2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 12.4MB
Sample260703-q97b3aav21
SHA256 60826923870a073d4aecf69aead8676b5dab1eab3dabcd8578dc5130fbbf6a7b
MD5 a351daf5d897e685d16c17a0edba4e38
SHA1 9a9756d2b9f62e48a78fb5f64d1e768bd4e9859f
SHA512 6606e950a9df721256d60f76ff9344fd6199b898a2b15da8a53146779184618fbf3310db0ba0c7d216e1431dc77c73e335558349ebfeab2172a4fc3a41e7a96d
SSDEEP 393216:rDLRH9/bqgztjC9RCNvDamGY5GK0B5Z1GlgWJ:rvRH9/bqSGyFBh5l0xQV
TLSH
T10ED63346A661C4F2D21482790962F23588327D3217E6D5FBA7937D35CC363D22B3E26E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 12.4MB

2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 46fa7d92eb62c4e3ece85c478b807f6e
SHA256 60826923870a073d4aecf69aead8676b5dab1eab3dabcd8578dc5130fbbf6a7b
MD5 a351daf5d897e685d16c17a0edba4e38
SHA1 9a9756d2b9f62e48a78fb5f64d1e768bd4e9859f
SHA512 6606e950a9df721256d60f76ff9344fd6199b898a2b15da8a53146779184618fbf3310db0ba0c7d216e1431dc77c73e335558349ebfeab2172a4fc3a41e7a96d
SSDEEP 393216:rDLRH9/bqgztjC9RCNvDamGY5GK0B5Z1GlgWJ:rvRH9/bqSGyFBh5l0xQV
TLSH
T10ED63346A661C4F2D21482790962F23588327D3217E6D5FBA7937D35CC363D22B3E26E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1c:79:b3:55:d1:e3:17:d6:00:63:b6:0d:da:cc:7b:0e:ba:bf:f2:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Chains

Oct 3, 2012

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Serial Number

a6:e2:7c:fe:35:24:62:de:4e:83:ee:ea:83:9a:f7:30

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2012 - Sep 12, 2013

Minor OS version

0

Major OS version

5

Entry point

281410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Builds\Temporary\activitymon20\MSVC\Builds\x86\Release\Setup\selfex.pdb

comctl32

InitCommonControlsEx

kernel32

ReadFile MultiByteToWideChar GetACP WriteFile DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesW CreateProcessW WaitForSingleObject WideCharToMultiByte InitializeCriticalSection TerminateThread DeleteCriticalSection ResumeThread EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount QueryPerformanceCounter CloseHandle GlobalMemoryStatus FreeLibrary GetProcAddress LoadLibraryA GetVersionExA FlushConsoleInputBuffer CompareStringW CompareStringA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA SetFilePointer CreateFileW GetModuleFileNameW CreateDirectoryW GetTempFileNameW GetLastError GetTempPathW RemoveDirectoryW FindClose GetCurrentProcessId FindNextFileW DeleteFileW FindFirstFileW SetCurrentDirectoryW GetCurrentDirectoryW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree GetConsoleCP GetConsoleMode ExitThread CreateThread GetStartupInfoW HeapReAlloc GetSystemTimeAsFileTime SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode RaiseException RtlUnwind CreateFileA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetModuleFileNameA VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess SetHandleCount GetStartupInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetModuleHandleA GetCPInfo GetOEMCP IsValidCodePage FlushFileBuffers SetEnvironmentVariableA

user32

MessageBoxA GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW SendMessageW SetWindowLongW GetWindowLongW GetDlgItem SetDlgItemTextW EndDialog SetTimer SetWindowPos GetSystemMetrics GetWindowRect DialogBoxParamW PostMessageW

advapi32

ReportEventA RegisterEventSourceA DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

comctl32

kernel32

user32

advapi32

generic