2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader
Size 2.1MB
Sample260709-rxqdfscs2l
SHA256 c38c0b50a664b43144f1705078d3156fc06e4e7f99d9b21e891d9742961ca7d9
MD5 b04c0f8b9c21cc69d6e33587d7a353da
SHA1 b8f5bcd93e7fcd281a79e3044fa89231ddc33db2
SHA512 37b8af2c462bb4241437402faad7ace2bdeb1fea7faa58139a23b074cec71bbd976a878b961f52c4c974e52645e99025ccb4b4af888452d055cfc87aea6b918f
SSDEEP 24576:7Cq/QSyHWvWL0vbcCqnstLyUktHIiLynAXIR8RL:7C552A0vbFqnstLet3LyGIR8x
TLSH
T1A1A591206AFF5722DC74F5309F7C869804647E549EE1C62AB690F66DE43B029783F623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader

File Explorer

2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader

.exe 2.1MB

2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader

IMPHASH 29b19f1d3e5b9a9966989b673eea4782
SHA256 c38c0b50a664b43144f1705078d3156fc06e4e7f99d9b21e891d9742961ca7d9
MD5 b04c0f8b9c21cc69d6e33587d7a353da
SHA1 b8f5bcd93e7fcd281a79e3044fa89231ddc33db2
SHA512 37b8af2c462bb4241437402faad7ace2bdeb1fea7faa58139a23b074cec71bbd976a878b961f52c4c974e52645e99025ccb4b4af888452d055cfc87aea6b918f
SSDEEP 24576:7Cq/QSyHWvWL0vbcCqnstLyUktHIiLynAXIR8RL:7C552A0vbFqnstLet3LyGIR8x
TLSH
T1A1A591206AFF5722DC74F5309F7C869804647E549EE1C62AB690F66DE43B029783F623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36045

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\setupexe\x86\ship\0\deployca\odeploy.pdb

advapi32

CloseServiceHandle QueryServiceStatusEx OpenServiceW OpenSCManagerW RegOpenKeyExW RegCreateKeyExW FreeSid AllocateAndInitializeSid ImpersonateLoggedOnUser RevertToSelf CreateProcessAsUserW RegFlushKey RegCloseKey

kernel32

WaitForSingleObject GetTickCount CreateFileW GetLastError SleepEx CompareFileTime GetSystemTimeAsFileTime SetErrorMode GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId EnterCriticalSection LeaveCriticalSection FreeLibrary LoadLibraryA InitializeCriticalSection Sleep GetCPInfo GetACP GetOEMCP VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode HeapSize MultiByteToWideChar GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers GetTimeZoneInformation CreateFileA CloseHandle CompareStringA CompareStringW SystemTimeToTzSpecificLocalTime GetSystemTime GetVersion ExpandEnvironmentStringsW LocalFree FormatMessageW FindClose FindFirstFileW lstrlenA GetFileAttributesW SetFileAttributesW DeleteFileW GetExitCodeProcess GetModuleFileNameW CreateProcessW GetPriorityClass GetTempPathW GetModuleHandleW OpenMutexW GetCommandLineW GlobalFree InitializeCriticalSectionAndSpinCount LoadLibraryExW

ole32

CoInitializeEx CoUninitialize

shell32

SHCreateDirectoryExW CommandLineToArgvW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

msi

ord177

secur32

GetUserNameExW

dbghelp

SymGetLineFromAddr64 SymInitialize SymGetSymFromAddr64

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_b04c0f8b9c21cc69d6e33587d7a353da_darkgate_elex_karagany_rhadamanthys_smoke-loader

advapi32

kernel32

ole32

shell32

version

msi

secur32

dbghelp

generic