2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader
Size 1.7MB
Sample261102-h5ga3sh18p
SHA256 bb0094bc30e95564c90d1ca936202b62426ac229006e767c951b1c8bb7f54f4a
MD5 d72b1ec66413a88420c69bf0b2af8a9d
SHA1 294f25ba2a14fa08ad826af056f90c690160a67d
SHA512 8d1007044bdd2489ef80416af6c0fe78a5a5b6dce6df94ea5ab78e5246043a3585e4c30ee57a261068c36a90575f3e44684174922c554e9d72a9e22c90074127
SSDEEP 49152:8RohZj8do3gMxpkNk6GmJKkOie628ghTmWcgc0YJ0:8ihZAdYNxCNrGYOieN8CNcgc0YJ0
TLSH
T15285F110B451E0B6D81210315CBDFB3952388E469F244EEBC7D1FE7D6E7A1D20E3A69A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

File Explorer

2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

.exe 1.7MB

2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

IMPHASH 51fac60819f50ca3be536bbf3430c81b
SHA256 bb0094bc30e95564c90d1ca936202b62426ac229006e767c951b1c8bb7f54f4a
MD5 d72b1ec66413a88420c69bf0b2af8a9d
SHA1 294f25ba2a14fa08ad826af056f90c690160a67d
SHA512 8d1007044bdd2489ef80416af6c0fe78a5a5b6dce6df94ea5ab78e5246043a3585e4c30ee57a261068c36a90575f3e44684174922c554e9d72a9e22c90074127
SSDEEP 49152:8RohZj8do3gMxpkNk6GmJKkOie628ghTmWcgc0YJ0:8ihZAdYNxCNrGYOieN8CNcgc0YJ0
TLSH
T15285F110B451E0B6D81210315CBDFB3952388E469F244EEBC7D1FE7D6E7A1D20E3A69A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

501600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

SogouExplorer.exe.pdb

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowStationW GetClassNameW GetProcessWindowStation GetThreadDesktop GetUserObjectInformationW GetWindowLongW GetWindowThreadProcessId IsWindow MessageBoxW PostMessageW SendMessageW SendNotifyMessageW SetProcessWindowStation

kernel32

AssignProcessToJobObject CloseHandle CompareFileTime CompareStringW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DecodePointer DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetVersionExW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus ProcessIdToSessionId QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SuspendThread SwitchToThread TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrcmpW lstrlenW

Name

.text

Size

627KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

288B

Characteristics

Name

.rsrc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

786KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_d72b1ec66413a88420c69bf0b2af8a9d_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_smoke-loader

user32

kernel32

generic