General
- Target 2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop
- Size 2.2MB
- Sample260411-rtbe5ady7x
- SHA256 76a59418c02a759bb723140cb795d41e7813ad027436ce76f0672bc589a59422
- MD5 01cbc29147f1eefa2efd4b83ded106b8
- SHA1 2e9a87e781551dba9be359c9c910fe156c7902dc
- SHA512 450ff636d3952dcbdc3fe14fbc7d12cffa0470bed309fbd89e4b8674da08ef715821487260c07206bcb0ca9918b6bcd1c47babf593d0658de70e26746780e4a9
- SSDEEP 49152:+WnPrMI0KFsI8VdYRQEx4eUyZ0NXiVv4znvVv4znglniK:+QV0pfNlnP
- TLSH T1E5B57B4377EC4618C4AF87B28472210C57B0F9062BB2EB5EA604967E2CE37115F56BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://nidoe.org/tmp/index.php
-
http://sodez.ru/tmp/index.php
-
http://uama.com.ua/tmp/index.php
-
http://talesofpirates.net/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop
- Size 2.2MB
- SHA256 76a59418c02a759bb723140cb795d41e7813ad027436ce76f0672bc589a59422
- MD5 01cbc29147f1eefa2efd4b83ded106b8
- SHA1 2e9a87e781551dba9be359c9c910fe156c7902dc
- SHA512 450ff636d3952dcbdc3fe14fbc7d12cffa0470bed309fbd89e4b8674da08ef715821487260c07206bcb0ca9918b6bcd1c47babf593d0658de70e26746780e4a9
- SSDEEP 49152:+WnPrMI0KFsI8VdYRQEx4eUyZ0NXiVv4znvVv4znglniK:+QV0pfNlnP
- TLSH T1E5B57B4377EC4618C4AF87B28472210C57B0F9062BB2EB5EA604967E2CE37115F56BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself
-
Executes dropped EXE