2026-09-24_4e3074aa80833ab17affe234e3df85b3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_4e3074aa80833ab17affe234e3df85b3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 3.1MB
Sample260925-mbd13sdc92
SHA256 b4bd196b7fb22d05a28c8320bfaaff2238a850a08e515b8baa0a2eb3117784b2
MD5 4e3074aa80833ab17affe234e3df85b3
SHA1 9ca5f74ddae8d660eadc9c82b20fe731900103cd
SHA512 d1d845f1629eca280da1a453477989b289a16474203de1ada868d08b610fc4cf64b520e8b7e1fc644e831eade7765a96e637b1314a578a42a0af8b4f23b7c646
SSDEEP 49152:+76TkBmApLuH1WIDlwHQJHPx+fJgCQ3zfZkjo/A:lquHUIxwwJv/Cg
TLSH
T121E57C217E81C236EAD101F289BCBF6E415DA9740F3845C7A1D81AEF9A246D33F35A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_4e3074aa80833ab17affe234e3df85b3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-24_4e3074aa80833ab17affe234e3df85b3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 3.1MB

2026-09-24_4e3074aa80833ab17affe234e3df85b3_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH de91458689a96136828021aefc718e1c
SHA256 b4bd196b7fb22d05a28c8320bfaaff2238a850a08e515b8baa0a2eb3117784b2
MD5 4e3074aa80833ab17affe234e3df85b3
SHA1 9ca5f74ddae8d660eadc9c82b20fe731900103cd
SHA512 d1d845f1629eca280da1a453477989b289a16474203de1ada868d08b610fc4cf64b520e8b7e1fc644e831eade7765a96e637b1314a578a42a0af8b4f23b7c646
SSDEEP 49152:+76TkBmApLuH1WIDlwHQJHPx+fJgCQ3zfZkjo/A:lquHUIxwwJv/Cg
TLSH
T121E57C217E81C236EAD101F289BCBF6E415DA9740F3845C7A1D81AEF9A246D33F35A53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\clean_master\fresh_home\realization_module\install_and_uninstall_template\InstallDemo\Release_RemoveSearchBox\InstallDemo_RemoveSearchBox.pdb

kernel32

FlushInstructionCache LoadLibraryExA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetModuleHandleA GetVersionExW VirtualProtect SetProcessAffinityMask QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx ResumeThread GetLocalTime MulDiv LoadLibraryW GetProcAddress GetModuleHandleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler OutputDebugStringA ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW GetCurrentThread GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx WriteConsoleW GetModuleFileNameA FreeLibrary GetTickCount GetCurrentDirectoryW SetCurrentDirectoryW lstrcmpW InitializeCriticalSectionAndSpinCount DisableThreadLibraryCalls GetACP MultiByteToWideChar Sleep CreateEventW WaitForSingleObject ResetEvent SetEvent ReadFile GetFileSize UnmapViewOfFile MapViewOfFile CreateFileMappingW GetTempPathW SetFilePointer SetEndOfFile GetTempFileNameW IsBadReadPtr lstrcpynW GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetVersion CloseHandle WriteFile DeleteFileW CreateFileW FindResourceW SizeofResource LockResource LoadResource FreeResource ExitProcess InterlockedPopEntrySList GetNativeSystemInfo GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc GetExitCodeThread TryEnterCriticalSection QueryPerformanceFrequency SwitchToThread EncodePointer InterlockedFlushSList InterlockedPushEntrySList RtlUnwind lstrcmpA DeviceIoControl ReleaseMutex FindNextFileA FindFirstFileA DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime GetFileTime InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx CreateSemaphoreW ReleaseSemaphore GlobalMemoryStatus Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessId VirtualFree VirtualAlloc GetTempFileNameA GetTempPathA DeleteFileA CreateFileA GetFileAttributesExW GetPrivateProfileStringW LocalAlloc WaitForMultipleObjects GetStdHandle GetFileInformationByHandle CompareFileTime FindFirstChangeNotificationW FindCloseChangeNotification GetWindowsDirectoryW SetFileTime GetShortPathNameW SearchPathW GetStartupInfoW CreateProcessW GetFileAttributesW GetSystemDirectoryW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection RemoveDirectoryW GetFullPathNameW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose OpenProcess GetExitCodeProcess TerminateProcess QueryDosDeviceW GetLongPathNameW GetLogicalDriveStringsW GetSystemInfo SetFileAttributesW MoveFileExW MoveFileW CopyFileW WritePrivateProfileStringW FormatMessageW LocalFree GetCurrentProcessId GetFileSizeEx GetTickCount64 GetDriveTypeW CreateMutexW WideCharToMultiByte lstrlenW CreateDirectoryW VerifyVersionInfoW lstrcmpiW LoadLibraryExW EnterCriticalSection InitializeCriticalSection DecodePointer GetLastError RaiseException FindResourceExW GetCurrentThreadId GetFileType DuplicateHandle IsDebuggerPresent OutputDebugStringW VerSetConditionMask SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcess RtlCaptureStackBackTrace

