2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
Size 2.0MB
Sample260528-qs1sysg15j
SHA256 8fc681baeb3c0265c3c0642a49749de24946e19241d9de96d737297a14e59cbe
MD5 5e1fc826501e7b8fbd8346aa6dabf8ce
SHA1 44c2f2a317ffb59231065ec3bf8077ab5233261c
SHA512 8242706dcdda274ef7d6f9a91c069aa40c3bc5de307b1ee453695242849550046e6e617466d7d3879bd35cf646b88227b19f76a0a85abf9132848a30c349be63
SSDEEP 49152:NJiV66faWoGODTP1xVFchS9mK5JLvzlaVsrPa0Pdswk9:PLGS9mKAKC
TLSH
T19EA53A0277F88135F1F36B709EB993649A77BD61AD39C14F3388165E0EB0A809A35727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

.exe 2.0MB

2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH eb248eb1139039af28f5f2ad4ada1499
SHA256 8fc681baeb3c0265c3c0642a49749de24946e19241d9de96d737297a14e59cbe
MD5 5e1fc826501e7b8fbd8346aa6dabf8ce
SHA1 44c2f2a317ffb59231065ec3bf8077ab5233261c
SHA512 8242706dcdda274ef7d6f9a91c069aa40c3bc5de307b1ee453695242849550046e6e617466d7d3879bd35cf646b88227b19f76a0a85abf9132848a30c349be63
SSDEEP 49152:NJiV66faWoGODTP1xVFchS9mK5JLvzlaVsrPa0Pdswk9:PLGS9mKAKC
TLSH
T19EA53A0277F88135F1F36B709EB993649A77BD61AD39C14F3388165E0EB0A809A35727
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_ns\BuildResults\bin\Release\PDFPrevHndlrShim.pdb

kernel32

LeaveCriticalSection GetModuleFileNameW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleHandleW CloseHandle WaitForSingleObject Sleep EnterCriticalSection CreateEventW GetCurrentThreadId SetEvent GetCommandLineW o5 o5 ( InterlockedDecrement InterlockedIncrement lstrcmpiW GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException CreateThread lstrlenW +r� (/ ( _ r1 ~M ,M� 3M M +6~M o, ,( 0 �** 0 o( o K r� ( *{K 0 Q-s o o ( ( t

user32

TranslateMessage DispatchMessageW GetMessageW PostThreadMessageW CharUpperW CharNextW

RegQuerMZ� RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW �

s program cannot be run in DOS mode. $ be run in DOS mode. $ $

�

ord6 ord7 ord162 ord161 ord2 ord186 ord163 ord277

r`;$"

h F��q&2Y\K+�/�w�� |��5�V,~��A8"iW'|�� V,~��A8"iW'|�� h�쉟K�eO�1��a�S�+]+%�4��(PRޏ�2O�_��ϡ<�A�r`;$" 4��(PRޏ�2O�_��ϡ<�A�r`;$"

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_5e1fc826501e7b8fbd8346aa6dabf8ce_amadey_darkgate_elex_mafia_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

�

r`;$"

generic