2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader
Size 1.6MB
Sample260702-lrtwssdy7j
SHA256 74d6bdf9d7b43bf3176e3660a60a78c9b44a200834e15524f612298d5125a303
MD5 bfd994e7cd49ff1083bf930d3e2b8309
SHA1 28d2de8fd07752dbb493ba1ce0ea3b695c98f469
SHA512 a6d1b5e4505ad548893af2f773c0bb103ff7a04c8ec92c793a0a870f6f4de2edb747c57b5d8f31800eccf74ecd997021260bdebe7dfe21d117486f7dd18441a0
SSDEEP 12288:k3J8g2jn1yqBe61GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:k5RWnnBe6VnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1F4755C10B6EDA02FF2167AF96FCBD65DC35AAEF4524BC22F6095392342B5C821B13135
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader

File Explorer

2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader

.exe 1.6MB

2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader

IMPHASH d0d24a0edb2b258c9c48e0ab0d62e5d1
SHA256 74d6bdf9d7b43bf3176e3660a60a78c9b44a200834e15524f612298d5125a303
MD5 bfd994e7cd49ff1083bf930d3e2b8309
SHA1 28d2de8fd07752dbb493ba1ce0ea3b695c98f469
SHA512 a6d1b5e4505ad548893af2f773c0bb103ff7a04c8ec92c793a0a870f6f4de2edb747c57b5d8f31800eccf74ecd997021260bdebe7dfe21d117486f7dd18441a0
SSDEEP 12288:k3J8g2jn1yqBe61GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:k5RWnnBe6VnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1F4755C10B6EDA02FF2167AF96FCBD65DC35AAEF4524BC22F6095392342B5C821B13135
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Job\Company\Conexant\SVN\SmartAudio_Service-AUDBD\Export\Release\SASrv.pdb

kernel32

SetEvent ConnectNamedPipe CreateNamedPipeW Sleep GetVersionExW TerminateProcess ReadFile MultiByteToWideChar DisconnectNamedPipe ResetEvent LocalAlloc CreateEventW DebugBreak LocalFree RaiseException InitializeCriticalSectionAndSpinCount WaitForSingleObject LCMapStringW HeapAlloc GetConsoleMode GetConsoleCP WideCharToMultiByte RtlUnwind LoadLibraryW HeapReAlloc IsProcessorFeaturePresent GetStringTypeW HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo InterlockedDecrement InterlockedIncrement lstrlenA GetCommandLineW lstrcpyW CloseHandle GetCurrentThreadId DeleteCriticalSection EnterCriticalSection GetLastError lstrlenW FlushFileBuffers CreateFileW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection WriteFile OutputDebugStringW SetFilePointer ExitProcess SetStdHandle WriteConsoleW IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapCreate HeapSetInformation GetStartupInfoW HeapFree EncodePointer DecodePointer ExitThread CreateThread SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW LoadStringW EndDialog DefWindowProcW EndPaint DestroyWindow PostQuitMessage CharNextW wvsprintfW DialogBoxParamW BeginPaint RegisterClassExW LoadIconW

advapi32

OpenServiceW ControlService ReportEventW RegOpenKeyExW SetServiceStatus QueryServiceStatus SetSecurityDescriptorDacl InitializeSecurityDescriptor DeregisterEventSource RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW OpenSCManagerW DeleteService CloseServiceHandle RegisterEventSourceW CreateServiceW RegSetValueExW RegCloseKey RegQueryValueExW RegCreateKeyExW

ole32

PropVariantClear CoInitialize CoUninitialize CoCreateInstance

winmm

timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_bfd994e7cd49ff1083bf930d3e2b8309_amadey_darkgate_elex_smoke-loader

kernel32

user32

advapi32

ole32

winmm

generic