2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader
Size 1.9MB
Sample260416-rnce8sds21
SHA256 56dbb8bdb840448e46800f4a0f25319f9e2b7a4c53ae3fc47cef1826ecdf5b33
MD5 0a2738f9b1e6451d4f4fbbde261c3383
SHA1 bae76cc4b058a2a0c7ee643b47965fab29b7884e
SHA512 90050935eba4b413b065584d18957f71865d29fa643ef2e9f4afba14042301fc67c1466a34eb0aec585916329d5758582b1b14454331f279fbda66fe75cd3cc2
SSDEEP 49152:zqhnTceepeapeqbtL2tLMlj6sNBk9/fw2BwfmM0fV:zcJvgV2VxsNi9Xwgwfot
TLSH
T14C95CE22FA60A032C77385716A25F73AA5397D301F157AC3E3A86E5E2EB11C15B3570B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

File Explorer

2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

.exe 1.9MB

2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

IMPHASH 7efe725e99fc270551c3f68973b3bb3f
SHA256 56dbb8bdb840448e46800f4a0f25319f9e2b7a4c53ae3fc47cef1826ecdf5b33
MD5 0a2738f9b1e6451d4f4fbbde261c3383
SHA1 bae76cc4b058a2a0c7ee643b47965fab29b7884e
SHA512 90050935eba4b413b065584d18957f71865d29fa643ef2e9f4afba14042301fc67c1466a34eb0aec585916329d5758582b1b14454331f279fbda66fe75cd3cc2
SSDEEP 49152:zqhnTceepeapeqbtL2tLMlj6sNBk9/fw2BwfmM0fV:zcJvgV2VxsNi9Xwgwfot
TLSH
T14C95CE22FA60A032C77385716A25F73AA5397D301F157AC3E3A86E5E2EB11C15B3570B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

firefox.pdb

mozglue

??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0PrintfTarget@mozilla@@IAE@XZ ??1MutexImpl@detail@mozilla@@QAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z ??3@YAXPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAA_NXZ ?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPAUHINSTANCE__@@HPAPAD@Z ?DllBlocklist_Initialize@@YAXI@Z ?DllBlocklist_SetBasicDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z ?DllBlocklist_SetFullDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z ?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ ?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPAVProfilingStack@23@XZ ?IsWin32kLockedDown@mozilla@@YA_NXZ ?MapRemoteViewOfFile@mozilla@@YAPAXPAX0_K0KKK@Z ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z ?NowUnfuzzed@TimeStamp@mozilla@@CA?AV12@_N@Z ?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ ?gTwoCharEscapes@detail@mozilla@@3QBDB ?lock@MutexImpl@detail@mozilla@@IAEXXZ ?profiler_current_thread_id@baseprofiler@mozilla@@YAHXZ ?profiler_init@baseprofiler@mozilla@@YAXPAX@Z ?profiler_shutdown@baseprofiler@mozilla@@YAXXZ ?unlock@MutexImpl@detail@mozilla@@IAEXXZ ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z _wcsdup free malloc moz_xmalloc mozalloc_abort realloc strdup

advapi32

AccessCheck CheckTokenMembership ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DeregisterEventSource DuplicateToken DuplicateTokenEx EqualSid FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation ImpersonateLoggedOnUser InitializeSecurityDescriptor InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

ntdll

NtMapViewOfSection NtOpenFile NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtUnmapViewOfSection RtlAcquireSRWLockExclusive RtlAcquireSRWLockShared RtlAllocateHeap RtlCaptureStackBackTrace RtlCompareMemory RtlCompareUnicodeString RtlDuplicateUnicodeString RtlEqualUnicodeString RtlFreeHeap RtlFreeUnicodeString RtlGetLastWin32Error RtlGetVersion RtlInitUnicodeString RtlNtStatusToDosError RtlQueryPerformanceCounter RtlReAllocateHeap RtlReleaseSRWLockExclusive RtlReleaseSRWLockShared RtlRunOnceExecuteOnce RtlRunOnceInitialize RtlSetLastWin32Error VerSetConditionMask memcmp memcpy memmove memset

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?fail@ios_base@std@@QBE_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject AttachConsole CloseHandle CreateEventW CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GetVolumePathNameW GlobalMemoryStatusEx HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent ResumeThread SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetProcessDEPPolicy SetStdHandle SetThreadAffinityMask SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory lstrlenW

vcruntime140

_CxxThrowException __CxxFrameHandler3 _except_handler3 _except_handler4_common _purecall strrchr wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _beginthreadex _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vswprintf _dup _fileno _get_osfhandle _set_fmode _wfopen _wtmpnam_s fclose fgets freopen

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong rand_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv _wgetenv getenv

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 strftime

api-ms-win-crt-convert-l1-1-0

_ltoa wcstoul

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp _wcslwr_s _wcsnicmp strcpy strlen tolower towlower towupper wcscat_s wcscmp wcscpy wcscpy_s wcslen wcsncmp wcspbrk wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetDependentModulePaths GetHandleVerifier GetNtLoaderAPI IsSandboxedProcess NativeNtBlockSet_Write _TargetConfigureOPMProtectedOutput@20 _TargetCreateNamedPipeW@36 _TargetCreateOPMProtectedOutputs@24 _TargetCreateProcessA@44 _TargetCreateProcessW@44 _TargetCreateThread@28 _TargetDestroyOPMProtectedOutput@8 _TargetEnumDisplayDevicesA@20 _TargetEnumDisplayMonitors@20 _TargetGdiDllInitialize@12 _TargetGetCertificate@20 _TargetGetCertificateByHandle@20 _TargetGetCertificateSize@16 _TargetGetCertificateSizeByHandle@16 _TargetGetMonitorInfoA@12 _TargetGetMonitorInfoW@12 _TargetGetOPMInformation@16 _TargetGetOPMRandomNumber@12 _TargetGetStockObject@8 _TargetGetSuggestedOPMProtectedOutputArraySize@12 _TargetNtCreateEvent@24 _TargetNtCreateFile@48 _TargetNtCreateKey@32 _TargetNtCreateSection@32 _TargetNtMapViewOfSection@44 _TargetNtOpenEvent@16 _TargetNtOpenFile@28 _TargetNtOpenKey@16 _TargetNtOpenKeyEx@20 _TargetNtOpenProcess@20 _TargetNtOpenProcessToken@16 _TargetNtOpenProcessTokenEx@20 _TargetNtOpenThread@20 _TargetNtOpenThreadToken@20 _TargetNtOpenThreadTokenEx@24 _TargetNtQueryAttributesFile@12 _TargetNtQueryFullAttributesFile@12 _TargetNtSetInformationFile@24 _TargetNtSetInformationThread@20 _TargetNtUnmapViewOfSection@12 _TargetRegisterClassW@8 _TargetSetOPMSigningKeyAndSequenceNumbers@12 g_handles_to_close g_interceptions g_nt g_originals g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section

Name

.text

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.freestd

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_0a2738f9b1e6451d4f4fbbde261c3383_amadey_darkgate_elex_glassworm_hawkeye_mespinoza_smoke-loader

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic