2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader
Size 1.6MB
Sample260602-rh17eafs71
SHA256 e1c8f629ded0a6a06e32d6c2f4b46c3c06b33ad8bd887e5b0f39851437084013
MD5 8630d8752e3262025090a8178a699f69
SHA1 49db9d13e20e59f8300ada9b51281c0eba6ab679
SHA512 00d3ae23731270328005b5fe1864f7caff932a5aeb0b21da88446e36efe7aa2300f0f0d94a6ce52f51a224c198b389460ed7b68d8acc7c7b30391bed05e66e23
SSDEEP 49152:7C55AoJdXN0BMOwLuvvakOElMaFLkNlju:CBJdXN0B7+Ovak73
TLSH
T11B85AE22BA50D436D1B741B08B25A715B7B97E300B3056DBE3946E4D2E702F2AF3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader

File Explorer

2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader

.exe 1.6MB

2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader

IMPHASH 29b19f1d3e5b9a9966989b673eea4782
SHA256 e1c8f629ded0a6a06e32d6c2f4b46c3c06b33ad8bd887e5b0f39851437084013
MD5 8630d8752e3262025090a8178a699f69
SHA1 49db9d13e20e59f8300ada9b51281c0eba6ab679
SHA512 00d3ae23731270328005b5fe1864f7caff932a5aeb0b21da88446e36efe7aa2300f0f0d94a6ce52f51a224c198b389460ed7b68d8acc7c7b30391bed05e66e23
SSDEEP 49152:7C55AoJdXN0BMOwLuvvakOElMaFLkNlju:CBJdXN0B7+Ovak73
TLSH
T11B85AE22BA50D436D1B741B08B25A715B7B97E300B3056DBE3946E4D2E702F2AF3A717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36045

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\setupexe\x86\ship\0\deployca\odeploy.pdb

advapi32

CloseServiceHandle QueryServiceStatusEx OpenServiceW OpenSCManagerW RegOpenKeyExW RegCreateKeyExW FreeSid AllocateAndInitializeSid ImpersonateLoggedOnUser RevertToSelf CreateProcessAsUserW RegFlushKey RegCloseKey

kernel32

WaitForSingleObject GetTickCount CreateFileW GetLastError SleepEx CompareFileTime GetSystemTimeAsFileTime SetErrorMode GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId EnterCriticalSection LeaveCriticalSection FreeLibrary LoadLibraryA InitializeCriticalSection Sleep GetCPInfo GetACP GetOEMCP VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode HeapSize MultiByteToWideChar GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers GetTimeZoneInformation CreateFileA CloseHandle CompareStringA CompareStringW SystemTimeToTzSpecificLocalTime GetSystemTime GetVersion ExpandEnvironmentStringsW LocalFree FormatMessageW FindClose FindFirstFileW lstrlenA GetFileAttributesW SetFileAttributesW DeleteFileW GetExitCodeProcess GetModuleFileNameW CreateProcessW GetPriorityClass GetTempPathW GetModuleHandleW OpenMutexW GetCommandLineW GlobalFree InitializeCriticalSectionAndSpinCount LoadLibraryExW

ole32

CoInitializeEx CoUninitialize

shell32

SHCreateDirectoryExW CommandLineToArgvW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

msi

ord177

secur32

GetUserNameExW

dbghelp

SymGetLineFromAddr64 SymInitialize SymGetSymFromAddr64

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_8630d8752e3262025090a8178a699f69_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader

advapi32

kernel32

ole32

shell32

version

msi

secur32

dbghelp

generic