2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader

General

Target
2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader
Size 688KB
Sample261020-p4sfaazvex
SHA256 24e2d507d1efb8124474db9d3e62bd5ccb4c508b17ede8b3c4897b088bed6ee3
MD5 91ee15f1d7889072d33a7f8c29895f33
SHA1 725cad5311b2839bda9354913b81f7a967ee1cf2
SHA512 2e0a2684e2362e3c6faf172d276f9a11833031a18cad0a072527fb77a8b6ccd249a1696c66356d0285002be44252b12852aa4d3a5be52d210a4985d771bdb9fd
SSDEEP 6144:wxmlp+NgR8mwnSAOY5o2TB63o1F12dMQRcR0FZXpu5tbXWBZw6ZraL3mSny0:w4ldRNwnSa9TB63mnQRlHQtOw6BaPN
TLSH
T18CE4195377E58521F1B33A3029BD96259A39FD6A1A20C11F277C1F5D1930AB0BA38B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader

File Explorer

2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader

.exe 688KB

2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader

IMPHASH 7c6aa7cb92b4940bd7f953ce159d6f65
SHA256 24e2d507d1efb8124474db9d3e62bd5ccb4c508b17ede8b3c4897b088bed6ee3
MD5 91ee15f1d7889072d33a7f8c29895f33
SHA1 725cad5311b2839bda9354913b81f7a967ee1cf2
SHA512 2e0a2684e2362e3c6faf172d276f9a11833031a18cad0a072527fb77a8b6ccd249a1696c66356d0285002be44252b12852aa4d3a5be52d210a4985d771bdb9fd
SSDEEP 6144:wxmlp+NgR8mwnSAOY5o2TB63o1F12dMQRcR0FZXpu5tbXWBZw6ZraL3mSny0:w4ldRNwnSa9TB63mnQRlHQtOw6BaPN
TLSH
T18CE4195377E58521F1B33A3029BD96259A39FD6A1A20C11F277C1F5D1930AB0BA38B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

25333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\click2run\x-none\perfboost.pdb

advapi32

OpenProcessToken GetTokenInformation LookupAccountNameW ConvertSidToStringSidW EventUnregister EventRegister EventWriteTransfer

kernel32

CreateEventExW Sleep GetCurrentProcess GetCurrentProcessId GetModuleFileNameW OpenEventW CreateMutexW LocalFree WaitForSingleObjectEx GetTickCount64 SetLastError CreateWaitableTimerW GetCurrentThreadId QueryDepthSList EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FindClose FindFirstFileExW SetFilePointerEx WriteFile MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetEvent IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RaiseException RtlUnwind EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW HeapSize GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetCurrentThread GetFileType GetStringTypeW HeapReAlloc GetProcessHeap FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers DecodePointer WriteConsoleW CreateFileW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetLastError CloseHandle GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FileTimeToSystemTime GetShortPathNameA CreateEventW GetThreadTimes

ole32

CoTaskMemFree StringFromIID

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_91ee15f1d7889072d33a7f8c29895f33_darkgate_elex_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader

advapi32

kernel32

ole32

generic