2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 14.8MB
Sample260929-ph3dcsz1c1
SHA256 87db211d39b0afff67ac5f5ed8e7a48d8f67319d8b7168a4213c3596ba0bfc2b
MD5 05f4aad1ec1cec291d6baf32c020946a
SHA1 6bd25bde1857c08109d3ea73e19942cc11e08b33
SHA512 7d4c8ec884800249aed56c8046e079f7f160204ac0e3c7589209840de4b3f4d53a8f4e383332630dafe706b72fe2abb86452369677363e1ea3b091ee6981aff6
SSDEEP 393216:Kb9+zykLmzEHwOkp719l89aAo4GXBhtVFMsnKC9:u9+zykLmz2c717RdhtzMRE
TLSH
T1EBF6CF227A4EC437E56F0AB0563C9B6B913C6D621F7248D773DCBD5A96B08C21232E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 14.8MB

2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 614aad28c38292f58cae1943df2be6db
SHA256 87db211d39b0afff67ac5f5ed8e7a48d8f67319d8b7168a4213c3596ba0bfc2b
MD5 05f4aad1ec1cec291d6baf32c020946a
SHA1 6bd25bde1857c08109d3ea73e19942cc11e08b33
SHA512 7d4c8ec884800249aed56c8046e079f7f160204ac0e3c7589209840de4b3f4d53a8f4e383332630dafe706b72fe2abb86452369677363e1ea3b091ee6981aff6
SSDEEP 393216:Kb9+zykLmzEHwOkp719l89aAo4GXBhtVFMsnKC9:u9+zykLmz2c717RdhtzMRE
TLSH
T1EBF6CF227A4EC437E56F0AB0563C9B6B913C6D621F7248D773DCBD5A96B08C21232E53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2294512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CloseHandle GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW Sleep LoadLibraryExW FreeLibrary GetCurrentProcess WideCharToMultiByte GetSystemDirectoryW GetCurrentProcessId DecodePointer CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateNamedPipeW GetExitCodeThread lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW CompareStringW FindNextFileW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW CreateSemaphoreW ReleaseSemaphore GlobalMemoryStatus GetModuleHandleA GetProcessAffinityMask CreateThread VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW OutputDebugStringW GetLocalTime FlushFileBuffers LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW FormatMessageW ConnectNamedPipe GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx FindFirstFileExW MoveFileExW QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode SetFilePointerEx GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW CreateFileW

imagehlp

SymGetModuleBase SymFunctionTableAccess SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions StackWalk

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

746KB

Virtual Size

746KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

kernel32

imagehlp

generic