2026-10-11_411053ad2870dcc3bda37f658288ac83_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_411053ad2870dcc3bda37f658288ac83_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 4.9MB
Sample261012-3f9asafc33
SHA256 90899d31f63c4de8b68f8dd2ed502fbfcf53645c1a93e9a07c174bf2b2b2b9f4
MD5 411053ad2870dcc3bda37f658288ac83
SHA1 8e431d347065462a12465afd15e61d3f68fe6a66
SHA512 a7c5f7b0fbaa2f96f52213c90a84d6077f9359a175aae439b510faccda3db0c48ad5a894e271ff76c358a7e4dadecd83e06f801b3eaf959aff260b27e6204a8f
SSDEEP 98304:+5zhIPZ0/1zlQ7epwIOl0y3xut3ccUpWOegzFhoO:+5zO6Q7e82gWRgB
TLSH
T1AD369D207901C172ED8210F5D9BCBEFF856D8D209B654AD393D43D6EA9702D33B3698A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_411053ad2870dcc3bda37f658288ac83_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-11_411053ad2870dcc3bda37f658288ac83_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 4.9MB

2026-10-11_411053ad2870dcc3bda37f658288ac83_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH 6cd249e010b702c21041f4d331a69e6e
SHA256 90899d31f63c4de8b68f8dd2ed502fbfcf53645c1a93e9a07c174bf2b2b2b9f4
MD5 411053ad2870dcc3bda37f658288ac83
SHA1 8e431d347065462a12465afd15e61d3f68fe6a66
SHA512 a7c5f7b0fbaa2f96f52213c90a84d6077f9359a175aae439b510faccda3db0c48ad5a894e271ff76c358a7e4dadecd83e06f801b3eaf959aff260b27e6204a8f
SSDEEP 98304:+5zhIPZ0/1zlQ7epwIOl0y3xut3ccUpWOegzFhoO:+5zO6Q7e82gWRgB
TLSH
T1AD369D207901C172ED8210F5D9BCBEFF856D8D209B654AD393D43D6EA9702D33B3698A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2432368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\mysti\OneDrive\Desktop\FULL #MartySama 5.9 DX9Ex\#MartySama 5.9 DX9Ex\SRC\metin2_client\Srcs\Client\bin\Release\metin2client.pdb

kernel32

DeleteFileA GetCurrentDirectoryA GetTickCount GetCurrentDirectoryW ReadProcessMemory GetCurrentProcessId WriteConsoleW SetEndOfFile GetCurrentProcess GetLastError FindNextFileA FindFirstFileA ReleaseMutex HeapQueryInformation HeapSize OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle DeleteFileW GetTimeZoneInformation CreateProcessW GetExitCodeProcess GetFileSizeEx SetConsoleCtrlHandler SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber HeapAlloc HeapFree GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType ExitProcess GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread FindClose UnhandledExceptionFilter IsDebuggerPresent CreateMutexA FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException GetThreadTimes GetCurrentThread QueryPerformanceFrequency SetLastError WaitNamedPipeW PeekNamedPipe CreateFileW GetModuleFileNameW GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW GetModuleHandleW DeviceIoControl AreFileApisANSI CreateFile2 GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree QueryPerformanceCounter CopyFileA CreateSemaphoreA ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GetModuleFileNameA GlobalFree lstrlenA GetPrivateProfileStringA MoveFileA WakeConditionVariable TryAcquireSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread SwitchToThread WaitForSingleObjectEx FlsFree GetSystemTimePreciseAsFileTime GlobalUnlock FreeLibrary GetVersionExA GetSystemDirectoryA MultiByteToWideChar SetFileAttributesA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot GetSystemInfo OpenProcess SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection GetModuleHandleA WriteFile SetFilePointer ReadFile LoadLibraryA GetProcAddress GetCurrentThreadId SetUnhandledExceptionFilter GetFileSize CreateFileA CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GetTempFileNameA GetTempPathA RemoveDirectoryA CreateDirectoryA AllocConsole GlobalAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection TerminateProcess CloseHandle

user32

SystemParametersInfoA LoadIconA GetKeyState ShowCursor SetCursor DestroyCursor LoadImageA SetCursorPos ClientToScreen ShowWindow GetCapture SetCapture FindWindowA ScreenToClient GetCursorPos GetAsyncKeyState SetWindowPos PostQuitMessage MessageBoxA DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA IsWindow DestroyWindow MoveWindow SetFocus UpdateWindow ReleaseCapture ChangeDisplaySettingsA GetSystemMetrics PeekMessageA GetDC ReleaseDC BeginPaint EndPaint InvalidateRect GetClientRect FillRect SetRect OffsetRect LoadStringA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetWindowRect SetWindowTextA GetMenu RegisterClassA CharPrevExA CharNextExA SetWindowLongA GetWindowLongA

gdi32

SetBkColor GetTextExtentPoint32W TextOutW CreateCompatibleDC DeleteDC SetBkMode SetDIBitsToDevice CreateDIBSection TextOutA GetCharABCWidthsFloatW CreateFontIndirectA EnumFontFamiliesExA CreateSolidBrush DeleteObject PatBlt StretchBlt GetTextExtentPoint32A SelectObject SetTextColor GetStockObject

ole32

CoInitialize CoCreateInstance CoInitializeEx OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoUninitialize

