2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry

General

Target
2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry
Size 2.2MB
Sample260529-ty57eahs5v
SHA256 f57108a7925a781eb1e962d0dd6f9c5e36323418ac7dacb861fc86e87b51595a
MD5 21166706b6a242ad16530010b9fc5897
SHA1 d96605a0b71dc021449e60dbcb503ce43bb595d1
SHA512 ab752fd6da30659e94e2f3bc63eb317afa847dc4a5aac93754158e00c1394b4ef5257bff65764c5627c548e29ea4480f1b0d181e681f18fc6b493d9ba213654a
SSDEEP 24576:W5+t0pOdRncuzKPgssStPUvgLjPYTqMi8CtBd2QHCHmTBW5:teODnhKPgssSt2gOqJtb2I
TLSH
T102B5061DFEE88E29E0B3A670C9B5936DAA323C605A31C54F2285725EDD71F809536733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry

File Explorer

2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry

.exe 2.2MB

2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry

IMPHASH 92f377bec2fd08bb16ed274dff1cdbcc
SHA256 f57108a7925a781eb1e962d0dd6f9c5e36323418ac7dacb861fc86e87b51595a
MD5 21166706b6a242ad16530010b9fc5897
SHA1 d96605a0b71dc021449e60dbcb503ce43bb595d1
SHA512 ab752fd6da30659e94e2f3bc63eb317afa847dc4a5aac93754158e00c1394b4ef5257bff65764c5627c548e29ea4480f1b0d181e681f18fc6b493d9ba213654a
SSDEEP 24576:W5+t0pOdRncuzKPgssStPUvgLjPYTqMi8CtBd2QHCHmTBW5:teODnhKPgssSt2gOqJtb2I
TLSH
T102B5061DFEE88E29E0B3A670C9B5936DAA323C605A31C54F2285725EDD71F809536733
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW GetModuleFileNameW SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW GetFileType SignalObjectAndWait CreateFileW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetModuleHandleExW SetLastError GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW TerminateProcess ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW HeapFree EncodePointer DecodePointer HeapAlloc HeapReAlloc IsProcessorFeaturePresent LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_21166706b6a242ad16530010b9fc5897_amadey_darkgate_elex_maze_rhadamanthys_smoke-loader_stop_wannacry

kernel32

winmm

advapi32

generic