2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.7MB
Sample261024-xtck3sdw3r
SHA256 9d7615ab5edd029ac5bd8e02858bf5c2dae4cc91b82b658fd8d30a7f47583ad8
MD5 233f826b6e65431101a2b52125314d1c
SHA1 18ffbed815d8e91ff08ec48b0d6e479fe244c1be
SHA512 68a332ba1e03044df9674b5b55524adb91267fc120142ae05f59d358f452ce02519361c576af2a54fa52a5054bd6f22f36229be3e7a75dd5f397581b02618c7c
SSDEEP 49152:GNTSi48Bs92yrgeMlDghAahEpzgJYlJarSj8RoTCCW:GxBxreCghAahE6sJTy
TLSH
T10085E03172928032D47300B1597EBBA6686DB0714B2695DBF3DC0A6D1B691D32F3EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.7MB

2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 0c2154a9472472efeaf7918b64042b68
SHA256 9d7615ab5edd029ac5bd8e02858bf5c2dae4cc91b82b658fd8d30a7f47583ad8
MD5 233f826b6e65431101a2b52125314d1c
SHA1 18ffbed815d8e91ff08ec48b0d6e479fe244c1be
SHA512 68a332ba1e03044df9674b5b55524adb91267fc120142ae05f59d358f452ce02519361c576af2a54fa52a5054bd6f22f36229be3e7a75dd5f397581b02618c7c
SSDEEP 49152:GNTSi48Bs92yrgeMlDghAahEpzgJYlJarSj8RoTCCW:GxBxreCghAahE6sJTy
TLSH
T10085E03172928032D47300B1597EBBA6686DB0714B2695DBF3DC0A6D1B691D32F3EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

415730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\build\core_lib\hardware\hdw_disk_scan\Release\hdw_disk_scan.pdb

kernel32

HeapReAlloc CloseHandle RaiseException LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary InterlockedIncrement lstrcmpiW LoadLibraryExW GetCommandLineW InitializeCriticalSection WaitForSingleObject CreateToolhelp32Snapshot CreateEventW Process32NextW SetEvent Process32FirstW ResetEvent LocalFree WideCharToMultiByte GetModuleFileNameA VirtualFree GetCurrentProcess DeviceIoControl VirtualAlloc GetSystemPowerStatus CreateMutexA GetVersionExW ReleaseMutex GetModuleHandleA GetDevicePowerState GlobalSize CreateFileA GlobalFree GlobalLock SetThreadExecutionState GetVersionExA GetLastError UnmapViewOfFile MapViewOfFile CreateFileW DeleteFileW WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetEnvironmentVariableW SetEnvironmentVariableA FlushFileBuffers GetFileAttributesExW ReadConsoleW ReadFile MultiByteToWideChar HeapSize GetCurrentThreadId CreateMutexW LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW InterlockedDecrement EnterCriticalSection SetLastError HeapFree GetACP WriteFile EnumSystemLocalesW GetStdHandle GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetTimeZoneInformation SetFilePointerEx OpenFileMappingW SizeofResource UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FormatMessageW GetStringTypeW QueryPerformanceFrequency SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache LoadLibraryExA OutputDebugStringW LockResource FindResourceExW RtlUnwind GetFileType

user32

GetClassInfoExW wsprintfW SetWindowLongW LoadCursorW TranslateMessage CharNextW PeekMessageW DispatchMessageW GetSystemMetrics OpenClipboard CloseClipboard GetClipboardData GetWindowLongW CallWindowProcW PostMessageW SetTimer PostQuitMessage GetMessageW DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExA RegOpenKeyExA RegCloseKey RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegSetValueExW

shell32

CommandLineToArgvW

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoSetProxyBlanket CoTaskMemAlloc

oleaut32

VarUI4FromStr VariantInit SysAllocStringLen VariantClear SysFreeString

shlwapi

StrStrIW PathRemoveFileSpecW PathAppendW PathFileExistsW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_233f826b6e65431101a2b52125314d1c_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic