2026-10-19_8fd20a9821a803b695b205d57b669851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_8fd20a9821a803b695b205d57b669851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 5.9MB
Sample261020-qeezbsbf96
SHA256 8180a971f1879824f8f977d7b39f6b7ed8efbed7e0b4b2a38d3a5e44e8166c7e
MD5 8fd20a9821a803b695b205d57b669851
SHA1 300eb283ae449a838196525339ae03ec8cce8424
SHA512 124f71835f0a4f6eb8093fc198dccd2e3b78c4bb969c34bf5fee1706114a94f973ef25106fb38da74d5a150aacee4fd95f47481dbebcc3e7a0a859f26a70d401
SSDEEP 98304:QABxMydd5IKSMdBYE0AbS/BgfL75xSeNisM6gDEsy+DOuVNHxkMYhujc:9xMyz5I2BYELbS5gfjSeNisM6gAF0Xl
TLSH
T10956D040B682D0B2D98A15B0A176BBFB9A361D14E72594D3D3E03C5DF5332D20A7BB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_8fd20a9821a803b695b205d57b669851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-19_8fd20a9821a803b695b205d57b669851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 5.9MB

2026-10-19_8fd20a9821a803b695b205d57b669851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH d591db0505cd67bade45d86c61d68ac3
SHA256 8180a971f1879824f8f977d7b39f6b7ed8efbed7e0b4b2a38d3a5e44e8166c7e
MD5 8fd20a9821a803b695b205d57b669851
SHA1 300eb283ae449a838196525339ae03ec8cce8424
SHA512 124f71835f0a4f6eb8093fc198dccd2e3b78c4bb969c34bf5fee1706114a94f973ef25106fb38da74d5a150aacee4fd95f47481dbebcc3e7a0a859f26a70d401
SSDEEP 98304:QABxMydd5IKSMdBYE0AbS/BgfL75xSeNisM6gDEsy+DOuVNHxkMYhujc:9xMyz5I2BYELbS5gfjSeNisM6gAF0Xl
TLSH
T10956D040B682D0B2D98A15B0A176BBFB9A361D14E72594D3D3E03C5DF5332D20A7BB8D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3533840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\wServers\Box2\sources\client\build\UserInterface\RelWithDebInfo\Metin2.pdb

d3dx9_43

D3DXMatrixRotationYawPitchRoll D3DXVec3TransformNormal D3DXMatrixTranspose D3DXMatrixInverse D3DXMatrixRotationAxis D3DXVec4Transform D3DXMatrixLookAtRH D3DXMatrixDeterminant D3DXVec2Normalize D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovRH D3DXMatrixScaling D3DXVec3Project D3DXCreateMatrixStack D3DXMatrixRotationQuaternion D3DXQuaternionRotationAxis D3DXQuaternionMultiply D3DXMatrixMultiply D3DXMatrixTranslation D3DXVec3TransformCoord D3DXMatrixRotationZ D3DXCreateSphere D3DXCreateCylinder D3DXCreateBox D3DXGetFVFVertexSize D3DXCreateTexture D3DXLoadSurfaceFromSurface D3DXCreateTextureFromFileInMemoryEx D3DXPlaneNormalize D3DXQuaternionRotationYawPitchRoll D3DXMatrixRotationX D3DXVec3Normalize

