2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader

General

Target
2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader
Size 511KB
Sample260319-dvp31sf14x
SHA256 ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446
MD5 8700ee98a03364747c1e63c54e2ffc17
SHA1 61343ffa09b49703d662ac99428541e89104978b
SHA512 a072e560f4eaa67df67074acb3e8828405a093ac37ca41cc238cb8381fd1f614597eb15331ff719f67e08ecc21bd1055c12e8212011f5efe79a43b3a700e30dd
SSDEEP 12288:jgRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Wu:jiGmrVmxuPnCXztW
TLSH
T163B4AE11E660D233D47650B4CBF9C327A928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader

File Explorer

2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader

.exe 511KB

2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader

IMPHASH 03bd72dc12ec7bdaea1dd4571e9c9341
SHA256 ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446
MD5 8700ee98a03364747c1e63c54e2ffc17
SHA1 61343ffa09b49703d662ac99428541e89104978b
SHA512 a072e560f4eaa67df67074acb3e8828405a093ac37ca41cc238cb8381fd1f614597eb15331ff719f67e08ecc21bd1055c12e8212011f5efe79a43b3a700e30dd
SSDEEP 12288:jgRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Wu:jiGmrVmxuPnCXztW
TLSH
T163B4AE11E660D233D47650B4CBF9C327A928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

160540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenMutexW GetLastError OpenEventW Wow64DisableWow64FsRedirection ExitProcess lstrcpyA lstrcpyW GetModuleHandleW LocalFree lstrcmpiW CreateThread GetProcessHeap IsWow64Process GetCurrentProcess GetProcAddress FreeLibrary LoadLibraryW lstrlenW InterlockedDecrement GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW LocalAlloc CloseHandle DeleteFileW WriteFile CreateFileW CreateDirectoryW Sleep GetCommandLineW VirtualFree LoadLibraryA VirtualAlloc RemoveDirectoryW WaitForSingleObject ReadFile GetFileSize CreateEventW SetEvent ResumeThread CreateMutexW lstrlenA WaitForMultipleObjects ReleaseMutex GetModuleHandleA TerminateThread GetExitCodeThread GetNativeSystemInfo FindClose FindNextFileW lstrcmpW FindFirstFileW VirtualProtect GetTickCount GetTickCount64 GetComputerNameExW GetUserGeoID GetCurrentProcessId GetFileAttributesExW HeapReAlloc WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW HeapSize FlushFileBuffers MultiByteToWideChar LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount RtlUnwind RaiseException HeapAlloc HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCPInfo GetACP GetOEMCP IsValidCodePage GetStdHandle HeapCreate GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW

user32

wsprintfW GetAsyncKeyState wsprintfA SetWindowTextW MessageBoxW DefWindowProcW RegisterClassW GetMessageW TranslateMessage DispatchMessageW DestroyWindow UnregisterClassW PostMessageW CreateWindowExW GetForegroundWindow

ole32

CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader

kernel32

user32

ole32

oleaut32

generic