2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader
Size 3.7MB
Sample260416-snwpjsfw41
SHA256 9df6ad556d0422dd6a1ca238db620014ea981408565294318e8b1fa76c5609f7
MD5 367032b6a102e424f03aa89e0a198ca2
SHA1 aefe64f12890ab2c84e2f8c632d7aae07fa92547
SHA512 0c5b1cfb3b5c918cd1871597292de5d3ba1466056b1526bfcab1b826069b5f536807fe430fe9356ab25661731631ee38124193e50553994305a6c0642c805cde
SSDEEP 49152:NXv9MnljxqcY/KqnstLet3LyFmUi6AjW/MUSdGRf3/:B96LjqnstLEfjxAZ
TLSH
T10006081166F18435D462EA305D64EB5D153A7F10DE238E4BB280BECEFBF5692A931332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader

File Explorer

2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader

.exe 3.7MB

2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader

IMPHASH 9bd8499d2ac056a616bc7696c39c263b
SHA256 9df6ad556d0422dd6a1ca238db620014ea981408565294318e8b1fa76c5609f7
MD5 367032b6a102e424f03aa89e0a198ca2
SHA1 aefe64f12890ab2c84e2f8c632d7aae07fa92547
SHA512 0c5b1cfb3b5c918cd1871597292de5d3ba1466056b1526bfcab1b826069b5f536807fe430fe9356ab25661731631ee38124193e50553994305a6c0642c805cde
SSDEEP 49152:NXv9MnljxqcY/KqnstLet3LyFmUi6AjW/MUSdGRf3/:B96LjqnstLEfjxAZ
TLSH
T10006081166F18435D462EA305D64EB5D153A7F10DE238E4BB280BECEFBF5692A931332
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\javacplexec\obj64\javacpl.pdb

user32

MessageBoxW LoadStringW wsprintfW

msvcr100

__dllonexit _lock _onexit ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crt_debugger_hook __set_app_type _fmode _commode __setusermatherr ??2@YAPEAX_K@Z _configthreadlocale _initterm_e _initterm _acmdln exit _cexit _ismbblead _exit _XcptFilter __getmainargs _amsg_exit __C_specific_handler ?terminate@@YAXXZ memcpy _vsnwprintf_s _ftime64_s wcsftime _snwprintf_s _localtime64 wcsncpy_s _wstat64i32 wcscat_s memcpy_s _wsplitpath_s wcscpy_s _wtoi memset swprintf_s ??_U@YAPEAX_K@Z ??3@YAXPEAX@Z __CxxFrameHandler3 _stat64i32 _CxxThrowException malloc ??_V@YAXPEAX@Z free _unlock

kernel32

LoadLibraryW LocalFree WideCharToMultiByte lstrlenA MultiByteToWideChar RaiseException GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter DecodePointer RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess EncodePointer GetStartupInfoW Sleep GetCurrentThreadId GetCurrentProcessId OutputDebugStringW GetShortPathNameW LocalAlloc lstrlenW WaitForSingleObject CreateProcessW GetSystemDirectoryW CreateFileW GetNativeSystemInfo GetCurrentProcess GetVersionExW GlobalMemoryStatusEx GetModuleHandleW GetModuleFileNameW GetLongPathNameW GetLastError GetProcAddress FreeLibrary CloseHandle FormatMessageW GetEnvironmentVariableW GetWindowsDirectoryW LoadLibraryA

ole32

CoTaskMemFree StringFromCLSID

oleaut32

SysStringLen SysAllocStringByteLen SysAllocString VariantClear SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_367032b6a102e424f03aa89e0a198ca2_amadey_darkgate_glassworm_hawkeye_smoke-loader

user32

msvcr100

kernel32

ole32

oleaut32

generic