2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 3.8MB
Sample261107-sa1fksfb94
SHA256 4c60278e9df0040fd70b3e95d276786e8a613c52c36898abad76174db68b18b1
MD5 438ebf2f207243cf6257e77b1bb8d3c3
SHA1 eaeb116914ebc0df87a5f5462c123c27dc5b85ff
SHA512 320fe7fe80723d3a45112754d5f937ddd18a8c7eac02faaa047ebee0b7fc223e3eb7f54d88e9d1658f48ed1657ea4dece09f3dc1f389584772e7adbb60471b02
SSDEEP 98304:ozl/FDtwGKchJBKJsv6tWKFdu9C5Q4vslzqRBL6gnHw5YONRgk:o58GKfJsv6tWKFdu9CTvslzqR0sHlMyk
TLSH
T1FA06F233BAD48136E3F38330186F676905ABBD326965444FB38C770D5DB02606AA76DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 3.8MB

2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 7670e9905d90a3643d257700ebf97277
SHA256 4c60278e9df0040fd70b3e95d276786e8a613c52c36898abad76174db68b18b1
MD5 438ebf2f207243cf6257e77b1bb8d3c3
SHA1 eaeb116914ebc0df87a5f5462c123c27dc5b85ff
SHA512 320fe7fe80723d3a45112754d5f937ddd18a8c7eac02faaa047ebee0b7fc223e3eb7f54d88e9d1658f48ed1657ea4dece09f3dc1f389584772e7adbb60471b02
SSDEEP 98304:ozl/FDtwGKchJBKJsv6tWKFdu9C5Q4vslzqRBL6gnHw5YONRgk:o58GKfJsv6tWKFdu9CTvslzqR0sHlMyk
TLSH
T1FA06F233BAD48136E3F38330186F676905ABBD326965444FB38C770D5DB02606AA76DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

640678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\DUOWAN_BUILD\build\Build_Src\ycube\ycube_product_fb\bin\release\pdb\AQ.pdb

winhttp

WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts

ws2_32

WSAGetLastError setsockopt htons getsockopt recv connect ntohs socket getsockname getpeername WSASetLastError closesocket WSAIoctl bind freeaddrinfo getaddrinfo WSAStartup WSACleanup ioctlsocket select __WSAFDIsSet send

crypt32

CertFreeCertificateContext

kernel32

CreateFileA CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SleepEx MultiByteToWideChar WideCharToMultiByte GetProcAddress FreeLibrary WaitForSingleObject ExpandEnvironmentStringsA Sleep SetLastError FormatMessageA GetSystemDirectoryW LoadLibraryW VerSetConditionMask GetModuleHandleW VerifyVersionInfoW GetTickCount GetVersionExW FormatMessageW LocalFree OutputDebugStringW DeviceIoControl FindFirstFileW FindClose GetFullPathNameW GetFileInformationByHandle SetErrorMode GetLogicalDrives GetFileAttributesExW CreateDirectoryW RemoveDirectoryW GetFileAttributesW GetTempPathW GetLongPathNameW SetCurrentDirectoryW GetCurrentDirectoryW CopyFileW MoveFileW DeleteFileW FileTimeToSystemTime FindFirstFileExW FindNextFileW FlushFileBuffers SetFilePointerEx GetFileType MoveFileExW SetEndOfFile CreateFileMappingW GetSystemInfo MapViewOfFile UnmapViewOfFile GetLocalTime GetSystemTime GetLocaleInfoW GetUserDefaultLCID CompareStringW SizeofResource GetCommandLineW GetCurrentProcess TerminateProcess WaitForMultipleObjects CreateMutexW GetLocaleInfoA FreeResource CreateToolhelp32Snapshot CreateEventW Process32NextW SetEvent GetDiskFreeSpaceExW LockResource Process32FirstW LoadResource FindResourceW GetCurrentProcessId WinExec GetFileInformationByHandleEx SignalObjectAndWait lstrlenA InterlockedExchange GetLastError LoadLibraryA InterlockedExchangeAdd InterlockedDecrement IsBadReadPtr ExitProcess GlobalFree GetModuleFileNameW OpenProcess Module32FirstW CreateProcessW GetTempFileNameW GetExitCodeProcess SetEnvironmentVariableW InitializeCriticalSectionAndSpinCount GetEnvironmentVariableW InterlockedCompareExchange64 RaiseException SwitchToThread DecodePointer InterlockedIncrement SetDllDirectoryW LoadLibraryExW FlushInstructionCache IsDebuggerPresent EncodePointer HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree TlsGetValue TlsAlloc GetExitCodeThread GetCurrentThread DuplicateHandle TryEnterCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx ResetEvent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle SetFileAttributesW GetConsoleMode ReadConsoleW GetConsoleCP GetTimeZoneInformation GetACP GetCommandLineA GetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesW SetEnvironmentVariableA WriteConsoleW IsValidCodePage GetOEMCP HeapSize SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber CreateFileW WriteFile ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW InterlockedCompareExchange CreateTimerQueue GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetModuleHandleA VirtualProtect ReleaseSemaphore QueryDepthSList UnregisterWaitEx TlsSetValue TlsFree LCMapStringW GetStringTypeW GetCPInfo GetCurrentThreadId InterlockedFlushSList

user32

RegisterClassExW GetMonitorInfoW MoveWindow LoadIconW MonitorFromWindow MonitorFromRect ShowWindow SetWindowPos LoadCursorW GetClientRect IsZoomed IsIconic GetWindowTextLengthW DestroyWindow CreateWindowExW SetWindowTextW SetWindowLongW SystemParametersInfoW GetParent InvalidateRect GetWindowTextW GetDC MapWindowPoints UpdateLayeredWindow ReleaseDC SendMessageW GetActiveWindow GetClassNameW SetParent GetDlgItem EnableWindow wsprintfW MsgWaitForMultipleObjects GetMessageW PostMessageW FindWindowExW MessageBoxW DispatchMessageW TranslateMessage PostQuitMessage GetWindowRect CallWindowProcW DefWindowProcW GetWindowLongW

gdi32

CreateSolidBrush CreateFontIndirectW SelectObject SetBkColor SetTextColor CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject GetStockObject

advapi32

RegDeleteValueW RegDeleteKeyW RegCloseKey RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegCreateKeyExW RegOpenKeyExW CryptGenRandom CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegSetValueExW RegFlushKey GetNamedSecurityInfoW SetNamedSecurityInfoW CreateWellKnownSid SetEntriesInAclW RegQueryValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHChangeNotify SHGetSpecialFolderLocation SHGetPathFromIDListW CommandLineToArgvW ord165

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoCreateGuid CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantClear

gdiplus

GdipCreateFromHDC GdiplusStartup GdiplusShutdown GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetClipRect GdipDeleteBrush GdipAlloc GdipCreateBitmapFromScan0 GdipDeleteFont GdipDeleteGraphics GdipGetImageGraphicsContext GdipMeasureString GdipDrawString GdipGetGenericFontFamilySansSerif GdipCreateSolidFill GdipCreateFont GdipDisposeImage

Name

.text

Size

915KB

Virtual Size

914KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

669KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

795KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_438ebf2f207243cf6257e77b1bb8d3c3_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

winhttp

ws2_32

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic