2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar

General

Target
2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar
Size 4.2MB
Sample260415-3k7bzset8x
SHA256 45c6651bd1aa8aefba257d28e37907ba2fa3699cd1a973d5dd34d60974a14590
MD5 64d58489fb83f17e890ef4359968800a
SHA1 bc3d86e500849784972aecc2d790a2cf88fff24d
SHA512 fe26c56c8489047778481e1995ba35aa201359a2f1ecbbd67c224716b5db1f1e6a36a04037f90ce036ed8b2d84e208ca077cb0141aaad6ad42904a3be3ce0419
SSDEEP 24576:MTm0qmTFw2cuzKPgssStPUvg/c+lPYnCcuzKPgssStPUvgb:MzqCBhKPgssSt2g/jhKPgssSt2g
TLSH
T10326960166E84025ECBE2E7099749174F9667C5FBD3FB90E2E80369E5AF7AC05921333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar

File Explorer

2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar

.exe 4.2MB

2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar

IMPHASH f0ad2a12b266c8e49036efcc620b4c91
SHA256 45c6651bd1aa8aefba257d28e37907ba2fa3699cd1a973d5dd34d60974a14590
MD5 64d58489fb83f17e890ef4359968800a
SHA1 bc3d86e500849784972aecc2d790a2cf88fff24d
SHA512 fe26c56c8489047778481e1995ba35aa201359a2f1ecbbd67c224716b5db1f1e6a36a04037f90ce036ed8b2d84e208ca077cb0141aaad6ad42904a3be3ce0419
SSDEEP 24576:MTm0qmTFw2cuzKPgssStPUvg/c+lPYnCcuzKPgssStPUvgb:MzqCBhKPgssSt2g/jhKPgssSt2g
TLSH
T10326960166E84025ECBE2E7099749174F9667C5FBD3FB90E2E80369E5AF7AC05921333
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

6272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_APPCONTAINER IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\nov\target\x64\ship\osfmui_installer\x-none\sdxhelperbgt.pdb

api-ms-win-core-errorhandling-l1-1-0

RaiseException

vccorlib140_app

?InitializeData@Details@Platform@@YAJH@Z ?UninitializeData@Details@Platform@@YAXH@Z

vcruntime140_app

__CxxFrameHandler3 __std_terminate __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv _seh_filter_exe _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_64d58489fb83f17e890ef4359968800a_amadey_darkgate_smoke-loader_stop_vidar

api-ms-win-core-errorhandling-l1-1-0

vccorlib140_app

vcruntime140_app

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic