2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.7MB
Sample261012-rmtywsfv4m
SHA256 1106c577b900d0cc6399c26171f51ed803864527dc08c0c22aba3cad406dd403
MD5 a3ae8f2c3e83409faa059f6442471522
SHA1 3b7e7a9bbe8798ec3a3e01e1b71ceeeb55ec904c
SHA512 1e144d4d25685446a6cb14920052c3a70af980a94f8700febd553d899fd4529e798dfa7db1838b215cf614f30051d716dce7bbe06e9894e14250695acdec1397
SSDEEP 49152:fgoOWsUCVaWK+TCDbIixJwb3i3tE0e/1Jtr:jsfrUjqi3tE/d
TLSH
T14F85DF217596C032D5A501722B6DDFB9813DBF711F72A5CBA3D43BA94A384C12B32F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

.exe 1.7MB

2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

IMPHASH e950f68a54e587bfd7fbe8349d3d13f4
SHA256 1106c577b900d0cc6399c26171f51ed803864527dc08c0c22aba3cad406dd403
MD5 a3ae8f2c3e83409faa059f6442471522
SHA1 3b7e7a9bbe8798ec3a3e01e1b71ceeeb55ec904c
SHA512 1e144d4d25685446a6cb14920052c3a70af980a94f8700febd553d899fd4529e798dfa7db1838b215cf614f30051d716dce7bbe06e9894e14250695acdec1397
SSDEEP 49152:fgoOWsUCVaWK+TCDbIixJwb3i3tE0e/1Jtr:jsfrUjqi3tE/d
TLSH
T14F85DF217596C032D5A501722B6DDFB9813DBF711F72A5CBA3D43BA94A384C12B32F1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

431445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\work\video_clip\develop\ImageShow\Output\Bin\Release\Win32\PicRunTime.pdb

kernel32

SetThreadLocale OpenProcess SetFileAttributesW MoveFileExW ResetEvent SetEvent PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateEventW CreateIoCompletionPort GetQueuedCompletionStatus GetLocalTime VirtualAlloc SetUnhandledExceptionFilter IsBadReadPtr VirtualProtect ExitProcess GetCurrentProcessId InitializeCriticalSection K32EnumProcessModules lstrcmpA GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile UnmapViewOfFile OpenEventW OpenFileMappingW DeviceIoControl SetEndOfFile GetFileSizeEx RemoveDirectoryW GetLongPathNameW InitializeCriticalSectionAndSpinCount SetErrorMode CreateThread FlushFileBuffers WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind UnhandledExceptionFilter WakeAllConditionVariable GetCPInfo GetTickCount GetNativeSystemInfo LocalFileTimeToFileTime Process32NextW GlobalFree GlobalAlloc GetSystemInfo lstrlenA SystemTimeToTzSpecificLocalTime Sleep FindClose FindNextFileW FindFirstFileW lstrlenW GetFileAttributesExW GetVersionExW WaitForSingleObject VerifyVersionInfoW VerSetConditionMask GetFileSize DeleteFileW SetProcessShutdownParameters WriteFile SetFilePointer CreateFileW TerminateProcess GetCommandLineW LoadLibraryExW lstrcmpiW GetSystemTime FreeLibrary LoadLibraryW MultiByteToWideChar GetCurrentProcess GetPrivateProfileStringW GetStartupInfoW WritePrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW OutputDebugStringA SetLastError RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetModuleFileNameW SystemTimeToFileTime LocalFree GetWindowsDirectoryW FileTimeToSystemTime WideCharToMultiByte GetModuleHandleW CreateProcessW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW CloseHandle HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx LCMapStringEx GetStringTypeW SleepConditionVariableSRW QueryPerformanceFrequency QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetThreadLocale Process32FirstW CreateToolhelp32Snapshot CreatePipe HeapFree SizeofResource ReadFile GetConsoleOutputCP

user32

CharNextW GetMessageW DispatchMessageW PeekMessageW ShowWindow PostQuitMessage TranslateMessage KillTimer SetTimer SendMessageW PostMessageW CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow IsWindow DefWindowProcW CharLowerBuffW UnregisterClassW wsprintfW MessageBoxW

advapi32

RegOpenKeyExW InitializeSecurityDescriptor RegSetValueExW RegSetKeySecurity RegCreateKeyExW RegEnumKeyW GetUserNameW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW SetSecurityDescriptorDacl RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetMalloc SHChangeNotify SHGetFolderPathW ord165 ShellExecuteW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity OleRun CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoTaskMemFree CoInitialize

oleaut32

GetErrorInfo SysFreeString SysStringLen LoadTypeLi SysAllocString VariantInit VariantClear VariantCopy VarUI4FromStr LoadRegTypeLi

shlwapi

PathSearchAndQualifyW AssocQueryStringW StrStrIW PathIsDirectoryW PathCombineW PathRemoveExtensionW PathFindFileNameW PathCanonicalizeW PathRemoveBackslashW PathIsPrefixW PathRemoveFileSpecW PathAppendW SHDeleteValueW StrCmpIW SHGetValueW PathFileExistsW

secur32

GetUserNameExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetReadFile HttpQueryInfoW InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW HttpOpenRequestW HttpSendRequestW InternetSetOptionW

crypt32

CryptBinaryToStringW CryptStringToBinaryW

netapi32

Netbios

iphlpapi

GetIpAddrTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_a3ae8f2c3e83409faa059f6442471522_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

secur32

version

wininet

crypt32

netapi32

iphlpapi

generic