2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader

General

Target
2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader
Size 515KB
Sample260227-1ect3sgy4e
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader

File Explorer

2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader

.exe 515KB

2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader

IMPHASH 03bd72dc12ec7bdaea1dd4571e9c9341
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

160540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenMutexW GetLastError OpenEventW Wow64DisableWow64FsRedirection ExitProcess lstrcpyA lstrcpyW GetModuleHandleW LocalFree lstrcmpiW CreateThread GetProcessHeap IsWow64Process GetCurrentProcess GetProcAddress FreeLibrary LoadLibraryW lstrlenW InterlockedDecrement GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW LocalAlloc CloseHandle DeleteFileW WriteFile CreateFileW CreateDirectoryW Sleep GetCommandLineW VirtualFree LoadLibraryA VirtualAlloc RemoveDirectoryW WaitForSingleObject ReadFile GetFileSize CreateEventW SetEvent ResumeThread CreateMutexW lstrlenA WaitForMultipleObjects ReleaseMutex GetModuleHandleA TerminateThread GetExitCodeThread GetNativeSystemInfo FindClose FindNextFileW lstrcmpW FindFirstFileW VirtualProtect GetTickCount GetTickCount64 GetComputerNameExW GetUserGeoID GetCurrentProcessId GetFileAttributesExW HeapReAlloc WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW HeapSize FlushFileBuffers MultiByteToWideChar LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount RtlUnwind RaiseException HeapAlloc HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCPInfo GetACP GetOEMCP IsValidCodePage GetStdHandle HeapCreate GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW

user32

wsprintfW GetAsyncKeyState wsprintfA SetWindowTextW MessageBoxW DefWindowProcW RegisterClassW GetMessageW TranslateMessage DispatchMessageW DestroyWindow UnregisterClassW PostMessageW CreateWindowExW GetForegroundWindow

ole32

CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader

kernel32

user32

ole32

oleaut32

generic