2026-11-03_634b1864dabe4a1d5e24ace0829504d9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_634b1864dabe4a1d5e24ace0829504d9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 3.6MB
Sample261104-xe8d7sy14j
SHA256 d78dedb5e5f0fdde92a9f62c95f26ef194670743d7625e4a93ff2044568bb780
MD5 634b1864dabe4a1d5e24ace0829504d9
SHA1 e571d825c92ab63cedf09da839509c9e02cea68c
SHA512 4aa758ad5e6a8513e60a3aae5c39bb1536f06402085e6a37314ac66c69d44bd6846a195c1da6c13796ddc318a0afb5184256768502d1a4fe97a56498ec228fa1
SSDEEP 49152:qtdQy20FrhFuw11sfldqi82lxVjdJ6oCMBXElGNC/pKlBtOtMt3+TSzwC1k4p+u7:EaIhb1ufzbLJJ6SBXWGN1wy
TLSH
T146065D30BB078867E4A312B15D7CE76A8528EF320B7318C393F4BA6D2D555C21773A96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-03_634b1864dabe4a1d5e24ace0829504d9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 3.6MB

2026-11-03_634b1864dabe4a1d5e24ace0829504d9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH b43a72bfcc17b480b31e6ec64d4fa1d0
SHA256 d78dedb5e5f0fdde92a9f62c95f26ef194670743d7625e4a93ff2044568bb780
MD5 634b1864dabe4a1d5e24ace0829504d9
SHA1 e571d825c92ab63cedf09da839509c9e02cea68c
SHA512 4aa758ad5e6a8513e60a3aae5c39bb1536f06402085e6a37314ac66c69d44bd6846a195c1da6c13796ddc318a0afb5184256768502d1a4fe97a56498ec228fa1
SSDEEP 49152:qtdQy20FrhFuw11sfldqi82lxVjdJ6oCMBXElGNC/pKlBtOtMt3+TSzwC1k4p+u7:EaIhb1ufzbLJJ6SBXWGN1wy
TLSH
T146065D30BB078867E4A312B15D7CE76A8528EF320B7318C393F4BA6D2D555C21773A96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

06:21:41:d5:38:e6:09:c3:2d:91:f5:e0:ec:a7:48:64:03:3d:e7:25:1f:ce:08:6e:23:23:df:cb:11:f8:23:eb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Oct 6, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

658176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb

rpcrt4

RpcStringBindingComposeW UuidCreate UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcObjectSetType RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall NdrAsyncClientCall NdrAsyncServerCall RpcStringBindingParseW NdrClientCall2 NdrServerCall2 RpcServerUnregisterIf RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcStringFreeW RpcBindingFromStringBindingW RpcBindingFree

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSetProperty BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptOpenAlgorithmProvider

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

shell32

ord165 SHGetKnownFolderPath

ntdll

RtlNtStatusToDosError RtlGetLastNtStatus NtClose NtSetInformationThread NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext VerSetConditionMask NtSystemDebugControl RtlDllShutdownInProgress NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlUnwind

kernel32

GetModuleHandleExW GetModuleFileNameA DebugBreak GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx ResetEvent SetLastError OutputDebugStringW IsDebuggerPresent Sleep SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime TerminateThread ResumeThread GetTickCount SetThreadPriority GetCurrentProcess LocalFree RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime LocalAlloc InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessTimes ReadProcessMemory GetThreadId CreateProcessW TerminateProcess GetExitCodeProcess GetPriorityClass ProcessIdToSessionId K32GetProcessMemoryInfo InitializeCriticalSectionEx LoadLibraryW CompareFileTime QueryFullProcessImageNameW FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime TlsAlloc TlsGetValue TlsSetValue FreeLibrary LoadLibraryExW GetCurrentThreadId ExpandEnvironmentStringsW GetFileAttributesW GetSystemDirectoryW SetErrorMode VirtualProtect HeapReAlloc GlobalMemoryStatusEx GetEnvironmentVariableW GetThreadPriority GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose CreateDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetDiskFreeSpaceExW CopyFileW SetFileInformationByHandle K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FormatMessageA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FormatMessageW GetTickCount64 CompareStringW GetCurrentThread HeapFree GetProcessHeap HeapAlloc GetModuleFileNameW VerifyVersionInfoW SetConsoleCtrlHandler SetDllDirectoryW GetProcAddress GetModuleHandleW WaitForSingleObject GetProcessId GetNamedPipeServerProcessId GetFileTime CreateFileW MultiByteToWideChar ContinueDebugEvent DebugActiveProcessStop GetFileAttributesExW GetSystemTimeAsFileTime OpenThread DebugBreakProcess SetEvent WaitForDebugEvent DebugSetProcessKillOnExit DebugActiveProcess WideCharToMultiByte VirtualQueryEx GetThreadContext K32GetProcessImageFileNameW K32GetModuleBaseNameW K32EnumProcessModules OpenProcess WaitForMultipleObjects GetLastError CreateEventW CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetStdHandle HeapSize HeapQueryInformation WriteConsoleW UnregisterWaitEx ReadDirectoryChangesW WaitForThreadpoolWaitCallbacks AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetLocaleInfoEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent RegisterWaitForSingleObject WakeConditionVariable InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer FlsFree SwitchToThread WaitForSingleObjectEx GetNativeSystemInfo GetProcessHandleCount K32EnumProcesses RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter LCMapStringEx GetSystemInfo FlushInstructionCache CheckRemoteDebuggerPresent FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess GetCommandLineW GetCommandLineA GetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait LoadLibraryExA K32GetPerformanceInfo SetEnvironmentVariableW CreateThread

user32

RegisterWindowMessageW LoadStringW PeekMessageW SetWindowLongW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo SendMessageW PostMessageW GetSystemMetrics RegisterClassExW GetClassInfoExW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfig2W ChangeServiceConfig2W StartServiceCtrlDispatcherW OpenSCManagerW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegDeleteKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW FreeSid RegOpenKeyExW CheckTokenMembership DuplicateToken AllocateAndInitializeSid ConvertSecurityDescriptorToStringSecurityDescriptorW GetFileSecurityW ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf EqualSid OpenProcessToken GetTokenInformation EventUnregister EventRegister EventWriteTransfer RegCloseKey StartServiceW QueryServiceStatus OpenThreadToken CloseServiceHandle ControlService ChangeServiceConfigW CreateServiceW DeleteService OpenServiceW SetThreadToken

ole32

CoTaskMemFree CoCreateGuid

powrprof

CallNtPowerInformation

fltlib

FilterSendMessage FilterGetMessage FilterReplyMessage FilterLoad FilterConnectCommunicationPort

shlwapi

PathAppendW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

693KB

Virtual Size

693KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

407KB

Virtual Size

438KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_634b1864dabe4a1d5e24ace0829504d9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

rpcrt4

bcrypt

wtsapi32

shell32

ntdll

kernel32

user32

advapi32

ole32

powrprof

fltlib

shlwapi

version

generic