kernel32

FindClose FindNextFileA FindFirstFileA Sleep GetLastError GetCurrentProcess HeapSize WriteConsoleW GetCommandLineW GetCommandLineA PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent ReadConsoleW GetConsoleMode GetModuleFileNameW HeapCompact UnlockFileEx LockFileEx GetTimeZoneInformation CreateProcessW FlushFileBuffers FreeLibraryAndExitThread ExitThread SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetStdHandle VirtualQuery VirtualProtect VirtualAlloc MultiByteToWideChar GlobalAlloc GlobalFree CreateDirectoryA GetFileSize GetSystemInfo CreateFileMappingA MapViewOfFile UnmapViewOfFile CloseHandle CreateFileA LoadLibraryA GetProcAddress GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter OutputDebugStringA SetFilePointer WriteFile ReadFile GetModuleHandleA WideCharToMultiByte FreeLibrary GetVersionExA GetSystemDirectoryA GlobalLock GlobalUnlock lstrlenW CompareStringA GetLocaleInfoA DeleteFileA CreateThread SetThreadPriority WaitForSingleObject CreateEventA SetEvent CreateSemaphoreW ReleaseSemaphore QueryPerformanceFrequency QueryPerformanceCounter ResetEvent CreateFileW GetFileInformationByHandle LocalFree FormatMessageA OutputDebugStringW GetConsoleCP GetConsoleOutputCP IsDBCSLeadByte GetFileAttributesA SetEndOfFile GetFullPathNameA GetModuleFileNameA SetLastError HeapAlloc HeapFree GetProcessHeap TlsAlloc TlsGetValue TlsSetValue TlsFree SetErrorMode LoadLibraryExA GetEnvironmentVariableA SetEnvironmentVariableA SetEnvironmentVariableW SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExA GetFileAttributesExW GetFileType GetFullPathNameW RemoveDirectoryA RemoveDirectoryW SetFileAttributesA SetFileAttributesW SetFileTime DuplicateHandle CreatePipe GetProcessTimes TerminateProcess GetExitCodeProcess CreateProcessA OpenProcess GetSystemTime GetVersion MoveFileA MoveFileW SystemTimeToFileTime GenerateConsoleCtrlEvent SetConsoleCtrlHandler GetACP FlushViewOfFile ExpandEnvironmentStringsW GetStdHandle GetLocaleInfoEx FindFirstFileExW GetTempPathW CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetTickCount SwitchToThread RtlUnwind RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW

user32

PostQuitMessage GetCursorPos ScreenToClient FindWindowA LoadIconA SetWindowPos SystemParametersInfoA LoadImageA DestroyCursor ShowCursor SetCursor ClientToScreen SetCursorPos SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow GetCapture GetSystemMetrics CharPrevA CharPrevExA CharNextExA CharNextW GetKeyboardLayoutNameA GetKeyboardLayout CloseClipboard GetClipboardData OpenClipboard RegisterClassA LoadCursorA GetMenu AdjustWindowRectEx GetWindowRect InvalidateRect UpdateWindow RegisterClassExA UnregisterClassA GetClientRect SetFocus CreateWindowExA DefWindowProcA MoveWindow GetWindowLongA SetWindowLongA IsWindow DestroyWindow MessageBoxA PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC SetRect

winmm

timeGetTime timeEndPeriod

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext ImmNotifyIME ImmSetCompositionStringW ImmGetCompositionStringW ImmGetCandidateListW ImmGetIMEFileNameA ImmGetOpenStatus ImmGetConversionStatus ImmIsIME

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

dinput8

DirectInput8Create

ws2_32

connect WSACleanup WSAStartup socket inet_addr gethostbyname htons closesocket __WSAFDIsSet select send ioctlsocket WSAGetLastError recv

d3d9

Direct3DCreate9Ex

gdi32

SelectObject EnumFontFamiliesExA GetStockObject DeleteObject SetTextColor SetBkColor TextOutA SetBkMode CreateDIBSection CreateCompatibleDC DeleteDC TextOutW GetCharABCWidthsFloatW GetTextExtentPoint32W CreateFontIndirectA GetTextExtentPoint32A

advapi32

RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegSetValueA RegSaveKeyA RegQueryValueA RegQueryInfoKeyA RegLoadKeyA RegFlushKey RegDeleteKeyA RegQueryValueExA RegCloseKey CryptReleaseContext RegDeleteValueA RegConnectRegistryA RegEnumValueA RegEnumKeyExA RegCreateKeyA

shell32

SHGetSpecialFolderPathA ShellExecuteA ShellExecuteW

ole32

OleSetContainedObject OleUninitialize CoGetClassObject OleInitialize CoCreateInstance

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

326KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=242, id=261, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=22, id=253, version=35721,

count=40, id=259, version=35721,

count=20, id=260, version=35721,

count=91, id=261, version=35721,

count=24, id=261, version=36260,

count=210, id=260, version=36260,

count=62, id=259, version=33145,

count=64, id=260, version=33145,

count=22, id=257, version=33145,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=3, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=382, id=1, productName=Unmarked objects,

count=336, id=265, version=36260,

count=1, id=255, version=36260,

count=1, id=151,

count=1, id=258, version=36260,