2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 1.0MB
Sample260701-nxfbpse13t
SHA256 f377cfbd09ab1c6808e10d09969bfbd49f2d375eb5d7db299d0c1779f39380d7
MD5 89e4a5e978b9a6cbf0f2c08fbb69f2c4
SHA1 a21c73eea90cdfcea4aee883ed69734556474e3a
SHA512 52ee4208cc3850227fed0fe1f30a82acfecae3678d7989757531033a2f81d93150d4676b6d744fe4b5e7603e4bb48061f275e39c1560a434f6d891103be0da83
SSDEEP 12288:IdzFuqW7mmusNTu9An4S1fDPgM7yCNtON0eFbBjvrEH7L:IdzFuqUmS8SxyCN4+eFhrEH7L
TLSH
T14835190277F94269F1F37BB0AEB992645AB7BC75AD39C50E2381215E0DB4A40DA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 1.0MB

2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 2cfe96b2f72a7adde477f896916db5d3
SHA256 f377cfbd09ab1c6808e10d09969bfbd49f2d375eb5d7db299d0c1779f39380d7
MD5 89e4a5e978b9a6cbf0f2c08fbb69f2c4
SHA1 a21c73eea90cdfcea4aee883ed69734556474e3a
SHA512 52ee4208cc3850227fed0fe1f30a82acfecae3678d7989757531033a2f81d93150d4676b6d744fe4b5e7603e4bb48061f275e39c1560a434f6d891103be0da83
SSDEEP 12288:IdzFuqW7mmusNTu9An4S1fDPgM7yCNtON0eFbBjvrEH7L:IdzFuqUmS8SxyCN4+eFhrEH7L
TLSH
T14835190277F94269F1F37BB0AEB992645AB7BC75AD39C50E2381215E0DB4A40DA31733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

45:79:62:2e:ec:49:1d:9f:56:34:cd:10:78:53:09:de:78:a4:c4:f5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=AcrobatXI,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 20, 2014

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2012 - Jun 6, 2022

Subject

Serial Number

75:fb:51:c8:76:8e:f6:92:7b:f4:1d:a1:a2:34:a1:d9

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2013 - Jul 25, 2015

Minor OS version

Major OS version

Entry point

282957

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\CB\ARM\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord16 ord118 ord171 ord141 ord115 ord119 ord88 ord240 ord281 ord205 ord123 ord120 ord114 ord160 ord159 ord32 ord92 ord8 ord116 ord70 ord181 ord195

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW

sensapi

IsNetworkAlive

kernel32

InterlockedDecrement GetModuleHandleA GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW FreeResource FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime InterlockedIncrement LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GlobalAddAtomW SetErrorMode GlobalFlags GetStartupInfoW SetEnvironmentVariableW GetSystemTimeAsFileTime ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate QueryPerformanceCounter GetCurrentDirectoryA GetDriveTypeA GetCPInfo GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA SuspendThread ResumeThread SetThreadPriority GlobalDeleteAtom GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GetModuleFileNameW GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetCurrentThread UnmapViewOfFile OpenFileMappingW MapViewOfFile GetVolumeInformationW HeapFree GetProcessHeap HeapAlloc GetCurrentProcess OpenEventW Module32NextW Module32FirstW Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW SetLastError OpenMutexW CreateMutexW GetThreadPriority RemoveDirectoryW GetVersionExW WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary lstrlenA GetPrivateProfileSectionNamesW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LocalFree FormatMessageW GetThreadLocale VirtualAlloc VirtualFree GetTempPathW OpenProcess CopyFileW GetACP LoadLibraryW lstrlenW WaitForSingleObject GetTickCount SetEvent CreateEventW GetProcAddress GetModuleHandleW Sleep MultiByteToWideChar CloseHandle CreateFileW ReadFile SetFilePointer GetFileSize CreateFileA FindClose FindFirstFileW DeleteFileW SetFileAttributesW SetFileTime WriteFile GetLastError CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource

user32

GetSysColorBrush DestroyMenu GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu ShowScrollBar CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SystemParametersInfoA GetWindowPlacement CopyRect GetSysColor EndPaint BeginPaint ReleaseDC GetDC ScreenToClient DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx GetLastActivePopup SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW EnableMenuItem CheckMenuItem GetWindowTextLengthW SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongW GetDlgCtrlID GetWindowLongW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetDlgItem GetWindow PostQuitMessage CharUpperW GetMenuState GetMenuStringW ExitWindowsEx RegisterWindowMessageW EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow KillTimer DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus GetWindowRect IsWindow SendMessageW EnableWindow PostMessageW LoadIconW GetForegroundWindow SetForegroundWindow SetTimer MessageBoxW UnregisterClassW ValidateRect GrayStringW

gdi32

ScaleWindowExtEx GetStockObject SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap DeleteDC GetDeviceCaps GetTextExtentPoint32W CreateFontIndirectW GetObjectW DeleteObject PtVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

GetSidSubAuthority RegCreateKeyW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid OpenThreadToken DuplicateToken CheckTokenMembership IsValidSid GetLengthSid ConvertSidToStringSidW LookupAccountNameW CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeSid GetSidLengthRequired RegEnumKeyExW RegCreateKeyExW RegDeleteValueW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumValueW RegQueryInfoKeyW GetUserNameW RegQueryValueExW RegFlushKey RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW Shell_NotifyIconW SHCreateDirectoryExW SHFileOperationW SHAppBarMessage ShellExecuteW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

SHDeleteKeyW PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

VariantClear VariantInit VariantChangeType

urlmon

URLDownloadToFileW

crypt32

CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CryptProtectData CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptUnprotectData CertGetNameStringW

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_89e4a5e978b9a6cbf0f2c08fbb69f2c4_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

msi

psapi

version

wininet

sensapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

crypt32

wintrust

userenv

generic