2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader

General

Target
2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader
Size 515KB
Sample260309-graqpsdt4x
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader

File Explorer

2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader

.exe 515KB

2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader

IMPHASH 03bd72dc12ec7bdaea1dd4571e9c9341
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

160540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenMutexW GetLastError OpenEventW Wow64DisableWow64FsRedirection ExitProcess lstrcpyA lstrcpyW GetModuleHandleW LocalFree lstrcmpiW CreateThread GetProcessHeap IsWow64Process GetCurrentProcess GetProcAddress FreeLibrary LoadLibraryW lstrlenW InterlockedDecrement GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW LocalAlloc CloseHandle DeleteFileW WriteFile CreateFileW CreateDirectoryW Sleep GetCommandLineW VirtualFree LoadLibraryA VirtualAlloc RemoveDirectoryW WaitForSingleObject ReadFile GetFileSize CreateEventW SetEvent ResumeThread CreateMutexW lstrlenA WaitForMultipleObjects ReleaseMutex GetModuleHandleA TerminateThread GetExitCodeThread GetNativeSystemInfo FindClose FindNextFileW lstrcmpW FindFirstFileW VirtualProtect GetTickCount GetTickCount64 GetComputerNameExW GetUserGeoID GetCurrentProcessId GetFileAttributesExW HeapReAlloc WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW HeapSize FlushFileBuffers MultiByteToWideChar LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount RtlUnwind RaiseException HeapAlloc HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCPInfo GetACP GetOEMCP IsValidCodePage GetStdHandle HeapCreate GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW

user32

wsprintfW GetAsyncKeyState wsprintfA SetWindowTextW MessageBoxW DefWindowProcW RegisterClassW GetMessageW TranslateMessage DispatchMessageW DestroyWindow UnregisterClassW PostMessageW CreateWindowExW GetForegroundWindow

ole32

CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader

kernel32

user32

ole32

oleaut32

generic