2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader
Size 1.7MB
Sample261011-27pvsaba23
SHA256 5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073
MD5 df05dcb7b675dcf11cc0293ad49d7ede
SHA1 c62b73d88c896831634af9afeab80b2885f347ce
SHA512 6b21d7e5ecde8334ddbc753ca99cf7474329ca7862846e784838b876b83edbe5f98dc9b2554d9adf9c75c5d72ec3bc90d7e633814c3d70a72091fe4b40ee48dc
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoPV:k0psOkIAmJRpCS/xThP0q6kFO
TLSH
T183859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

File Explorer

2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

.exe 1.7MB

2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

IMPHASH 9e34d1ea3835c0ff6057e6898d581533
SHA256 5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073
MD5 df05dcb7b675dcf11cc0293ad49d7ede
SHA1 c62b73d88c896831634af9afeab80b2885f347ce
SHA512 6b21d7e5ecde8334ddbc753ca99cf7474329ca7862846e784838b876b83edbe5f98dc9b2554d9adf9c75c5d72ec3bc90d7e633814c3d70a72091fe4b40ee48dc
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoPV:k0psOkIAmJRpCS/xThP0q6kFO
TLSH
T183859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1720320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Torch\69-prerelease\Client\src\out\release_static_x86_official\setup.exe.pdb

advapi32

AddAce AdjustTokenPrivileges CloseServiceHandle ControlService ConvertSidToStringSidW ConvertStringSidToSidW CopySid CreateProcessAsUserW EqualSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetUserNameW ImpersonateNamedPipeClient InitializeAcl InitializeSid IsValidSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueA RegEnumValueW RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegisterTraceGuidsW RevertToSelf SetNamedSecurityInfoW StartServiceW SystemFunction036 TraceEvent UnregisterTraceGuids

psapi

GetPerformanceInfo GetProcessMemoryInfo

shell32

CommandLineToArgvW ord680 SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath SHOpenWithDialog SHQueryUserNotificationState ShellExecuteExW ShellExecuteW

user32

AllowSetForegroundWindow CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EqualRect GetForegroundWindow GetMessageW GetMonitorInfoW GetSystemMetrics GetWindowLongW GetWindowRect GetWindowThreadProcessId IntersectRect LoadIconW MessageBoxW MonitorFromRect MonitorFromWindow MoveWindow PostMessageW RegisterClassW SendMessageW SetForegroundWindow SetWindowLongW SetWindowsHookExW TranslateMessage UnhookWindowsHookEx UnregisterClassW

ws2_32

ntohl

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject AttachConsole CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlushFileBuffers FlushViewOfFile FormatMessageA FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleDisplayMode GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadLocale GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion GetVersionExW GetWindowsDirectoryW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessShutdownParameters SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear StringFromGUID2

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathMatchSpecW UrlCanonicalizeW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromCLSID

winmm

timeGetTime

urlmon

CreateURLMonikerEx

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantInit

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

334KB

Virtual Size

334KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

108KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

advapi32

psapi

shell32

user32

ws2_32

kernel32

ole32

wtsapi32

version

shlwapi

userenv

propsys

winmm

urlmon

oleaut32

winhttp

generic