2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader
Size 4.6MB
Sample261104-vr7mbsby2s
SHA256 f2460cdea9bb3143c5def437dcb357bfbeee2ce88235f3472072bac6b4bced65
MD5 7102652d029a4102cb1be08f9b66ebe5
SHA1 294f25f6dc5ad761f0dd406f8525fb109ef95a22
SHA512 25f7436ff9d707c6fc1ccbdd6c9695f595cf846dc11a85a5a1ddb8de690ff7458dc2967cfdd196d0ce5014c2c3f663028297d41881a1e0911d1fb79dd05f1176
SSDEEP 98304:mgJxIxMfY9b4hY8ffnpBZa8wSypsmCqC5+uMU+57:mgQx2Y9bJGfZMfsmCrVg
TLSH
T16726A0207607C037DA9351B25A2CAB9F863CAA201FB614D793E43E7D0D615C36B36E97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 4.6MB

2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 99e18a114a5695802ca34d0f2ef06bc7
SHA256 f2460cdea9bb3143c5def437dcb357bfbeee2ce88235f3472072bac6b4bced65
MD5 7102652d029a4102cb1be08f9b66ebe5
SHA1 294f25f6dc5ad761f0dd406f8525fb109ef95a22
SHA512 25f7436ff9d707c6fc1ccbdd6c9695f595cf846dc11a85a5a1ddb8de690ff7458dc2967cfdd196d0ce5014c2c3f663028297d41881a1e0911d1fb79dd05f1176
SSDEEP 98304:mgJxIxMfY9b4hY8ffnpBZa8wSypsmCqC5+uMU+57:mgQx2Y9bJGfZMfsmCrVg
TLSH
T16726A0207607C037DA9351B25A2CAB9F863CAA201FB614D793E43E7D0D615C36B36E97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1711104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\67d9289f94964a81\BUILDS\Release\x86\CCUpdate.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW ImpersonateLoggedOnUser RegOpenCurrentUser RevertToSelf CryptReleaseContext InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken GetTokenInformation EqualSid RegDeleteValueW RegEnumValueW OpenThreadToken ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx ControlService StartServiceW CloseServiceHandle CryptGenRandom CryptAcquireContextW RegQueryMultipleValuesW RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW

ole32

CoInitializeEx CoCreateGuid CoCreateInstance CoUninitialize CoInitializeSecurity CoTaskMemFree

oleaut32

VariantClear SysStringLen SysFreeString SysAllocString VariantInit VariantCopy

user32

RegisterClassExW GetClassInfoExW SetWindowLongW SendMessageW PostMessageW RegisterWindowMessageW LoadStringW

rpcrt4

RpcIfInqId RpcStringBindingComposeW NdrAsyncServerCall NdrServerCall2 NdrClientCall2 NdrAsyncClientCall RpcAsyncCancelCall RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcBindingToStringBindingW RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcMgmtEpEltInqDone RpcStringBindingParseW RpcStringFreeW UuidToStringW UuidCreate UuidIsNil UuidFromStringW RpcRevertToSelf RpcBindingFree I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

shell32

SHGetFolderPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

inet_ntoa

ntdll

RtlNtStatusToDosError VerSetConditionMask NtClose NtSetInformationThread NtSetInformationFile NtOpenKey RtlCaptureContext NtQueryKey NtDeleteKey RtlUnwind

kernel32

LCMapStringEx EncodePointer WakeConditionVariable GetLocaleInfoEx HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetLastError CreateMutexW SizeofResource LockResource LoadResource FindResourceExW FindResourceW CloseHandle SetErrorMode Sleep CreateFileW LoadLibraryW GetProcAddress FreeLibrary DuplicateHandle GetCurrentProcess SetEvent CreateEventW GetTempPathW CreateDirectoryW WaitForSingleObject MoveFileExW DeleteFileW MultiByteToWideChar ReadFile WriteFile SetFilePointer WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetPrivateProfileStringW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCommandLineW GetDateFormatW GetTimeFormatW GetVersionExW GetNativeSystemInfo GlobalMemoryStatusEx GetSystemDirectoryW GetModuleFileNameW GetFileAttributesExW GetPrivateProfileSectionW GetCurrentDirectoryW GetFileAttributesW CopyFileW GetCurrentProcessId GetFileSizeEx OutputDebugStringW SetConsoleCtrlHandler FreeConsole ReleaseMutex AttachConsole AllocConsole GetTickCount FindFirstFileW SetFileAttributesW FindNextFileW RemoveDirectoryW FindClose ExpandEnvironmentStringsW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLongPathNameW LocalFree GetCurrentThread CreateProcessW GetExitCodeProcess OpenProcess TerminateProcess K32EnumProcesses K32GetModuleFileNameExW K32GetProcessImageFileNameW TerminateThread VerifyVersionInfoW GetLocalTime FileTimeToSystemTime WritePrivateProfileStringW InitializeCriticalSectionEx DecodePointer GetFullPathNameW MoveFileW GlobalFree CreateWaitableTimerW SetWaitableTimer VirtualFree IsProcessorFeaturePresent GetVersion ResetEvent ReleaseSemaphore CreateSemaphoreW ResumeThread SetThreadAffinityMask GetModuleFileNameA GetModuleHandleExW GetCurrentThreadId GetFileTime CompareFileTime SetFilePointerEx UnlockFileEx LockFileEx QueryUnbiasedInterruptTime SetLastError CancelIoEx GetOverlappedResult ReadDirectoryChangesW UnregisterWaitEx ProcessIdToSessionId WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetThreadPriority RaiseException GetThreadTimes SetThreadPriority QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter QueryThreadCycleTime CompareStringW GetThreadId GetSystemInfo LoadLibraryExW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread TlsAlloc TlsFree TlsSetValue TlsGetValue SetEndOfFile GetWindowsDirectoryW GetFileInformationByHandle FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW FlushFileBuffers OutputDebugStringA SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW VirtualQuery FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks GetSystemTimes GetTickCount64 WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CompareStringEx GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetStartupInfoW InterlockedPushEntrySList GetCommandLineA GetConsoleCP GetFileType GetConsoleMode ReadConsoleW GetConsoleOutputCP CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleMode ReadConsoleInputW SetStdHandle GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW VirtualAlloc RegisterWaitForSingleObject

wininet

HttpEndRequestW InternetCrackUrlW HttpQueryInfoW InternetReadFile InternetWriteFile HttpSendRequestExW InternetConnectW InternetCanonicalizeUrlW InternetSetOptionW InternetOpenW HttpAddRequestHeadersW HttpSendRequestW HttpOpenRequestW FtpOpenFileW GopherOpenFileW InternetCloseHandle

winhttp

WinHttpOpenRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpOpen

cabinet

ord22 ord23 ord20

dnsapi

DnsFree DnsQuery_W

powrprof

CallNtPowerInformation

generic

count=205, id=261, version=29395,

count=5, id=253, version=33030,

count=23, id=260, version=33030,

count=107, id=261, version=33030,

count=29, id=259, version=33030,

count=20, id=259, version=29395,

count=27, id=260, version=29395,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, version=30146,

count=6, productName=Unmarked objects (old),

count=1, id=263, version=29395,

count=1, id=262, version=29395,

count=4, id=261, version=30154,

count=28, id=257, version=29395,

count=9, id=257, version=30795,

count=496, id=1, productName=Unmarked objects,

count=10, id=260, version=30154,

count=242, id=265, version=33130,

count=1, id=256, version=33130,

count=1, id=255, version=33130,

count=2, id=151,

count=1, id=258, version=33130,