2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop
Size 3.7MB
Sample260925-n65b7axt3n
SHA256 1decac6afd4ca9fc63f6421e617d03baf7b0ba89074fd1c9823db4294006aaa4
MD5 37945e665d68e68ad1e6526b01137d32
SHA1 95790ac3af7c79db835667c6e1175898e6106744
SHA512 8cd85d4bec2f9833e5c5325469a11e22c5ac3092b6beb4835c3be320615025608e6c2541c879eff789be98f2819d98ffbc23e46ccd0a6e1952328824a36ccee2
SSDEEP 49152:FchKPgssSt2gRKWTA8+i0mgiuciydcu2zdpHkDcj/7pFc/C6P9TMc63JlWdYfiK:Fchv7St2N8f01iuciNu2zPnj/7pxX5
TLSH
T1BF063B026FE55076F1B327309D7A731486BABEB21D36C51F66943A0E5A70E819932F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop

File Explorer

2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop

.exe 3.7MB

2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop

IMPHASH e791258d96e10d4d21caa3d8d49afe49
SHA256 1decac6afd4ca9fc63f6421e617d03baf7b0ba89074fd1c9823db4294006aaa4
MD5 37945e665d68e68ad1e6526b01137d32
SHA1 95790ac3af7c79db835667c6e1175898e6106744
SHA512 8cd85d4bec2f9833e5c5325469a11e22c5ac3092b6beb4835c3be320615025608e6c2541c879eff789be98f2819d98ffbc23e46ccd0a6e1952328824a36ccee2
SSDEEP 49152:FchKPgssSt2gRKWTA8+i0mgiuciydcu2zdpHkDcj/7pFc/C6P9TMc63JlWdYfiK:Fchv7St2N8f01iuciNu2zPnj/7pxX5
TLSH
T1BF063B026FE55076F1B327309D7A731486BABEB21D36C51F66943A0E5A70E819932F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_at\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb

kernel32

UnmapViewOfFile CreateFileA VirtualQueryEx GetCurrentProcess MapViewOfFile CreateFileMappingA GetFileAttributesA FindClose FindNextFileA FindFirstFileA ReadFile CloseHandle GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA LoadLibraryA FreeLibrary GetProcAddress GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetSystemInfo IsDebuggerPresent OutputDebugStringA SetFilePointer GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

user32

FindWindowA SendMessageA MessageBoxA

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

msvcr80

??0exception@std@@QAE@ABQBDH@Z ?what@exception@std@@UBEPBDXZ ??3@YAXPAX@Z ??0exception@std@@QAE@XZ _invalid_parameter_noinfo ??2@YAPAXI@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z strchr strrchr free strcpy malloc strlen strcmp ?terminate@@YAXXZ ??0exception@std@@QAE@ABQBD@Z __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer _invoke_watson _controlfp_s __CxxFrameHandler3 _snprintf _amsg_exit ??1exception@std@@UAE@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_37945e665d68e68ad1e6526b01137d32_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader_stop

kernel32

user32

advapi32

shell32

msvcp80

msvcr80

generic