2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 736KB
Sample260708-q2exvahs7j
SHA256 64e80e5432a415e5cd59887d205157c23395bba62db7dd981818611994ef6833
MD5 0b8844b3f5f40fa2445b82cefc6b3c5c
SHA1 dd9aa1d73b7d3d078ef68909098ca2498ab3b47b
SHA512 e6df72dcbf9318be14396714747a8ef75b353fd3304b2206e2ac2f587b6e532d29564e5e72b6920546d9054f5d96c9973efb54a231147818e7597cc1549afdc9
SSDEEP 12288:pUb6gRu8fffozRBSnJg47CbEqAP2Z/xoL5dJZ04fnk/6J:pUbHffqwnJg4n2Z/xcbZfkC
TLSH
T17AF44C01B754C07BC29232718E66D675D66BEC604F3146873FE03E6F6E782D29A39B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 736KB

2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH fe7333b0d52b24c148e6deb1f49e364e
SHA256 64e80e5432a415e5cd59887d205157c23395bba62db7dd981818611994ef6833
MD5 0b8844b3f5f40fa2445b82cefc6b3c5c
SHA1 dd9aa1d73b7d3d078ef68909098ca2498ab3b47b
SHA512 e6df72dcbf9318be14396714747a8ef75b353fd3304b2206e2ac2f587b6e532d29564e5e72b6920546d9054f5d96c9973efb54a231147818e7597cc1549afdc9
SSDEEP 12288:pUb6gRu8fffozRBSnJg47CbEqAP2Z/xoL5dJZ04fnk/6J:pUbHffqwnJg4n2Z/xcbZfkC
TLSH
T17AF44C01B754C07BC29232718E66D675D66BEC604F3146873FE03E6F6E782D29A39B06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a6:0a:d9:1d:e3:3f:c4:b4:57:ea:46:65:8b:5d:2f:82:47:36:28:a3:a4:c1:5f:fb:bc:41:6e:07:60:ac:37:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Huizhou Ningda Times Supply Chain Co.\, Ltd.,O=Huizhou Ningda Times Supply Chain Co.\, Ltd.,L=Huizhou,ST=Guangdong,C=CN

Chains

May 14, 2026

CN=Huizhou Ningda Times Supply Chain Co.\, Ltd.,O=Huizhou Ningda Times Supply Chain Co.\, Ltd.,L=Huizhou,ST=Guangdong,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Huizhou Ningda Times Supply Chain Co.\, Ltd.,O=Huizhou Ningda Times Supply Chain Co.\, Ltd.,L=Huizhou,ST=Guangdong,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

04:44:c0

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 22, 2008 - Dec 31, 2029

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Huizhou Ningda Times Supply Chain Co.\, Ltd.,O=Huizhou Ningda Times Supply Chain Co.\, Ltd.,L=Huizhou,ST=Guangdong,C=CN

Serial Number

49:16:ad:68:d1:b4:ec:43:8e:b4:7b:6b:ee:0f:61:83

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

May 14, 2026

Timespan

Apr 24, 2026 - Apr 24, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

211235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Programing\7、Others[Ring3]\A1SysTest\Release\A1SysTest.pdb

kernel32

ExitProcess HeapReAlloc RaiseException HeapSize VirtualProtect VirtualAlloc VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA HeapFree HeapAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW GetComputerNameW GetFileTime GetFileSizeEx GetFileAttributesW SetErrorMode lstrlenA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale FindNextFileW GetModuleHandleA GetTickCount InterlockedDecrement GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA CopyFileW MulDiv GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW FreeResource GlobalFree GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW CompareStringA MultiByteToWideChar WideCharToMultiByte InterlockedExchange lstrcmpW GetCurrentProcess GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExW GlobalSize GlobalUnlock GlobalLock GlobalAlloc LocalFree LocalSize lstrlenW LocalAlloc FormatMessageW QueryDosDeviceW CloseHandle DeviceIoControl CreateFileW FindClose FindFirstFileW FreeLibrary GetVersionExW Sleep WaitForSingleObject CreateThread GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError FindResourceW LoadResource LockResource SizeofResource LCMapStringW

user32

PostThreadMessageW UnregisterClassW GetSysColorBrush MessageBeep GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW SetRect IsRectEmpty CharNextW LoadCursorW WindowFromPoint DestroyMenu IsClipboardFormatAvailable CharUpperW EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW TabbedTextOutW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx ScreenToClient EqualRect RegisterWindowMessageW CallWindowProcW EnableWindow LoadIconW GetDlgCtrlID DefWindowProcW GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetMenuItemID GetMenuItemCount GetWindowThreadProcessId GetLastActivePopup SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW IsWindowVisible PeekMessageW ValidateRect SetMenuItemBitmaps SendMessageW GetClientRect GetWindowRect SetWindowLongW IsIconic GetSystemMetrics DrawIcon EnableMenuItem MessageBoxW RedrawWindow PostMessageW FillRect DrawTextW GetSysColor SetCaretPos ShowCaret DestroyCaret SetScrollPos DragDetect SetCapture CreateCaret PtInRect SetScrollInfo EnableScrollBar ReleaseCapture GetKeyState LoadMenuW GetSubMenu RegisterClipboardFormatW EmptyClipboard SystemParametersInfoW InvalidateRect GetWindowLongW GetCursorPos PostQuitMessage SetWindowPos MapDialogRect GetParent SetWindowContextHelpId GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState CheckMenuItem ReleaseDC GetDC CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetWindow SendDlgItemMessageW

gdi32

GetMapMode GetRgnBox GetTextColor GetBkColor GetStockObject DeleteDC ExtSelectClipRgn CreateFontW ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CopyMetaFileW GetDeviceCaps CreateBitmap CreateRectRgnIndirect BitBlt TextOutW GetTextExtentPoint32W GetCharWidthW SetBoundsRect CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueExW OpenSCManagerW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW CloseServiceHandle RegCloseKey InitiateSystemShutdownExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken DeleteService ControlService StartServiceW CreateServiceW OpenServiceW

shell32

ShellExecuteW DragQueryFileW DragAcceptFiles

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW PathRemoveExtensionW PathFindFileNameW StrStrIA PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleFlushClipboard OleIsCurrentClipboard OleGetClipboard CoInitializeEx CoCreateInstance CoUninitialize OleInitialize CoFreeUnusedLibraries CoRevokeClassObject OleSetClipboard OleUninitialize OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CreateStreamOnHGlobal

oleaut32

SysFreeString SysAllocStringLen SysStringLen VariantClear VariantChangeType VariantInit OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy SysAllocString VariantCopy

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupOpenInfFileW SetupFindFirstLineW SetupGetStringFieldW SetupCloseInfFile SetupDiDestroyDeviceInfoList SetupDiDestroyClassImageList SetupDiGetClassImageList SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetClassImageIndex CM_Get_DevNode_Status SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiCallClassInstaller SetupDiRemoveDevice CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex SetupFindNextLine SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW

Name

.text

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

nw�U�uT

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_0b8844b3f5f40fa2445b82cefc6b3c5c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

newdev

setupapi

generic