2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 36.1MB
Sample260710-pyay2sbx4j
SHA256 703f466285030db5702e51ad5dcf021fa0d293707a883ee6fea5a5ac567ec698
MD5 a79483b7403ebfc89f301b51c56683a1
SHA1 ff24b09cd08bc971848740597c832764a4ae2a5d
SHA512 47fb450883f0edb2cddac01a1c19a4cfcb22e7ef861ec73afc06a0751ef26a695cebec9b31a90affb591ddc4acec9cd7cedac3dfbabf526eebd280a9804389c2
SSDEEP 786432:qR+RGye41ApiJfgutD4R3W7k403p+Ty2SfUfnkTIInIm:FxegApiJfgutMR3lR3p+Ty2SfWnkPIm
TLSH
T13E873323BBE8C03BC66301305D5AD37997B5BD205B32899BA3987F1E1F711C26676B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 36.1MB

2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 7f94f21db9416755a50f9c7bcccb4e3f
SHA256 703f466285030db5702e51ad5dcf021fa0d293707a883ee6fea5a5ac567ec698
MD5 a79483b7403ebfc89f301b51c56683a1
SHA1 ff24b09cd08bc971848740597c832764a4ae2a5d
SHA512 47fb450883f0edb2cddac01a1c19a4cfcb22e7ef861ec73afc06a0751ef26a695cebec9b31a90affb591ddc4acec9cd7cedac3dfbabf526eebd280a9804389c2
SSDEEP 786432:qR+RGye41ApiJfgutD4R3W7k403p+Ty2SfUfnkTIInIm:FxegApiJfgutMR3lR3p+Ty2SfWnkPIm
TLSH
T13E873323BBE8C03BC66301305D5AD37997B5BD205B32899BA3987F1E1F711C26676B06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

94:3a:ab:c5:e3:c7:bc:ea:3a:62:c0:a4:f1:bc:ed:95:e1:f0:3f:88

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Deep Sea Electronics LTD,O=Deep Sea Electronics LTD,L=Hunmanby,ST=North Yorkshire,C=GB

Chains

Jul 6, 2021

CN=Deep Sea Electronics LTD,O=Deep Sea Electronics LTD,L=Hunmanby,ST=North Yorkshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Deep Sea Electronics LTD,O=Deep Sea Electronics LTD,L=Hunmanby,ST=North Yorkshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Deep Sea Electronics LTD,O=Deep Sea Electronics LTD,L=Hunmanby,ST=North Yorkshire,C=GB

Serial Number

0a:5c:01:da:43:24:ca:76:c7:b1:d1:2e:dc:61:8a:f0

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2021 - Jun 24, 2024

Minor OS version

Major OS version

Entry point

547120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BranchAI\win\Release\stubs\x86u\ExternalUi.pdb

kernel32

GetLastError GetDriveTypeW CompareStringW lstrcmpiW lstrlenW FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleFileNameW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount GetModuleHandleA GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP HeapCreate ExitProcess GetModuleFileNameA LCMapStringW LCMapStringA LoadLibraryW GetStringTypeW RtlUnwind DeleteCriticalSection GetSystemTimeAsFileTime TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW IsDebuggerPresent UnhandledExceptionFilter GetLocaleInfoA VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy LoadLibraryA LocalAlloc PeekNamedPipe GetStdHandle TerminateProcess OpenProcess SearchPathW ConnectNamedPipe CreateNamedPipeW GetDiskFreeSpaceExW ResetEvent MoveFileW TerminateThread GetEnvironmentVariableW GetSystemDirectoryW OutputDebugStringW GlobalMemoryStatus GetUserDefaultLangID GetSystemDefaultLangID EnumResourceLanguagesW SetFilePointer CopyFileW SetCurrentDirectoryW GetVersion GetWindowsDirectoryW GetExitCodeProcess CreateProcessW GetLocaleInfoW InitializeCriticalSection GlobalUnlock GlobalLock GlobalAlloc lstrcmpW CreateFileW WriteFile CreateMutexW GetFileSize ReadFile GlobalFree GetTempPathW FindFirstFileW DeleteFileW InterlockedExchange WideCharToMultiByte GetModuleHandleW LoadLibraryExW MultiByteToWideChar FindClose CreateFileA GetFileAttributesW GetLogicalDriveStringsW FindNextFileW RemoveDirectoryW GetProcAddress FindResourceExW FindResourceW LoadResource LockResource SizeofResource CreateDirectoryW GetCurrentProcessId CloseHandle GetExitCodeThread SetEvent GetSystemTime FlushFileBuffers LocalFree FormatMessageW SetFileAttributesW GetShortPathNameW GetTempFileNameW GetCurrentThread CreateThread SetUnhandledExceptionFilter GetVersionExW WaitForSingleObject CreateEventW SetLastError FlushInstructionCache GetCurrentProcess Sleep RaiseException EnterCriticalSection GetCurrentThreadId LeaveCriticalSection GetCPInfo MulDiv

