2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop

General

Target
2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop
Size 1.6MB
Sample261110-2ba2rabg87
SHA256 56f115cf743a0558081849949982607a19a847286b810191410b8dd2a9f92cc8
MD5 3a689d98a209edfff388249a81445a20
SHA1 663505aa8a91c4a107c9679cb09350423ee2d9b4
SHA512 74f0afadb97d563338526becb029c2314dfb769aee13f25558319cef6abf7d09f7a36428bb3f9cb7caea9ff20aa73278ef60e6e9ee283d5e540c8ac5171c36e8
SSDEEP 24576:WHQy5Sk2OXVav9Mk7A56Eoym1uBv3lx/B5ewYsKUnNzO0LdXewKNnp3:q92fv9Mq1Uv3nBQCKMN7pXRKNnp3
TLSH
T163858C1277E18836F2B316314DB9B3692ABEBD621E31C21F73941A4D4E71691AE34733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop

File Explorer

2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop

.exe 1.6MB

2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop

IMPHASH c8aa01ee81dfa614588a44bb990de12a
SHA256 56f115cf743a0558081849949982607a19a847286b810191410b8dd2a9f92cc8
MD5 3a689d98a209edfff388249a81445a20
SHA1 663505aa8a91c4a107c9679cb09350423ee2d9b4
SHA512 74f0afadb97d563338526becb029c2314dfb769aee13f25558319cef6abf7d09f7a36428bb3f9cb7caea9ff20aa73278ef60e6e9ee283d5e540c8ac5171c36e8
SSDEEP 24576:WHQy5Sk2OXVav9Mk7A56Eoym1uBv3lx/B5ewYsKUnNzO0LdXewKNnp3:q92fv9Mq1Uv3nBQCKMN7pXRKNnp3
TLSH
T163858C1277E18836F2B316314DB9B3692ABEBD621E31C21F73941A4D4E71691AE34733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

71548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x86\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent CloseHandle WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject ReleaseMutex CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW DecodePointer FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwind RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

rpcrt4

RpcServerRegisterIfEx RpcImpersonateClient RpcRevertToSelf NdrServerCall2 RpcServerUnregisterIf RpcServerUseProtseqEpW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_3a689d98a209edfff388249a81445a20_amadey_darkgate_elex_emotet_luca-stealer_njrat_remcos_smoke-loader_stop

advapi32

kernel32

rpcrt4

wintrust

generic