user32

EnableWindow IsWindowVisible IsZoomed IsIconic SetWindowPos UnregisterClassW UpdateLayeredWindow IsWindow CallWindowProcW DefWindowProcW SetForegroundWindow SetPropW PostMessageW GetClientRect GetWindowRect MessageBoxW SetLayeredWindowAttributes ShowWindow SendMessageW ReleaseDC GetWindowDC GetDC GetMonitorInfoW GetPropW RemovePropW SetWindowRgn MonitorFromWindow GetParent SetWindowLongW GetWindowLongW ScreenToClient CopyRect SetTimer KillTimer RedrawWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW GetSysColor ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret CreateCaret FindWindowW AdjustWindowRectEx GetMenu GetSystemMetrics GetClassInfoExW RegisterClassExW RegisterClassW PostQuitMessage RegisterWindowMessageW wsprintfW CopyImage MapWindowPoints GetCursorPos InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetFocus PeekMessageW BringWindowToTop GetAsyncKeyState FindWindowExW GetWindowThreadProcessId SendMessageTimeoutW SendNotifyMessageW CharUpperW CharPrevExA CharLowerW EqualRect DestroyCursor DrawFocusRect MoveWindow SetFocus DestroyWindow IsChild CreateWindowExW DispatchMessageW TranslateMessage GetMessageW GetIconInfo DrawIconEx LoadImageW DestroyIcon IsRectEmpty IntersectRect SetRect DrawTextW CharPrevW CharNextW PtInRect LoadCursorW OffsetRect UnionRect InflateRect SetCursor wvsprintfW SystemParametersInfoW GetWindow

gdi32

GetObjectW CreateDIBSection BitBlt SetDIBitsToDevice SelectObject GetDIBits DeleteDC CreateDCW CreateCompatibleDC DeleteObject CreateRoundRectRgn SetViewportOrgEx RectVisible OffsetViewportOrgEx CombineRgn CreatePen CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetStockObject GetTextExtentPoint32W LineTo Rectangle RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode SetStretchBltMode SetTextColor MoveToEx TextOutW ExtTextOutW GdiFlush CreateFontIndirectW RestoreDC SaveDC GetTextMetricsW SetWindowOrgEx GetDeviceCaps CreateSolidBrush CreateCompatibleBitmap StretchBlt

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeSecurity CoCreateGuid OleRun

oleaut32

SysAllocStringByteLen VariantClear VariantCopy VariantInit SysAllocString VariantChangeType SetErrorInfo CreateErrorInfo SysStringLen SysAllocStringLen VarUI4FromStr SysFreeString GetErrorInfo

shlwapi

PathFileExistsW PathCombineW SHCreateStreamOnFileEx PathRemoveFileSpecW PathAppendW PathIsDirectoryW PathIsRelativeW SHGetValueW StrStrIA StrTrimA StrCmpNIW StrStrIW SHSetValueW PathAppendA PathIsPrefixW PathRenameExtensionA PathFindFileNameA PathFindExtensionW wnsprintfW SHDeleteValueW PathFindFileNameW PathIsRootW StrCmpIW StrToInt64ExW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

gdiplus

GdipCreateFontFamilyFromName GdipAlloc GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawImageRectI GdipFree GdipLoadImageFromStream GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipCreateSolidFill GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreatePath GdipFillEllipseI GdipCreatePen1 GdipDeletePen GdipDrawEllipseI GdipAddPathArc GdipDrawPath GdiplusStartup GdiplusShutdown GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateTexture GdipCloneImage GdipDisposeImage

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

msimg32

AlphaBlend GradientFill

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

secur32

GetUserNameExW

setupapi

SetupIterateCabinetW

crypt32

CryptBinaryToStringW CryptStringToBinaryW CryptStringToBinaryA CryptBinaryToStringA

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

advapi32

EqualSid GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegGetValueW GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW RegCloseKey DeleteAce RegQueryValueExW FreeSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetUserNameW

shell32

ord165 SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHChangeNotify SHGetSpecialFolderPathW SHBrowseForFolderW SHGetPathFromIDListW

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

425KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=178, id=243, version=40116,

count=35, id=242, version=40116,

count=1, id=208, version=65501,

count=2, id=260, version=27034,

count=10, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=24, id=261, version=27051,

count=5, id=261, version=27031,

count=1, id=209, version=65501,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=13, id=260, version=27054,

count=132, id=261, version=26706,

count=38, id=260, version=26706,

count=4, id=206, version=65501,

count=43, id=203, version=65501,

count=565, id=1, productName=Unmarked objects,

count=172, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,