2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader
Size 1.7MB
Sample261011-3fkmesbb99
SHA256 f243168a14b785bca6fa9a4a2bcd27e41f1eee35638f64ff68e1e046fb19b831
MD5 797f9830918933f19b83b7a2d6063960
SHA1 9bbe8db5e99ca707a09c135ab1b02ebc6dd74de4
SHA512 13e384ed01be624af2f938ef4616654f7a74d8ac7f553ea63ce0998023e5c6b87bb1bf5cffe52dd39b8e4cde64a9e85a378b73e55ca991bfaef949515e77921d
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoP/:k0psOkIAmJRpCS/xThP0q6kF+
TLSH
T17B859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

File Explorer

2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

.exe 1.7MB

2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

IMPHASH 9e34d1ea3835c0ff6057e6898d581533
SHA256 f243168a14b785bca6fa9a4a2bcd27e41f1eee35638f64ff68e1e046fb19b831
MD5 797f9830918933f19b83b7a2d6063960
SHA1 9bbe8db5e99ca707a09c135ab1b02ebc6dd74de4
SHA512 13e384ed01be624af2f938ef4616654f7a74d8ac7f553ea63ce0998023e5c6b87bb1bf5cffe52dd39b8e4cde64a9e85a378b73e55ca991bfaef949515e77921d
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoP/:k0psOkIAmJRpCS/xThP0q6kF+
TLSH
T17B859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1720320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Torch\69-prerelease\Client\src\out\release_static_x86_official\setup.exe.pdb

advapi32

AddAce AdjustTokenPrivileges CloseServiceHandle ControlService ConvertSidToStringSidW ConvertStringSidToSidW CopySid CreateProcessAsUserW EqualSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetUserNameW ImpersonateNamedPipeClient InitializeAcl InitializeSid IsValidSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueA RegEnumValueW RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegisterTraceGuidsW RevertToSelf SetNamedSecurityInfoW StartServiceW SystemFunction036 TraceEvent UnregisterTraceGuids

psapi

GetPerformanceInfo GetProcessMemoryInfo

shell32

CommandLineToArgvW ord680 SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath SHOpenWithDialog SHQueryUserNotificationState ShellExecuteExW ShellExecuteW

user32

AllowSetForegroundWindow CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EqualRect GetForegroundWindow GetMessageW GetMonitorInfoW GetSystemMetrics GetWindowLongW GetWindowRect GetWindowThreadProcessId IntersectRect LoadIconW MessageBoxW MonitorFromRect MonitorFromWindow MoveWindow PostMessageW RegisterClassW SendMessageW SetForegroundWindow SetWindowLongW SetWindowsHookExW TranslateMessage UnhookWindowsHookEx UnregisterClassW

ws2_32

ntohl

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject AttachConsole CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlushFileBuffers FlushViewOfFile FormatMessageA FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleDisplayMode GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadLocale GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion GetVersionExW GetWindowsDirectoryW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessShutdownParameters SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear StringFromGUID2

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathMatchSpecW UrlCanonicalizeW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromCLSID

winmm

timeGetTime

urlmon

CreateURLMonikerEx

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantInit

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

334KB

Virtual Size

334KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

108KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader

advapi32

psapi

shell32

user32

ws2_32

kernel32

ole32

wtsapi32

version

shlwapi

userenv

propsys

winmm

urlmon

oleaut32

winhttp

generic