2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc
Size 92KB
Sample260705-bjsnnabw3q
SHA256 8d272aee2be6dee2e1276f850f28291c678c3ec335eedbc5ead2875225a45e38
MD5 c5bbc0fd88e7529412b6d8cad93c8d25
SHA1 1e5dca59ae8a827a0bbe76ca152bc6bbfabf54d8
SHA512 65cd0f6f2753e6aacd7854bf4289bb67c1f77d01d5227df6a7a8655d02d838962d237f52b76597f331ab8dc9485862580c59ed9c0aad5e4c4196f2e072828ac9
SSDEEP 1536:1+RaIyKCuGgr0ZCHX/dPx+looG84wLts3dxROqsR/3lYkJ5kOzQi2qBg:1+RaFjgwwxkpGZdxROnRf5kOMi2P
TLSH
T118938E1176E0C032F8A219306568C6725E7EB93356B9C887779C07A95F703C1DA6E3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc

File Explorer

2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc

.exe 92KB

2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc

IMPHASH 574abcdb191034e6f8fd28d08da9ecc0
SHA256 8d272aee2be6dee2e1276f850f28291c678c3ec335eedbc5ead2875225a45e38
MD5 c5bbc0fd88e7529412b6d8cad93c8d25
SHA1 1e5dca59ae8a827a0bbe76ca152bc6bbfabf54d8
SHA512 65cd0f6f2753e6aacd7854bf4289bb67c1f77d01d5227df6a7a8655d02d838962d237f52b76597f331ab8dc9485862580c59ed9c0aad5e4c4196f2e072828ac9
SSDEEP 1536:1+RaIyKCuGgr0ZCHX/dPx+looG84wLts3dxROqsR/3lYkJ5kOzQi2qBg:1+RaFjgwwxkpGZdxROnRf5kOMi2P
TLSH
T118938E1176E0C032F8A219306568C6725E7EB93356B9C887779C07A95F703C1DA6E3DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

04:e2:97:6f:08:41:67:6c:4c:82:e3:d4:bd:73:b5:9f:0f:cc:49:25

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Chains

Dec 24, 2013

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Subject

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Serial Number

05:11:ea:f8:57:9e:26:62:be:62:2d:e5:ae:0c:d4:08

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2013 - Sep 21, 2016

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

11911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\m-cen-w32-ntly-000000000000000\build\obj-firefox\webapprt\win\webapprt-stub.pdb

kernel32

GetEnvironmentVariableW MultiByteToWideChar CloseHandle CreateProcessW MoveFileW CopyFileW MoveFileExW WideCharToMultiByte GetModuleFileNameW SetDllDirectoryW ExpandEnvironmentStringsW LoadLibraryExW GetProcAddress FreeLibrary ReadFile SetFilePointerEx CreateFileW IsDebuggerPresent SetEnvironmentVariableW GetCurrentProcess GetLastError TerminateProcess GetCommandLineW HeapSetInformation HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection HeapReAlloc SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsProcessorFeaturePresent RaiseException RtlUnwind SetFilePointer SetStdHandle Sleep LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode HeapSize FlushFileBuffers CompareStringW SetEnvironmentVariableA LCMapStringW GetStringTypeW WriteConsoleW SetEndOfFile GetProcessHeap

user32

MessageBoxW

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_c5bbc0fd88e7529412b6d8cad93c8d25_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc

PE Signature issue

kernel32

user32

advapi32

generic