2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop

General

Target
2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop
Size 2.7MB
Sample260416-rd3vfacx21
SHA256 81c9e16155cc93dae52a4ef91a3225728f15758d7864293b26903d506942fe1b
MD5 03519003f5ccbeb15425d4f2d05f098e
SHA1 79cb0dd19f08d73f8caccf4f3ea8a51fa433963e
SHA512 859476594a32bc61fa780597d34c78eac687574a33393cfbbdc83e4e71503c1d8270c5580904e212972772c82a2acf3f43a23a8568b29459e4fac430db85fd35
SSDEEP 49152:8H676x4LMcY/+lj2M84p0DkYOMwwnMb4PmyVM35DMnCIjtAy:8H676xe1f5YOXwnS4rVz55
TLSH
T138D54C11766185B9CD6646318564EA7D1126BE109723AECB72CD3ECEFBF0BC11A37232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop

.exe 2.7MB

2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop

IMPHASH 29f658e321d3823f0a9ce796dfebf315
SHA256 81c9e16155cc93dae52a4ef91a3225728f15758d7864293b26903d506942fe1b
MD5 03519003f5ccbeb15425d4f2d05f098e
SHA1 79cb0dd19f08d73f8caccf4f3ea8a51fa433963e
SHA512 859476594a32bc61fa780597d34c78eac687574a33393cfbbdc83e4e71503c1d8270c5580904e212972772c82a2acf3f43a23a8568b29459e4fac430db85fd35
SSDEEP 49152:8H676x4LMcY/+lj2M84p0DkYOMwwnMb4PmyVM35DMnCIjtAy:8H676xe1f5YOXwnS4rVz55
TLSH
T138D54C11766185B9CD6646318564EA7D1126BE109723AECB72CD3ECEFBF0BC11A37232
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

57284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime GetNativeSystemInfo GetVersionExW GetModuleFileNameW InitializeCriticalSectionAndSpinCount SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW TerminateProcess GetFileType SignalObjectAndWait CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetLastError GetModuleHandleExW GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent HeapFree HeapAlloc LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW HeapReAlloc

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_03519003f5ccbeb15425d4f2d05f098e_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader_stop

kernel32

winmm

advapi32

generic