2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader

General

Target
2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader
Size 8.0MB
Sample260710-qqpb5sat3n
SHA256 8a7847d773e2dd11207799e2a4af963921566c7868d5de1f34ebd8c0ce32f79d
MD5 7e0630aadc2dde2e80c110fb9aa0743f
SHA1 936fcabca000edd8dee3383458389fe589c1a7f3
SHA512 6c72c3585b3f11cbe89560cd73e38d6928353d221f9e3e61d1da9599c78a5f3d570c4a26a1598beb98e2f4ead354168cd1800126fa47d72e2c271d1c21e99777
SSDEEP 98304:c6IWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOewb:NgDyw2WHOuCRUOZb
TLSH
T13886AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader

.exe 8.0MB

2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader

IMPHASH 9158747dc6240279afce84ac4d726c82
SHA256 8a7847d773e2dd11207799e2a4af963921566c7868d5de1f34ebd8c0ce32f79d
MD5 7e0630aadc2dde2e80c110fb9aa0743f
SHA1 936fcabca000edd8dee3383458389fe589c1a7f3
SHA512 6c72c3585b3f11cbe89560cd73e38d6928353d221f9e3e61d1da9599c78a5f3d570c4a26a1598beb98e2f4ead354168cd1800126fa47d72e2c271d1c21e99777
SSDEEP 98304:c6IWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOewb:NgDyw2WHOuCRUOZb
TLSH
T13886AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-18970417\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtProtectVirtualMemory NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrUnloadDll RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader

kernel32

user32

ntdll

generic