2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

General

Target
2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop
Size 47.9MB
Sample261102-ke8nraee82
SHA256 52ef323b605dd13f6747097b42e081a97d5ac3107969ac0d53fdafa2c9ffff23
MD5 cc8224014520ac52b82476abb286498b
SHA1 8825acec5ee0d0d1862d79a67a9a54dc13b709f5
SHA512 6df138b7247b7989d79a3ffafe3f4af06b97752d17d82b4efc972100d3ddea9a912a324f52fa91010cf6316916eedb36c571f73bfc37726ed8a6db8e47acdd8d
SSDEEP 786432:SNVjchuWARCSRpGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0K3:SNVjchuWARLRPinmMeQhJhCV49hG1oB
TLSH
T125B71220368EC43BE62F16B1593D9A6A913C7DA61B7208D773DCBD1916748C32732E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

.exe 47.9MB

2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 63ed59597dad42eeec3f01fae0ba2a2e
SHA256 52ef323b605dd13f6747097b42e081a97d5ac3107969ac0d53fdafa2c9ffff23
MD5 cc8224014520ac52b82476abb286498b
SHA1 8825acec5ee0d0d1862d79a67a9a54dc13b709f5
SHA512 6df138b7247b7989d79a3ffafe3f4af06b97752d17d82b4efc972100d3ddea9a912a324f52fa91010cf6316916eedb36c571f73bfc37726ed8a6db8e47acdd8d
SSDEEP 786432:SNVjchuWARCSRpGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0K3:SNVjchuWARLRPinmMeQhJhCV49hG1oB
TLSH
T125B71220368EC43BE62F16B1593D9A6A913C7DA61B7208D773DCBD1916748C32732E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2294976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW Sleep LoadLibraryExW FreeLibrary GetCurrentProcess WideCharToMultiByte GetSystemDirectoryW GetCurrentProcessId DecodePointer CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateNamedPipeW GetExitCodeThread lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW CompareStringW FindNextFileW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW CreateSemaphoreW ReleaseSemaphore GlobalMemoryStatus GetModuleHandleA GetProcessAffinityMask VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW OutputDebugStringW GetLocalTime FlushFileBuffers LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW FormatMessageW ConnectNamedPipe CloseHandle InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx FindFirstFileExW MoveFileExW QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode SetFilePointerEx GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetEnvironmentStringsW CreateFileW

imagehlp

SymGetModuleBase SymFunctionTableAccess SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions StackWalk

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

746KB

Virtual Size

745KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop

kernel32

imagehlp

generic