2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader
Size 2.3MB
Sample260415-typ57ady4k
SHA256 b3c49a15a3a144a190abe7acdaa8b2d799e7cccc9c05ccbb7bddf1c76c70f430
MD5 5600e841e836fda6350eb898588c3b76
SHA1 3d251fdab2fd48e6212ffc105539725cdbfc2673
SHA512 1524e903abe71750ac8aeee3e9ab1ffc746500b4862db7b6c706e4bc16189809093a8cd7f556a7cc53998a5e076e2f7c03145f09cc98d15f955f957ab0a274e0
SSDEEP 49152:qEA0vbFljiZqhaK6zbfqdlqqnstLet3Lyo:LAO6xDqnstLE7
TLSH
T165B51710A7F54135E0BAF5346AB4930E947ABE208F71C68FF240D15D2A3AAE1B935737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader

File Explorer

2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader

.exe 2.3MB

2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader

IMPHASH 79e1bf126f286a03f0b7587666321da8
SHA256 b3c49a15a3a144a190abe7acdaa8b2d799e7cccc9c05ccbb7bddf1c76c70f430
MD5 5600e841e836fda6350eb898588c3b76
SHA1 3d251fdab2fd48e6212ffc105539725cdbfc2673
SHA512 1524e903abe71750ac8aeee3e9ab1ffc746500b4862db7b6c706e4bc16189809093a8cd7f556a7cc53998a5e076e2f7c03145f09cc98d15f955f957ab0a274e0
SSDEEP 49152:qEA0vbFljiZqhaK6zbfqdlqqnstLet3Lyo:LAO6xDqnstLE7
TLSH
T165B51710A7F54135E0BAF5346AB4930E947ABE208F71C68FF240D15D2A3AAE1B935737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

TextExtractor.pdb

query

LoadIFilter

kernel32

InterlockedIncrement GetCurrentProcess GetProcAddress GetModuleHandleA GetLongPathNameW LocalFree GetCommandLineW SetErrorMode UnmapViewOfFile InterlockedDecrement SetEvent OpenProcess GetVersionExA MapViewOfFile OpenFileMappingW OpenEventW ResetEvent WaitForMultipleObjects GetTickCount GetStartupInfoW CloseHandle TerminateProcess HeapSetInformation InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime DecodePointer EncodePointer WideCharToMultiByte lstrlenA MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitialize

oleaut32

SysStringLen SysFreeString SysAllocString VariantClear

shlwapi

PathFileExistsW PathIsRelativeW PathFindExtensionW PathAddBackslashW PathIsDirectoryW

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_BADOFF@std@@3_JB ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7ios_base@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

?what@exception@std@@UBEPBDXZ ??0exception@std@@QAE@ABQBD@Z ??3@YAXPAX@Z memcpy memmove ??2@YAPAXI@Z ??_V@YAXPAX@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z __CxxFrameHandler3 strlen _mbschr _mbslwr _splitpath_s _fullpath memset _wcslwr wcslen _wfullpath _wcsicmp _wcsnicmp wcscpy_s swscanf_s free malloc _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _except_handler4_common ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _invoke_watson _controlfp_s ??1exception@std@@UAE@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_5600e841e836fda6350eb898588c3b76_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader

query

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp100

msvcr100

generic