2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar
Size 1.6MB
Sample260523-l9frwsav21
SHA256 aa690ba0f50c10b09a9ebe14ebc1e6a2b8e8669087ff4890c4ae310a8ffa7e66
MD5 a8fbc14383da44724b9fd9f6a61c917e
SHA1 91f5c8a77e90b31507f1d8bfd5cdf6b603a9432b
SHA512 0087065b5a454f46352e02074325621f2b9b3f8d68c9659b7550bdcfa2ae1d6a2b6e049c2846015ed3d9476d68d44b513023896e362140ecd619dd388d1571ee
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfU45jcAkSYqyEwqN/JWSV9:pLtk1qbLLfU+pYqQCWSV9
TLSH
T1EC856C23FAE48972D073957586959641EB32B4520B2183CB71AC876E1F337E1AD3B732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar

File Explorer

2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar

.exe 1.6MB

2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar

IMPHASH c320870209f8127dd7e4590516029388
SHA256 aa690ba0f50c10b09a9ebe14ebc1e6a2b8e8669087ff4890c4ae310a8ffa7e66
MD5 a8fbc14383da44724b9fd9f6a61c917e
SHA1 91f5c8a77e90b31507f1d8bfd5cdf6b603a9432b
SHA512 0087065b5a454f46352e02074325621f2b9b3f8d68c9659b7550bdcfa2ae1d6a2b6e049c2846015ed3d9476d68d44b513023896e362140ecd619dd388d1571ee
SSDEEP 24576:pLqLKk1Rs7Wy8sLLfU45jcAkSYqyEwqN/JWSV9:pLtk1qbLLfU+pYqQCWSV9
TLSH
T1EC856C23FAE48972D073957586959641EB32B4520B2183CB71AC876E1F337E1AD3B732
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FileSyncConfig.pdb

kernel32

FindClose CreateFileW CompareStringOrdinal IsWow64Process SetFileAttributesW GetFileAttributesW DeleteFileW GetCurrentProcess Sleep FindFirstFileW CloseHandle IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer OutputDebugStringW IsDebuggerPresent GetDiskFreeSpaceExW GetFileInformationByHandle SetLastError GetVolumeInformationByHandleW GetCurrentDirectoryW DecodePointer GetVolumePathNameW SetFileInformationByHandle SetFilePointerEx SetFileTime GetSystemDirectoryW MoveFileExW ReplaceFileW VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetFileInformationByHandleEx

msvcp120

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?_Orphan_all@_Container_base0@std@@QAEXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1ios_base@std@@UAE@XZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??0id@locale@std@@QAE@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?uncaught_exception@std@@YA_NXZ

msvcr120

_gmtime64 _read _close ??3@YAXPAX@Z _purecall __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??2@YAPAXI@Z _except_handler4_common _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter memset printf fprintf __iob_func memcpy __CxxFrameHandler3 _CxxThrowException ??_V@YAXPAX@Z memmove free _wcsicmp wcsrchr _errno _wfullpath _wmkdir _wrmdir _wunlink _wfindfirst64i32 ?_wopen@@YAHPB_WHH@Z _wstat64 _wfopen wcscpy_s _wcsnicmp ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ fclose feof ferror fread _fseeki64 fwrite _write _chsize _get_osfhandle _open_osfhandle ?what@exception@std@@UBEPBDXZ _vsnwprintf _vsnprintf malloc

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree PropVariantClear CoTaskMemAlloc

advapi32

RegEnumKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey InitializeAcl SetNamedSecurityInfoW

shell32

SHChangeNotify SHGetDataFromIDListW SHBindToParent SHParseDisplayName ord709 SHFileOperationW SHGetKnownFolderPath ord526

shlwapi

PathIsDirectoryW PathIsPrefixW

telemetry

??1ScenarioQosSyncWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z ?DefineDatapointValueList@ScenarioQosSyncWrapper@QoS@@IAEXPAV?$vector@W4DatapointValueType@ValueNode@@V?$allocator@W4DatapointValueType@ValueNode@@@std@@@std@@@Z ??0ScenarioQosSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIIII@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIII@Z ?RecordUploadDownloadScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@IABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11II@Z ?RecordFailedAssert@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I0_N@Z ?GetTxnContextString@ScenarioQosWrapper@QoS@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ??1ScenarioQosWrapper@QoS@@MAE@XZ ??1ScenarioQosSyncPerfWrapper@QoS@@UAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenarioWithSize@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@I@Z

loggingplatform

?LoggingWriteStructuredEvent@@YGXPBDI0ABU_GUID@@IIIQAUStructuredEventParameter@@@Z ?LoggingRotateIfNeeded@@YGXXZ ?StripPrivateInfoFromString@@YG?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

