2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop

General

Target
2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop
Size 3.0MB
Sample260418-p91c3sat3v
SHA256 3f19f506eda16addf81c05c39c27daf4173081144e23c697eb523c309effe090
MD5 cab5346c965f19180419f6dba486e153
SHA1 3c1f3f724db8dd85dff66bb0182c568872ee0fb0
SHA512 1de439011130831313268f26a2d370e5843cba216f8f65c326a7964c363f1f083f7a37ebed0582b83e844069f4830809dfa1ee15e305bbf8481dd703cdadef0c
SSDEEP 49152:MmDta4zmUi6AjW/MUSdGRf3/1k9hKPgssSt2gzcY/5H:MCcjxAZe9hv7Sti
TLSH
T184E5E70266E58435E5B297304EB5F69C5666BD64D9338E0F32C53DCEFBF0A815A22332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop

.exe 3.0MB

2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop

SHA256 3f19f506eda16addf81c05c39c27daf4173081144e23c697eb523c309effe090
MD5 cab5346c965f19180419f6dba486e153
SHA1 3c1f3f724db8dd85dff66bb0182c568872ee0fb0
SHA512 1de439011130831313268f26a2d370e5843cba216f8f65c326a7964c363f1f083f7a37ebed0582b83e844069f4830809dfa1ee15e305bbf8481dd703cdadef0c
SSDEEP 49152:MmDta4zmUi6AjW/MUSdGRf3/1k9hKPgssSt2gzcY/5H:MCcjxAZe9hv7Sti
TLSH
T184E5E70266E58435E5B297304EB5F69C5666BD64D9338E0F32C53DCEFBF0A815A22332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

150292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\selfcert.pdb

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-18_cab5346c965f19180419f6dba486e153_amadey_darkgate_elex_mespinoza_rhadamanthys_smoke-loader_stop

generic