Static task
static1
Behavioral task
behavioral1
Sample
2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250619-en
General
-
Target
2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader
-
Size
754KB
-
MD5
e7a1294ae66a9b255f984b45c5a1a3e6
-
SHA1
4fa6fff2aa486b9ad08829b914926635bc7c5e2b
-
SHA256
b9bb7ad541c02f06c2549a3fe83e484d8e8ea551801e3e01f2c80996477aa043
-
SHA512
38a850cc7f19283ee0eeae9bb2a37c335dc06c742ecd07e2deba974aac83a7a73de845fc10aa65653c327676572c93c7150e6b54c745235b45bf133743cb62ab
-
SSDEEP
12288:amhjKOXdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxiOqOF:thLalj3DSudvGM3MXTVhtSQWGtxt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader
Files
-
2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe windows:5 windows x86 arch:x86
34791a1ad0a42b816d48d1d1c182fe7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
shell32
CommandLineToArgvW
ShellExecuteExW
shlwapi
StrCmpIW
PathFileExistsW
PathAppendW
user32
wsprintfW
kernel32
HeapReAlloc
LoadLibraryW
SetEnvironmentVariableW
CompareStringW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
VirtualAlloc
MultiByteToWideChar
VirtualFree
LocalAlloc
GetLastError
GetCurrentProcess
ReadFile
CloseHandle
GetFileSizeEx
CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetSystemDirectoryW
SetFileTime
FileTimeToSystemTime
GetFileTime
GetModuleFileNameW
MoveFileW
DeleteFileW
CreateProcessW
GetStartupInfoW
GetCommandLineW
SetErrorMode
lstrlenA
WideCharToMultiByte
GetFileSize
WriteFile
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapAlloc
HeapSetInformation
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
ExitProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapSize
GetStdHandle
HeapCreate
SetHandleCount
GetFileType
LCMapStringW
GetStringTypeW
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