2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader

General

Target
2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader
Size 8.0MB
Sample260715-s8cr6sbs8y
SHA256 823932e7fd469c77a6e1f712e4dbdf5b1e5d582158b7eec1b7ee7792ef9873c0
MD5 25e8e282dabb91ddc49ab54699e792d9
SHA1 563be87f3c0c49b27e81a507fc70f857728ea0b2
SHA512 21a8c66522466337d4f5935016f46b5cdce3a18c5b345ba56074b123e838573bd2cb67899084a3fdbaede21e250eef8f5098fdd67e85d153dc151f164403cf01
SSDEEP 98304:hiIWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOewqO:6gDyw2WHOuCRUOZqO
TLSH
T1F186AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader

.exe 8.0MB

2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader

IMPHASH 9158747dc6240279afce84ac4d726c82
SHA256 823932e7fd469c77a6e1f712e4dbdf5b1e5d582158b7eec1b7ee7792ef9873c0
MD5 25e8e282dabb91ddc49ab54699e792d9
SHA1 563be87f3c0c49b27e81a507fc70f857728ea0b2
SHA512 21a8c66522466337d4f5935016f46b5cdce3a18c5b345ba56074b123e838573bd2cb67899084a3fdbaede21e250eef8f5098fdd67e85d153dc151f164403cf01
SSDEEP 98304:hiIWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOewqO:6gDyw2WHOuCRUOZqO
TLSH
T1F186AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-18970417\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtProtectVirtualMemory NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrUnloadDll RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader

kernel32

user32

ntdll

generic