user32

SetFocus GetDC ReleaseDC GetWindowRect SendMessageW GetSysColorBrush IsWindowVisible IntersectRect EqualRect MapWindowPoints GetWindowLongW PtInRect IsRectEmpty SetRectEmpty GetClientRect ClientToScreen SetWindowPos OffsetRect GetSystemMetrics GetWindowTextW GetWindowTextLengthW DrawIconEx GetComboBoxInfo DrawFrameControl RegisterWindowMessageW CreateAcceleratorTableW InvalidateRgn GetDesktopWindow DestroyAcceleratorTable GetKeyState DrawTextExW DrawStateW ValidateRect DestroyMenu AppendMenuW CreatePopupMenu TrackPopupMenu InflateRect LoadBitmapW CharNextW DrawFocusRect GetClassNameW ReleaseCapture GetCapture SetCapture UpdateWindow GetDlgCtrlID SetScrollInfo GetScrollPos GetClassInfoExW RegisterClassExW SetScrollPos EndPaint FillRect SetRect BeginPaint MoveWindow GetScrollInfo ScreenToClient GetMessagePos GetSysColor RedrawWindow DestroyIcon SystemParametersInfoW GetActiveWindow TrackMouseEvent GetAsyncKeyState GetWindowDC KillTimer CreateWindowExW DestroyCursor DrawTextW CopyRect IsZoomed SetWindowRgn CreateDialogParamW EndDialog DialogBoxParamW GetNextDlgTabItem GetWindowRgn IsWindowEnabled SetCursor GetWindow MonitorFromWindow GetMonitorInfoW LoadImageW InvalidateRect IsDialogMessageW IsChild GetFocus PostQuitMessage IsWindow LoadStringW MessageBoxW PostMessageW SetForegroundWindow SetCursorPos GetCursorPos PeekMessageW GetMessageW TranslateMessage DispatchMessageW ShowWindow LoadCursorW GetParent GetForegroundWindow GetPropW MsgWaitForMultipleObjects GetSystemMenu ModifyMenuW FindWindowW ExitWindowsEx SetPropW RemovePropW EnableMenuItem LoadMenuW GetSubMenu SetTimer LoadIconW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData UnregisterClassA CallWindowProcW SetWindowLongW GetDlgItem SetWindowTextW DestroyWindow EnableWindow DefWindowProcW

gdi32

GetTextMetricsW ExtTextOutW SetBkColor GetWindowExtEx GetViewportExtEx SetMapMode GetMapMode CreateDIBSection CreateFontIndirectW GetObjectW CreateSolidBrush GetRgnBox EqualRgn CreatePolygonRgn CreateRectRgnIndirect GetStockObject GetBitmapBits ExcludeClipRect SelectClipRgn CreateRectRgn SetBkMode SetTextColor SetViewportOrgEx GetDeviceCaps SetBrushOrgEx CreatePatternBrush BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject CreateBitmapIndirect CreateFontW

advapi32

LookupPrivilegeValueW OpenProcessToken StartServiceW QueryServiceStatus OpenServiceW GetUserNameW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges OpenSCManagerW LockServiceDatabase UnlockServiceDatabase CloseServiceHandle RegOpenKeyW

shell32

ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetSpecialFolderLocation SHGetFileInfoW ShellExecuteW

ole32

CoGetClassObject CoCreateInstance CLSIDFromString OleInitialize CoUninitialize CoInitializeEx CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CoTaskMemFree CoInitialize CoTaskMemRealloc CLSIDFromProgID

oleaut32

SysAllocStringByteLen SysStringByteLen OleLoadPicture VarDateFromStr VarUI4FromStr SysAllocStringLen OleCreateFontIndirect VariantChangeType VariantCopy VariantInit VariantClear SysAllocString SysFreeString LoadTypeLi SysStringLen LoadRegTypeLi

dbghelp

SymInitialize StackWalk SymCleanup SymGetLineFromAddr SymGetSymFromAddr SymFunctionTableAccess SymSetOptions SymGetModuleBase

shlwapi

PathIsUNCW PathFileExistsW

comctl32

CreatePropertySheetPageW ImageList_ReplaceIcon ImageList_AddMasked ImageList_GetIcon ImageList_SetBkColor ImageList_LoadImageW InitCommonControlsEx DestroyPropertySheetPage PropertySheetW ImageList_Destroy ImageList_Create _TrackMouseEvent

msimg32

TransparentBlt

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comdlg32

GetOpenFileNameW GetSaveFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_a79483b7403ebfc89f301b51c56683a1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

shlwapi

comctl32

msimg32

version

comdlg32

generic