2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop
Size 1.1MB
Sample260416-pyqphaaw2s
SHA256 dd7ee75bc578d431ab770b438d1f63b87ed8475d52c3a9ced5ab6db6fa8b8bfc
MD5 04d88b0693934416162062a8d1c98a3b
SHA1 e122d5e9140a1f43a0201b8e7f8b05b4f5555c88
SHA512 de41f88058375022267c6da5e1434e1af7c1a09f6a31559f3a223eebf35a1b43d8fa8b1fccb4a0f3fa42f6fc462f0b6d94d392eed278333921c853672c43403e
SSDEEP 24576:hPGoB+pF3LbQTqqh5iXndUtv2EtE3tZ/qBsPO/PNi7R/1DB:4DUtStxPO/lg/1DB
TLSH
T1C2358D92779481F6D92A00B1A4B7FF36247775A9937841C7B297A62FC8212C2743B12F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop

File Explorer

2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop

.exe 1.1MB

2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop

IMPHASH a5c13f20f9441d3e4ae258db92d45497
SHA256 dd7ee75bc578d431ab770b438d1f63b87ed8475d52c3a9ced5ab6db6fa8b8bfc
MD5 04d88b0693934416162062a8d1c98a3b
SHA1 e122d5e9140a1f43a0201b8e7f8b05b4f5555c88
SHA512 de41f88058375022267c6da5e1434e1af7c1a09f6a31559f3a223eebf35a1b43d8fa8b1fccb4a0f3fa42f6fc462f0b6d94d392eed278333921c853672c43403e
SSDEEP 24576:hPGoB+pF3LbQTqqh5iXndUtv2EtE3tZ/qBsPO/PNi7R/1DB:4DUtStxPO/lg/1DB
TLSH
T1C2358D92779481F6D92A00B1A4B7FF36247775A9937841C7B297A62FC8212C2743B12F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

363926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\svn\dtl_dep\PC\driverthelife\dtl6\ui\ui_tools\dtl_main_repair\build\base\Release\dtl_main_repair.pdb

kernel32

CreateThread GetTickCount ExitThread GetTempFileNameW lstrcpyW WinExec lstrlenW GetCurrentDirectoryW GetModuleHandleA DeleteFileW GlobalFree GetCurrentProcess GetModuleHandleW GetProcAddress SystemTimeToFileTime GetModuleFileNameW WriteFile CreateFileW CreateEventW WaitForMultipleObjects GlobalUnlock GlobalLock GlobalAlloc FreeLibrary LoadLibraryW CreateProcessW WaitForSingleObject GetPrivateProfileStringA FormatMessageA GetLastError GetCurrentProcessId GetCurrentThreadId GetLocalTime GetFileSize DeleteFileA GetModuleFileNameA InterlockedExchange LeaveCriticalSection SetFilePointer CreateFileA EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar GetProcessHeap SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA GetLocaleInfoA GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW VirtualAlloc VirtualFree HeapCreate FlushFileBuffers GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetStartupInfoA SetHandleCount InitializeCriticalSectionAndSpinCount LoadLibraryA GetStdHandle HeapSize SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue HeapReAlloc GetCPInfo LCMapStringW LCMapStringA RtlUnwind RaiseException SetEvent GetTempPathW TerminateProcess InterlockedIncrement InterlockedDecrement Sleep IsBadReadPtr ReadFile MulDiv GetACP FindResourceW LoadResource FreeResource SizeofResource LockResource DosDateTimeToFileTime GetFileType DuplicateHandle IsProcessorFeaturePresent ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc GetStartupInfoW CloseHandle

user32

SetTimer PostQuitMessage FindWindowW KillTimer InflateRect DrawIconEx DestroyIcon MoveWindow CreateAcceleratorTableW InvalidateRgn GetWindowDC GetDesktopWindow RedrawWindow GetWindowTextW GetWindowTextLengthW SetWindowTextW CharPrevW DrawTextW FillRect GetCaretPos GetSysColor ClientToScreen CharNextW SetWindowRgn BringWindowToTop SetForegroundWindow IsWindowVisible SendMessageW GetDC ReleaseDC GetKeyState DestroyWindow GetClientRect SetWindowPos GetWindowLongW SetWindowLongW PostMessageW GetWindow SetFocus GetUpdateRect BeginPaint EndPaint IsRectEmpty IsIconic UnionRect GetWindowRect UpdateLayeredWindow InvalidateRect MapWindowPoints CreateWindowExW ScreenToClient GetCursorPos GetMessageW TranslateMessage DispatchMessageW GetFocus IsWindow SetCapture ReleaseCapture PtInRect GetParent ShowCaret HideCaret SetCaretPos CreateCaret IntersectRect OffsetRect CopyRect SetRect IsZoomed SetCursor LoadCursorW DefWindowProcW ShowWindow EnableWindow GetMonitorInfoW MonitorFromWindow RegisterClassW GetClassInfoExW RegisterClassExW CallWindowProcW SetPropW GetPropW

advapi32

RegCloseKey RegQueryValueW RegOpenKeyExW

shell32

ord165 ShellExecuteW

ole32

CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal CoUninitialize CoCreateGuid CLSIDFromString CoCreateInstance

shlwapi

PathRemoveFileSpecW PathFileExistsW PathAppendW

winhttp

WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCloseHandle WinHttpReadData WinHttpOpen WinHttpSetOption WinHttpCrackUrl

gdiplus

GdipFillRectangleI GdipSetTextRenderingHint GdipCreateFontFromDC GdipDisposeImage GdipCreateFromHDC GdipCloneImage GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipDeleteFont GdipCloneStringFormat GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromStream GdiplusStartup GdipCreateFontFromLogfontA GdipCloneBrush GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipImageSelectActiveFrame GdipMeasureString GdipDrawString GdipCreateStringFormat GdipCreateLineBrushI GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectRect GdipSetInterpolationMode GdipCreateBitmapFromFile GdipReleaseDC GdipDrawImageRectI GdipImageGetFrameCount

msimg32

AlphaBlend

comctl32

_TrackMouseEvent ord17

gdi32

GetCharABCWidthsW GetObjectW CreateFontIndirectW EnumFontFamiliesW GetStockObject CreatePen DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection SelectObject SaveDC RestoreDC CreateCompatibleBitmap BitBlt Rectangle SetWindowOrgEx GetTextMetricsW CreateRoundRectRgn GetDeviceCaps SelectClipRgn GetClipBox CreateRectRgnIndirect ExtSelectClipRgn CombineRgn StretchBlt SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo RoundRect GetObjectA SetBkMode SetTextColor SetBkColor PatBlt GetTextExtentPoint32W TextOutW GetTextExtentPointW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_04d88b0693934416162062a8d1c98a3b_amadey_darkgate_elex_smoke-loader_stop

kernel32

user32

advapi32

shell32

ole32

shlwapi

winhttp

gdiplus

msimg32

comctl32

gdi32

oleaut32

imm32

generic