propsys

PropVariantToGUID

ntdll

NtQueryDirectoryFile RtlNtStatusToDosError

??0ScenarioQosChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosClientPolicy@QoS@@QAE@ABV01@@Z ??0ScenarioQosClientPolicy@QoS@@QAE@XZ ??0ScenarioQosDownloadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@_N@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@ABV01@@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@XZ ??0ScenarioQosLogUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosLogUpload@QoS@@QAE@XZ ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@ABV01@@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@_N@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@XZ ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@ABV01@@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@XZ ??0ScenarioQosSubScopeMapping@QoS@@QAE@ABV01@@Z ??0ScenarioQosSubScopeMapping@QoS@@QAE@XZ ??0ScenarioQosSyncPerf@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncPerf@QoS@@QAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@XZ ??0ScenarioQosSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@XZ ??0ScenarioQosUploadExternalFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadExternalFile@QoS@@QAE@XZ ??0ScenarioQosUploadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadFile@QoS@@QAE@_N@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@_N@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosWrapper@QoS@@QAE@ABV01@@Z ??1ScenarioQosChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosClientPolicy@QoS@@UAE@XZ ??1ScenarioQosDownloadFile@QoS@@UAE@XZ ??1ScenarioQosGetSpecialFolderInfo@QoS@@UAE@XZ ??1ScenarioQosLogUpload@QoS@@UAE@XZ ??1ScenarioQosPollingChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosQuotaStatus@QoS@@UAE@XZ ??1ScenarioQosSelectiveSyncEnumeration@QoS@@UAE@XZ ??1ScenarioQosStartupChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosStorageProvisioning@QoS@@UAE@XZ ??1ScenarioQosSubScopeMapping@QoS@@UAE@XZ ??1ScenarioQosSyncPerf@QoS@@UAE@XZ ??1ScenarioQosSyncVerification@QoS@@UAE@XZ ??1ScenarioQosUploadCrossScopeCopy@QoS@@UAE@XZ ??1ScenarioQosUploadExternalFile@QoS@@UAE@XZ ??1ScenarioQosUploadFile@QoS@@UAE@XZ ??1ScenarioQosUploadMetadata@QoS@@UAE@XZ ??1ScenarioQosWNSNotificationChangeEnumeration@QoS@@UAE@XZ ??4ScenarioQosChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosClientPolicy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDownloadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosGetSpecialFolderInfo@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosLogUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPollingChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosQuotaStatus@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSelectiveSyncEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStartupChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStorageProvisioning@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSubScopeMapping@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerf@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerfWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncVerification@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadCrossScopeCopy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadExternalFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadMetadata@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWrapper@QoS@@QAEAAV01@ABV01@@Z ??_7ScenarioQosChangeEnumeration@QoS@@6B@ ??_7ScenarioQosClientPolicy@QoS@@6B@ ??_7ScenarioQosDownloadFile@QoS@@6B@ ??_7ScenarioQosGetSpecialFolderInfo@QoS@@6B@ ??_7ScenarioQosLogUpload@QoS@@6B@ ??_7ScenarioQosPollingChangeEnumeration@QoS@@6B@ ??_7ScenarioQosQuotaStatus@QoS@@6B@ ??_7ScenarioQosSelectiveSyncEnumeration@QoS@@6B@ ??_7ScenarioQosStartupChangeEnumeration@QoS@@6B@ ??_7ScenarioQosStorageProvisioning@QoS@@6B@ ??_7ScenarioQosSubScopeMapping@QoS@@6B@ ??_7ScenarioQosSyncPerf@QoS@@6B@ ??_7ScenarioQosSyncPerfWrapper@QoS@@6B@ ??_7ScenarioQosSyncVerification@QoS@@6B@ ??_7ScenarioQosSyncWrapper@QoS@@6B@ ??_7ScenarioQosUploadCrossScopeCopy@QoS@@6B@ ??_7ScenarioQosUploadExternalFile@QoS@@6B@ ??_7ScenarioQosUploadFile@QoS@@6B@ ??_7ScenarioQosUploadMetadata@QoS@@6B@ ??_7ScenarioQosWNSNotificationChangeEnumeration@QoS@@6B@ ??_7ScenarioQosWrapper@QoS@@6B@ ?DefaultOrMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@W434@@Z ?GetApiId@ScenarioQosWrapper@QoS@@IAE?AW4_ApiId@Bici@@XZ ?GetMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@XZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-23_a8fbc14383da44724b9fd9f6a61c917e_amadey_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader_vidar

kernel32

msvcp120

msvcr120

ole32

advapi32

shell32

shlwapi

telemetry

loggingplatform

propsys

ntdll

generic