2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop

General

Target
2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop
Size 2.2MB
Sample260411-rtbe5ady7x
SHA256 76a59418c02a759bb723140cb795d41e7813ad027436ce76f0672bc589a59422
MD5 01cbc29147f1eefa2efd4b83ded106b8
SHA1 2e9a87e781551dba9be359c9c910fe156c7902dc
SHA512 450ff636d3952dcbdc3fe14fbc7d12cffa0470bed309fbd89e4b8674da08ef715821487260c07206bcb0ca9918b6bcd1c47babf593d0658de70e26746780e4a9
SSDEEP 49152:+WnPrMI0KFsI8VdYRQEx4eUyZ0NXiVv4znvVv4znglniK:+QV0pfNlnP
TLSH
T1E5B57B4377EC4618C4AF87B28472210C57B0F9062BB2EB5EA604967E2CE37115F56BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop

.exe 2.2MB

2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop

IMPHASH fee2e01e9ecb27c28da2b6fc37f265e9
SHA256 76a59418c02a759bb723140cb795d41e7813ad027436ce76f0672bc589a59422
MD5 01cbc29147f1eefa2efd4b83ded106b8
SHA1 2e9a87e781551dba9be359c9c910fe156c7902dc
SHA512 450ff636d3952dcbdc3fe14fbc7d12cffa0470bed309fbd89e4b8674da08ef715821487260c07206bcb0ca9918b6bcd1c47babf593d0658de70e26746780e4a9
SSDEEP 49152:+WnPrMI0KFsI8VdYRQEx4eUyZ0NXiVv4znvVv4znglniK:+QV0pfNlnP
TLSH
T1E5B57B4377EC4618C4AF87B28472210C57B0F9062BB2EB5EA604967E2CE37115F56BE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17495

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xohayajixapeh mon-muvicupifujuja\rohagi_cedepamavosan.pdb

kernel32

GlobalMemoryStatus GetLocaleInfoA LocalCompact InterlockedDecrement GetComputerNameW CreateHardLinkA GetSystemDefaultLCID BackupSeek GetTickCount GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsW GetUserDefaultLangID SetCommState GlobalAlloc LoadLibraryW ReadConsoleInputA WriteConsoleW GetModuleFileNameW MultiByteToWideChar GetLastError ChangeTimerQueueTimer SetLastError GetThreadLocale GetProcAddress RemoveDirectoryA SetFileAttributesA BuildCommDCBW LoadLibraryA SetCalendarInfoW GetExitCodeThread AddAtomW CreateEventW GlobalFindAtomW GetOEMCP LoadLibraryExA VirtualProtect GetConsoleProcessList GetTempPathA GetVolumeInformationW HeapAlloc EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent IsValidCodePage GetACP GetCPInfo GetCurrentThreadId HeapFree ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetProcessHeap EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetFileType GetStartupInfoW CloseHandle GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetStringTypeW LoadLibraryExW OutputDebugStringW LCMapStringW SetStdHandle SetFilePointerEx HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-11_01cbc29147f1eefa2efd4b83ded106b8_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop

kernel32

generic