2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader
Size 749KB
Sample260707-cp5qvafz21
SHA256 45ec964382c01152e565c42cf258b4430cf5941513464811e2e7137b126baa4c
MD5 92621a6f9ca90ed0d168e5a05029e787
SHA1 66e6a54237668833564aefbb832f32118f148ff6
SHA512 d97a54c7c5d002efcdbd218c5d27f49d299c7ace665c7e2773344927dbdee9ac159591448324384b0e776900afe6da8047fbfc9220da05322b756151bf13c1f3
SSDEEP 12288:ZNQvvFAwSfxL/2Dc3jDLLmt0LDQewsAjROCWV7q9zGImAjJdcH4j3ttzFdVCLNSR:bQGaewsAjaV7uNRjr4CFTl
TLSH
T1F5F4BE31FAB4D022D67B0DB21B79C716183DBD604B614DCBE3A86A8D49702D22776F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader

File Explorer

2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader

.exe 749KB

2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader

IMPHASH 023408dbf6d3cd7e20eaafd16d0b11dc
SHA256 45ec964382c01152e565c42cf258b4430cf5941513464811e2e7137b126baa4c
MD5 92621a6f9ca90ed0d168e5a05029e787
SHA1 66e6a54237668833564aefbb832f32118f148ff6
SHA512 d97a54c7c5d002efcdbd218c5d27f49d299c7ace665c7e2773344927dbdee9ac159591448324384b0e776900afe6da8047fbfc9220da05322b756151bf13c1f3
SSDEEP 12288:ZNQvvFAwSfxL/2Dc3jDLLmt0LDQewsAjROCWV7q9zGImAjJdcH4j3ttzFdVCLNSR:bQGaewsAjaV7uNRjr4CFTl
TLSH
T1F5F4BE31FAB4D022D67B0DB21B79C716183DBD604B614DCBE3A86A8D49702D22776F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u421\1068\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb

user32

GetWindowThreadProcessId CloseDesktop OpenInputDesktop MessageBoxW wsprintfW GetShellWindow LoadStringW

kernel32

GlobalFree WideCharToMultiByte GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RaiseException GetEnvironmentVariableW GetLongPathNameW CloseHandle GetLastError FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW FormatMessageW VerSetConditionMask CreateFileW GetShortPathNameW GetTempPathW InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetCurrentProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo GetModuleHandleW GlobalAlloc MultiByteToWideChar LocalAlloc LocalFree lstrlenW VerifyVersionInfoW WTSGetActiveConsoleSessionId OutputDebugStringW GetCurrentProcessId GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysFreeString SysStringLen

vcruntime140

_except_handler4_common __std_exception_copy __CxxFrameHandler3 memset _CxxThrowException memcpy __current_exception __current_exception_context __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf_s _wfopen_s __stdio_common_vfwprintf_s fclose __stdio_common_vsnwprintf_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _wstat64i32 _wsplitpath_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _set_app_type _crt_atexit _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _errno _invalid_parameter_noinfo _controlfp_s _register_onexit_function _seh_filter_exe

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-environment-l1-1-0

_wdupenv_s _wputenv

api-ms-win-crt-string-l1-1-0

wcscat_s wcscpy_s wcsncpy_s _wcsicmp

api-ms-win-crt-time-l1-1-0

_ftime64_s wcsftime _localtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_92621a6f9ca90ed0d168e5a05029e787_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader

user32

kernel32

ole32

oleaut32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic