2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 7.0MB
Sample261107-q7cpnsfb22
SHA256 95cd020aac846b2bac5f9b91479ec3c0ad68ffce538f4bc0abd233acff161c30
MD5 5a2bd99edefd7e0f3681f8dd0a603afa
SHA1 719f15cc578c71cd2eea4d0b89c1daa373d94e79
SHA512 b68f21782e7507a021f753195360ba4c493f01580a7ece78bda4250c3c354d42890e24459bcf0608608da56dc9d2ac53299eb08e5bfdbd5b90b10dd80ec84b3f
SSDEEP 196608:FEh8PXaRFAQceoyAoOMUf8DWayTCgdbM25Sh:C2PqR+QIy8MUfJ1rI
TLSH
T16676492176974066E1BF03706E79F78685A9BDF30FF2C05B2384123E1BB19D19AA5723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 7.0MB

2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 9c35cbf4812b8325a9b814b776ef6ffe
SHA256 95cd020aac846b2bac5f9b91479ec3c0ad68ffce538f4bc0abd233acff161c30
MD5 5a2bd99edefd7e0f3681f8dd0a603afa
SHA1 719f15cc578c71cd2eea4d0b89c1daa373d94e79
SHA512 b68f21782e7507a021f753195360ba4c493f01580a7ece78bda4250c3c354d42890e24459bcf0608608da56dc9d2ac53299eb08e5bfdbd5b90b10dd80ec84b3f
SSDEEP 196608:FEh8PXaRFAQceoyAoOMUf8DWayTCgdbM25Sh:C2PqR+QIy8MUfJ1rI
TLSH
T16676492176974066E1BF03706E79F78685A9BDF30FF2C05B2384123E1BB19D19AA5723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

3865447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\el\omr\Target\x86\ship\click2run\en-us.pre\SetupBootstrapper.pdb

oleaut32

GetErrorInfo SysStringLen SysAllocString VariantClear VariantInit SysFreeString SetErrorInfo

kernel32

GlobalAlloc GetEnvironmentStringsW GetCommandLineA SetStdHandle LCMapStringW CompareStringW VirtualProtect EnumSystemLocalesW GetOEMCP ExitProcess GetConsoleOutputCP ReadConsoleW FreeLibraryAndExitThread CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy WriteFile DeleteFileW CreateEventExW IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName LocaleNameToLCID AttachConsole AllocConsole GetStdHandle FreeConsole GetSystemTimeAsFileTime GetTickCount64 K32GetProcessMemoryInfo GlobalMemoryStatusEx OpenProcess RaiseException IsValidCodePage WideCharToMultiByte GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetStringTypeExW GetCPInfoExW GetSystemDirectoryW GetTempPathW CreateDirectoryW GetFileAttributesExW SetFileAttributesW GetExitCodeProcess GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource ReleaseSemaphore WaitForSingleObjectEx SetEvent CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent EnterCriticalSection LeaveCriticalSection GetVersionExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW FormatMessageA GetLogicalProcessorInformation HeapAlloc OpenEventW ReleaseMutex CreateMutexExW GetLongPathNameW GetFinalPathNameByHandleW TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime IsDebuggerPresent FindFirstFileExW MoveFileExW FindNextFileW FindClose RemoveDirectoryW ReadFile ReplaceFileW SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVolumeInformationW CreateFileMappingW MapViewOfFile UnmapViewOfFile WaitForMultipleObjects K32EnumProcessModulesEx RtlCaptureStackBackTrace GetFileType SetFilePointer CreateFileA GetOverlappedResult GetFileAttributesW GetFileTime QueryPerformanceCounter QueryPerformanceFrequency ExitThread SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetTickCount InitOnceExecuteOnce GetSystemPowerStatus GetTimeZoneInformation Sleep AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile LoadLibraryA DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile GetFileSize GetCurrentThread OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic GetThreadLocale FindFirstFileW lstrcmpW CopyFileW VirtualQuery ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW PeekNamedPipe GetConsoleMode SetConsoleMode CreatePipe SetHandleInformation GetPriorityClass K32EnumProcesses IsValidLocale GetSystemDefaultLocaleName GetUserGeoID GetLocaleInfoEx LCIDToLocaleName LCMapStringEx GetUserDefaultLCID GetSystemDefaultLCID EnumSystemLocalesEx LoadLibraryExA LockResource GetLocaleInfoW GetUserPreferredUILanguages GetACP GetPhysicallyInstalledSystemMemory GetProductInfo UnhandledExceptionFilter DeleteTimerQueueTimer CreateTimerQueueTimer GetLocalTime WriteConsoleW RtlUnwind SetUnhandledExceptionFilter GetFileInformationByHandle GetDriveTypeW GetTimeFormatW GetDateFormatW GetSystemPreferredUILanguages K32GetProcessImageFileNameW GetStringTypeW CreateFile2 CopyFile2 CreateSymbolicLinkW TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete SwitchToThread EncodePointer GetCPInfo IsProcessorFeaturePresent FreeEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

340KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_5a2bd99edefd7e0f3681f8dd0a603afa_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

oleaut32

kernel32

api-ms-win-core-synch-l1-2-0

generic