winmm

timeBeginPeriod timeGetDevCaps timeGetTime timeEndPeriod

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXQuaternionRotationYawPitchRoll D3DXPlaneNormalize D3DXCompileShader D3DXMatrixRotationY D3DXCreateTextureFromFileInMemoryEx D3DXVec3Transform D3DXCreateTexture D3DXLoadSurfaceFromSurface D3DXGetImageInfoFromFileInMemory D3DXGetFVFVertexSize D3DXCreateSphere D3DXCreateCylinder D3DXCreateMatrixStack D3DXMatrixTranspose D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovRH D3DXMatrixLookAtRH D3DXMatrixDeterminant D3DXVec2Normalize D3DXMatrixScaling D3DXVec3Unproject D3DXVec3Project D3DXMatrixTransformation D3DXVec4Transform D3DXMatrixRotationAxis D3DXVec3TransformNormal D3DXMatrixRotationX D3DXMatrixInverse D3DXMatrixRotationYawPitchRoll D3DXMatrixOrthoOffCenterRH D3DXMatrixMultiply D3DXVec3Normalize D3DXVec3TransformCoord D3DXMatrixRotationZ D3DXQuaternionRotationAxis D3DXMatrixTranslation D3DXMatrixRotationQuaternion D3DXQuaternionMultiply

python27

PyDict_GetItemString PyList_New PyList_Append PyInt_AsLong PyDict_Next PyDict_Size PyString_AsString PyErr_SetString PyFrame_GetLineNumber PyExc_RuntimeError _PyThreadState_Current PyString_FromString PyModule_AddStringConstant PyImport_ImportModule PyString_InternFromString PyObject_GetAttrString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check _Py_NoneStruct PyDict_SetItemString PyModule_GetDict PyErr_Fetch PyTuple_Size Py_Initialize Py_Finalize PyRun_StringFlags Py_CompileStringFlags PyEval_SetTrace Py_FlushLine PyImport_GetMagicNumber PyImport_AddModule PyObject_AsCharBuffer PyCode_Addr2Line PyEval_EvalCode Py_OptimizeFlag PyCode_Type PyUnicodeUCS2_DecodeUTF8 PyInt_FromLong _PyLong_FromByteArray PyFloat_FromDouble PyComplex_FromCComplex PyString_FromStringAndSize PyLong_AsLong Py_InitModule4 PyModule_AddIntConstant Py_BuildValue PyTuple_GetItem PyTuple_New PyList_SetItem PyDict_New PyDict_SetItem PyErr_Occurred PyErr_NoMemory PyCode_New PyMarshal_ReadObjectFromString _PyLong_New _Py_EllipsisObject PyExc_StopIteration PyExc_EOFError PyExc_ValueError Py_SetProgramName PyEval_GetRestricted

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

devil

ilGetInteger ilGenImages ilDeleteImages ilBindImage ilInit ilTexImage ilSetPixels ilSave ilShutDown ilOriginFunc ilConvertImage ilEnable ilCopyPixels ilLoad

granny2

_GrannyCompleteControlAt@8 _GrannySetLogCallback@4 _GrannyGetMaterialTextureByType@8 _GrannyFindMatchingMember@16 _GrannyConvertSingleObject@20 _GrannyReadEntireFileFromMemory@8 _GrannyGetWorldPose4x4@8 _GrannyFreeFileSection@8 _GrannyFreeFile@4 _GrannyGetFileInfo@4 _GrannyGetSourceSkeleton@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannySampleModelAnimationsAccelerated@20 _GrannyUpdateModelMatrix@20 _GrannyNewLocalPose@4 _GrannyFreeLocalPose@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyInstantiateModel@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyFreeControlOnceUnused@4 _GrannyFreeControl@4 _GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannyGetWorldPoseComposite4x4@8 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@16 _GrannyCopyMeshIndices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexType@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyPlayControlledAnimation@12 _GrannySetControlRawLocalClock@8 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOutCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyGetControlLocalDuration@4

mss32

_AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_init_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_update_3D_position@8 _AIL_auto_update_3D_position@8 _AIL_set_file_callbacks@16

speedtreert

?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z

dinput8

DirectInput8Create

ws2_32

gethostbyname ntohs ntohl inet_addr htons gethostname htonl WSACleanup __WSAFDIsSet closesocket connect ioctlsocket recv select send socket WSAGetLastError WSAStartup

ddraw

DirectDrawCreate

advapi32

RegQueryValueExW RegSetValueExW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptReleaseContext CryptGenRandom RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

SysAllocString SafeArrayCreate SafeArrayDestroy SafeArrayAccessData VariantInit SysFreeString VariantClear

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

604KB

Virtual Size

603KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

132KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

327KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=264, version=36256,

count=48, id=259, version=33145,

count=218, id=261, version=33145,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=25, version=9210,

count=1, id=29, version=9178,

count=2, id=262, version=33145,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=5, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=253, version=35721,

count=26, id=259, version=35721,

count=18, id=260, version=35721,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=98, id=261, version=35721,

count=1, id=260, version=36256,

count=43, id=260, version=33145,

count=25, id=257, version=33145,

count=562, id=1, productName=Unmarked objects,

count=342, id=261, version=36256,

count=1, id=255, version=36256,

count=1, id=151,

count=1, id=258, version=36256,