2026-10-13_213973d8eba3cfb9220db3ff044bde93_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_213973d8eba3cfb9220db3ff044bde93_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.5MB
Sample261015-wrcbvsaz3x
SHA256 56c6508aff8a629873f80db47554ecf1559480c81ca2f9ec3d6ff70ba3d77624
MD5 213973d8eba3cfb9220db3ff044bde93
SHA1 c020c84510ac9dda9d13b6568db6955d0138756d
SHA512 ccaf4bb3bdececbb4070c55c825c735b681a82f38ed7656f95296af56f4299c477105bc1d8bfd3d377cad79da82ac497e606d79f6fb4355fa61603ef665d1a85
SSDEEP 24576:o1cS1CklbwM+s04vEjOpgI/HGl7k+TvFsnSQ0OUT7K4i9/iHFaFGQT3x:09HvzuZNvFU8Ri9/GFk
TLSH
T1D975E03176C1C136DA7201B04A79ABB9157FFA244B361AD7A3D8493E19303E21F36A77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_213973d8eba3cfb9220db3ff044bde93_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-13_213973d8eba3cfb9220db3ff044bde93_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.5MB

2026-10-13_213973d8eba3cfb9220db3ff044bde93_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH b6f33e662384ed7cda66fb43200c5f2e
SHA256 56c6508aff8a629873f80db47554ecf1559480c81ca2f9ec3d6ff70ba3d77624
MD5 213973d8eba3cfb9220db3ff044bde93
SHA1 c020c84510ac9dda9d13b6568db6955d0138756d
SHA512 ccaf4bb3bdececbb4070c55c825c735b681a82f38ed7656f95296af56f4299c477105bc1d8bfd3d377cad79da82ac497e606d79f6fb4355fa61603ef665d1a85
SSDEEP 24576:o1cS1CklbwM+s04vEjOpgI/HGl7k+TvFsnSQ0OUT7K4i9/iHFaFGQT3x:09HvzuZNvFU8Ri9/GFk
TLSH
T1D975E03176C1C136DA7201B04A79ABB9157FFA244B361AD7A3D8493E19303E21F36A77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\workbase\project\tankcamp\gamedating\Updater\Release\TankCampUpdater.pdb

kernel32

EnterCriticalSection LeaveCriticalSection ReleaseMutex Sleep CreateMutexW LoadLibraryExW LocalFree InitializeCriticalSection DeviceIoControl TerminateProcess OpenProcess GetExitCodeProcess GetVersionExW GetStdHandle GetFileSize SetEndOfFile OutputDebugStringA GetLocalTime lstrlenA SetConsoleTextAttribute FreeConsole AllocConsole WriteConsoleW GlobalFree SetLastError SetEvent MulDiv lstrcmpW CreateEventW InterlockedDecrement SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage InterlockedIncrement FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP SetStdHandle GetTimeZoneInformation ExitProcess RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx GetFileSizeEx CreateFileA LocalFileTimeToFileTime GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetTempFileNameW GetTempPathW lstrcmpiW SystemTimeToFileTime SetFilePointer GetFileType GetCurrentProcess FindNextFileW FindFirstFileW CreateDirectoryW FindResourceExW OutputDebugStringW CreateProcessW GetModuleHandleW lstrlenW FindClose ReadFile WaitForSingleObject FreeLibrary GetCurrentProcessId GlobalUnlock GlobalLock GetCurrentThreadId GlobalAlloc SetFileAttributesW CreateFileW FindResourceW CloseHandle WriteFile SizeofResource LoadResource LockResource FreeResource WideCharToMultiByte DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer GetModuleFileNameW LoadLibraryW GetProcAddress

user32

SetWindowPos UnregisterClassW GetWindowTextW GetWindowTextLengthW SetCursor GetCursorPos CreateCaret GetCaretBlinkTime HideCaret SetCaretPos ScreenToClient GetSysColor FillRect SetRect CopyRect IntersectRect UnionRect SubtractRect OffsetRect GetSystemMetrics SetWindowTextW InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow IsRectEmpty PtInRect SetClassLongW GetWindowRect GetParent GetWindowThreadProcessId PostMessageW SetTimer GetMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW DestroyWindow ShowWindow LoadCursorW LoadImageW DrawIconEx GetIconInfo CharNextW PostQuitMessage CallWindowProcW KillTimer GetClientRect MapWindowPoints GetWindowLongW SetWindowLongW GetWindow MonitorFromWindow GetMonitorInfoW ClientToScreen TrackMouseEvent GetMessagePos SendMessageW AttachThreadInput RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow UpdateLayeredWindow GetForegroundWindow MoveWindow BringWindowToTop IsZoomed RegisterClipboardFormatW SetFocus GetFocus GetKeyState GetAsyncKeyState SetCapture ReleaseCapture DrawIcon DrawTextW UpdateWindow EnumDisplaySettingsW SystemParametersInfoW SwitchToThisWindow

gdi32

CreateSolidBrush MoveToEx DeleteDC DeleteObject GetBitmapBits GetDeviceCaps GetDIBits GetObjectA GetTextExtentPoint32W LineTo Rectangle RoundRect SelectObject SetBkMode SetBitmapBits StretchBlt SetStretchBltMode SetTextColor GetObjectW BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateFontIndirectW CreateFontW CreatePen CreateRectRgn GetStockObject CreateRoundRectRgn CreateDIBSection

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCloseKey RegQueryValueExA

shell32

Shell_NotifyIconW

ole32

CreateStreamOnHGlobal CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VarUI4FromStr

shlwapi

PathRemoveExtensionW PathMatchSpecW StrDupW PathFindFileNameW PathAddBackslashW PathRemoveFileSpecW PathFileExistsW PathAppendW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetOpenA InternetSetOptionW

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses

gdiplus

GdipSetStringFormatTrimming GdipReleaseDC GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetImageAttributesColorKeys GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateStringFormat GdipMeasureString GdipDrawString GdipGetFontSize GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipDeleteGraphics GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipScaleTextureTransform GdipTranslateTextureTransform GdipCreateTexture2I GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipAddPathString GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDeleteStringFormat GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipDrawImageRectRectI GdipFillPath GdipFillEllipseI GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipSetSmoothingMode GdipCreateBitmapFromStream GdipCreateFromHDC GdipCreateSolidFill

generic

count=16, id=241, version=40116,

count=170, id=243, version=40116,

count=29, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=26, id=259, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=513, id=1, productName=Unmarked objects,

count=7, id=261, version=27040,

count=3, id=265, version=27045,

count=1, id=261, version=27039,

count=22, id=261, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,