2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 1.2MB
Sample260702-zyebksez2x
SHA256 55e67a014509c125198b986f539fe35846b0e2e5dbcaeca0adf9d80d8c0d11d2
MD5 2cd192a01e33931738d3277f28ee99f5
SHA1 d646d8df7c1644647d3050051438333ab6f81e43
SHA512 d1535d20cf5c995f259155f32bad2cc0defde0de0b58948aee5164be9cb86ab9d06697054709a4dda990b61f2b2155a80e57d71f88551c8713fa538428362bdd
SSDEEP 12288:qEMa88+Y/zcK41sWytpmRYTnlM/vbpqwVeEIwIm6iLQWjJBjvrEH7O:qEf8h0zcd2tpbM1qyefnmwWzrEH7O
TLSH
T19345080277F95229F1F37BB1EEB992645AB7BC61AD3DC50E5280025E0DB4A90DA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 1.2MB

2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 7278c7328f8906d1bb3bab6498e3ba97
SHA256 55e67a014509c125198b986f539fe35846b0e2e5dbcaeca0adf9d80d8c0d11d2
MD5 2cd192a01e33931738d3277f28ee99f5
SHA1 d646d8df7c1644647d3050051438333ab6f81e43
SHA512 d1535d20cf5c995f259155f32bad2cc0defde0de0b58948aee5164be9cb86ab9d06697054709a4dda990b61f2b2155a80e57d71f88551c8713fa538428362bdd
SSDEEP 12288:qEMa88+Y/zcK41sWytpmRYTnlM/vbpqwVeEIwIm6iLQWjJBjvrEH7O:qEf8h0zcd2tpbM1qyefnmwWzrEH7O
TLSH
T19345080277F95229F1F37BB1EEB992645AB7BC61AD3DC50E5280025E0DB4A90DA31733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a5:09:ef:74:54:13:83:ec:a7:e4:5c:e3:cc:ff:f2:45:0d:56:7e:48

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat DC,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 23, 2016

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

10:fb:71:33:19:02:7f:3f:1f:1c:06:67:b3:c3:8c:a9

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 14, 2015 - May 7, 2017

Minor OS version

Major OS version

Entry point

315136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\CB\ARM_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord88 ord171 ord118 ord116 ord141 ord205 ord114 ord160 ord159 ord8 ord16 ord115 ord32 ord92 ord119 ord131 ord70 ord181 ord195 ord281 ord240

psapi

GetModuleFileNameExW GetModuleBaseNameW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle HttpQueryInfoW

sensapi

IsNetworkAlive

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData

kernel32

LockFile UnlockFile DuplicateHandle GetFullPathNameW GetModuleFileNameW InterlockedExchange CompareStringA LoadLibraryExW GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThreadId GlobalDeleteAtom SetThreadPriority ResumeThread SuspendThread GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW FreeResource FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime FlushFileBuffers GetFileSizeEx GetFileTime InterlockedIncrement LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree SetErrorMode GlobalFlags GetStartupInfoW GetSystemTimeAsFileTime ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentDirectoryA GetDriveTypeA GetCPInfo GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv InterlockedDecrement GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetCurrentThread UnmapViewOfFile OpenFileMappingW MapViewOfFile GetVolumeInformationW HeapFree GetProcessHeap HeapAlloc OpenEventW Module32NextW Module32FirstW Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess FindResourceExW lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetVersionExW lstrlenA WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary GetPrivateProfileSectionNamesW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW GetLocalTime MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LocalFree FormatMessageW GetThreadLocale GetModuleHandleW VirtualAlloc VirtualFree GetTempPathW WaitForSingleObject OpenProcess CopyFileW GetProcAddress GetACP LoadLibraryW lstrlenW GetTickCount CreateEventW SetLastError Sleep SetEvent GetThreadPriority MultiByteToWideChar CloseHandle CreateFileW ReadFile SetFilePointer GetFileSize CreateFileA FindClose FindFirstFileW DeleteFileW SetFileAttributesW SetFileTime WriteFile GetLastError CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource GetFileAttributesExW

user32

WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu ShowScrollBar CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SystemParametersInfoA GetWindowPlacement CopyRect GetSysColor EndPaint BeginPaint ReleaseDC GetDC ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetWindowTextLengthW SetFocus ShowWindow SetWindowLongW GetDlgCtrlID IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuStringW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow KillTimer DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW UnregisterClassW GetSysColorBrush SetWindowPos GetForegroundWindow MessageBoxW DestroyMenu GetDesktopWindow GetNextDlgTabItem CreateDialogIndirectParamW EndDialog SendDlgItemMessageA

gdi32

DeleteDC GetStockObject ScaleWindowExtEx ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject GetTextExtentPoint32W CreateFontIndirectW GetObjectW Escape

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

LookupAccountNameW RegCloseKey RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegFlushKey ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW OpenThreadToken DuplicateToken CheckTokenMembership IsValidSid GetLengthSid ConvertSidToStringSidW RegCreateKeyExW CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired RegEnumKeyExW RegSetValueExW RegDeleteValueW RegEnumValueW RegQueryInfoKeyW CreateProcessAsUserW OpenProcessToken DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountSidW GetUserNameW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW SHCreateDirectoryExW SHFileOperationW SHAppBarMessage Shell_NotifyIconW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathStripToRootW PathFindFileNameW PathFindExtensionW PathIsUNCW SHDeleteKeyW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance CoInitialize OleRun

oleaut32

SysAllocString VariantChangeType VariantCopy VariantInit SysStringByteLen SysAllocStringByteLen VariantClear SysFreeString GetErrorInfo

urlmon

URLDownloadToFileW

crypt32

CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CryptProtectData CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertGetNameStringW CryptUnprotectData

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_2cd192a01e33931738d3277f28ee99f5_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

crypt32

wintrust

userenv

generic