA LoadCursorA SetWindowTextA MoveWindow GetMenu AdjustWindowRectEx SetRect GetClientRect SetWindowLongA CreateWindowExA DestroyWindow IsWindow InvalidateRect GetKeyboardLayoutNameA

shell32

SHGetSpecialFolderPathA ShellExecuteA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

python27

Py_BuildValue PyErr_SetString PyExc_RuntimeError PyList_New PyString_FromString PyList_Append Py_InitModule4 PyModule_AddIntConstant PyTuple_Size PyTuple_GetItem PyDict_GetItemString PyLong_AsLong PyLong_FromLongLong PyArg_ParseTuple PyTuple_New PyTuple_SetItem PyInt_FromLong PyImport_ImportModule PyString_InternFromString PyErr_BadArgument PyErr_Clear _Py_NoneStruct PyLong_AsLongLong PyFloat_AsDouble PyString_AsString PyNumber_Check PyObject_GetAttrString PyCallable_Check PyObject_CallObject PyErr_Print Py_Initialize Py_Finalize PyErr_Fetch Py_SetProgramName PyImport_AddModule PyModule_GetDict PyDict_SetItemString PyRun_StringFlags PyObject_GetAttr

mss32

_AIL_file_type@8 _AIL_file_read@8 _AIL_release_3D_sample_handle@4 _AIL_startup@0 _AIL_WAV_info@8 _AIL_decompress_ADPCM@12 _AIL_mem_free_lock@4 _AIL_decompress_ASI@24 _AIL_set_file_callbacks@16 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_set_sample_file@12 _AIL_last_error@0 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_sample_volume_pan@12 _AIL_set_sample_volume_pan@12 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_close_3D_provider@4 _AIL_set_3D_orientation@28 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_init_sample@4 _AIL_set_redist_directory@4 _AIL_allocate_3D_sample_handle@4 _AIL_set_3D_sample_file@8 _AIL_auto_update_3D_position@8 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_3D_sample_volume@4 _AIL_set_3D_sample_volume@8 _AIL_close_stream@4 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_stream_volume_levels@12 _AIL_set_stream_volume_levels@12 _AIL_open_digital_driver@16 _AIL_close_digital_driver@4 _AIL_open_stream@12 _AIL_shutdown@0

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

winmm

timeEndPeriod timeGetTime

imm32

ImmReleaseContext ImmAssociateContext ImmSetConversionStatus ImmGetConversionStatus ImmNotifyIME ImmGetCompositionStringW ImmGetCandidateListW ImmGetIMEFileNameA ImmIsIME ImmGetOpenStatus ImmGetContext

ws2_32

send select __WSAFDIsSet closesocket socket recv WSAGetLastError connect WSACleanup WSAStartup inet_addr gethostbyname htons ioctlsocket

dinput8

DirectInput8Create

d3d8

Direct3DCreate8

voice_chat_core_release_win32

??0VoiceChat@amun@@QAE@XZ ??1VoiceChat@amun@@UAE@XZ ?setPlaybackDelay@VoiceChat@amun@@QAEXI@Z ?init@VoiceChat@amun@@QAE_NIE@Z ?destroy@VoiceChat@amun@@QAEXXZ ?startRecording@VoiceChat@amun@@QAE_NXZ ?stopRecording@VoiceChat@amun@@QAEXXZ ?setVolume@VoiceChat@amun@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@M@Z ?decode@VoiceChat@amun@@QAEABV?$vector@FV?$allocator@F@std@@@std@@PBDI@Z ?addSamples@VoiceChat@amun@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBFI@Z ?isReady@VoiceChat@amun@@QBE_NXZ

gdi32

SetBkMode EnumFontFamiliesExA GetTextExtentPoint32A SelectObject DeleteObject SetTextColor SetBkColor CreateFontIndirectA GetTextExtentPoint32W GetCharABCWidthsFloatW TextOutW DeleteDC TextOutA GetStockObject CreateDIBSection CreateCompatibleDC

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA

oleaut32

SysFreeString VariantClear

gdiplus

GdipBitmapUnlockBits GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdiplusShutdown GdipBitmapLockBits GdipSaveImageToFile GdipCloneImage GdipDisposeImage GdipAlloc GdipCreateBitmapFromScan0 GdipFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

352KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=263, version=33145,

count=48, id=259, version=33145,

count=203, id=261, version=33145,

count=2, id=257, version=35225,

count=1, id=28, version=9178,

count=75, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=2, id=25, version=9210,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=262, version=33145,

count=5, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=56, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=62, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2019 v16.2.3 build 27905, version=27905,

count=24, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=5, id=253, version=28518,

count=19, id=260, version=30034,

count=39, id=259, version=30034,

count=90, id=261, version=30034,

count=48, id=260, version=33145,

count=27, id=257, version=33145,

count=383, id=1, productName=Unmarked objects,

count=288, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,