2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader
Size 416KB
Sample260717-1dfvcaav4x
SHA256 df5c00fd170ed2209e9d544dfb6a788a9376ff12e1e5bc6eacf40ecaae937314
MD5 af8cddde3f23f05add6494e404b9b7bb
SHA1 c29ba5f84b96d05c3ef94a88a53249cf49f3a572
SHA512 82e6150f2d53aab76712c354dbc46658392b45c59e117056ae82b1492cdd9a5c60dec96e2c9485ea68b8ba61dbb3fc9611169696496541086defe1772448b5f8
SSDEEP 6144:U06HK3WzBIQTLxZUXprUu918Jtv/nowT88WXKwBoWBV+UdvrEFp7hKsWI:UPXzBIQTLApU018Xv/p9KoWBjvrEH77
TLSH
T19794AF12779086F5C5A205333E18AB119AFDBA798F7656C7F3D40A4C8F781D2A638B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader

File Explorer

2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader

.exe 416KB

2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader

IMPHASH 5ec9bba5013c8edc8b56c89d6632671a
SHA256 df5c00fd170ed2209e9d544dfb6a788a9376ff12e1e5bc6eacf40ecaae937314
MD5 af8cddde3f23f05add6494e404b9b7bb
SHA1 c29ba5f84b96d05c3ef94a88a53249cf49f3a572
SHA512 82e6150f2d53aab76712c354dbc46658392b45c59e117056ae82b1492cdd9a5c60dec96e2c9485ea68b8ba61dbb3fc9611169696496541086defe1772448b5f8
SSDEEP 6144:U06HK3WzBIQTLxZUXprUu918Jtv/nowT88WXKwBoWBV+UdvrEFp7hKsWI:UPXzBIQTLApU018Xv/p9KoWBjvrEH77
TLSH
T19794AF12779086F5C5A205333E18AB119AFDBA798F7656C7F3D40A4C8F781D2A638B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e7:9b:43:7a:df:39:14:c6:00:f8:34:94:35:18:08:8d:da:3a:89:65:9e:72:e0:98:63:6a:93:d1:d0:de:1f:e9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=114-87-13936,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Feb 15, 2022

SERIALNUMBER=114-87-13936,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

bd:56:96:17:90:e1:db:e6:e8:fc:72:e7:a9:d4:4a:d7:dc:dd:5a:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=114-87-13936,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Feb 15, 2022

SERIALNUMBER=114-87-13936,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=114-87-13936,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

0c:0e:fe:aa:58:14:0c:1b:10:99:19:df:98:f5:41:3a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2020 - Nov 1, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

118324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadConsoleInputA SetConsoleMode ReadConsoleW GetStdHandle GetConsoleCP GetSystemTimeAsFileTime ExitProcess GetModuleHandleExW AreFileApisANSI RtlUnwind RaiseException IsDebuggerPresent IsProcessorFeaturePresent HeapSize HeapQueryInformation CreateDirectoryW GetVolumeInformationA CreateFileW IsValidCodePage GetFileType InitOnceExecuteOnce GetStartupInfoW SetStdHandle SetFilePointerEx WriteConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetTimeZoneInformation QueryPerformanceCounter GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW GetConsoleMode GetDateFormatEx CompareStringEx LCMapStringEx GetStringTypeW SetEnvironmentVariableA SetEndOfFile GetFullPathNameA FindFirstFileA FindClose GetCPInfo GetOEMCP DeleteFileA GlobalFlags InterlockedIncrement WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection FileTimeToSystemTime DecodePointer EncodePointer GetFileAttributesExA FileTimeToLocalFileTime GetTimeFormatEx InterlockedDecrement GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA LoadLibraryW LoadLibraryA lstrcmpW GetProcAddress GetModuleHandleW GetModuleFileNameW GetVersion DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetFileAttributesW SetErrorMode FormatMessageA LocalFree GlobalFree GlobalUnlock SetLastError GetLocaleInfoEx GetThreadPreferredUILanguages CompareStringA ApplicationRecoveryFinished ApplicationRecoveryInProgress RegisterApplicationRestart RegisterApplicationRecoveryCallback lstrcmpA GlobalDeleteAtom GlobalLock GlobalAlloc LoadLibraryExW FreeLibrary GetCurrentThreadId GetCurrentThread InterlockedExchange GetACP CreateEventA SetEvent TerminateProcess GetModuleFileNameA Sleep CreateNamedPipeA FlushFileBuffers ReadFile WriteFile ConnectNamedPipe GetCurrentDirectoryA GetCurrentProcessId ReleaseMutex CreateMutexA WaitForSingleObject CreateThread HeapReAlloc CloseHandle GetVersionExA CreateToolhelp32Snapshot ProcessIdToSessionId Process32Next MultiByteToWideChar OpenProcess GetProcessHeap Process32First HeapFree GetCurrentProcess HeapAlloc WinExec GetModuleHandleA LockResource GetLastError GetConsoleWindow SizeofResource WideCharToMultiByte GetCommandLineA LoadResource FindResourceW InitializeCriticalSectionEx

user32

ReleaseDC GetDC TabbedTextOutA GrayStringA DrawTextExA DrawTextA InvalidateRect KillTimer SetTimer RealChildWindowFromPoint ClientToScreen SetCursor LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetCursorPos GetActiveWindow TranslateMessage GetMessageA SetWindowTextA IsWindowEnabled ShowWindow GetMonitorInfoA MonitorFromWindow WinHelpA LoadIconW LoadIconA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetLastActivePopup GetTopWindow GetClassNameA GetClassLongA SetWindowLongA CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxA AdjustWindowRectEx GetWindowRect RemovePropA GetPropA SetPropA RedrawWindow ValidateRect SetForegroundWindow GetSystemMetrics GetSysColorBrush LoadCursorA DestroyMenu CharUpperA GetForegroundWindow UpdateWindow SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsWindowVisible SetWindowPos DestroyWindow IsWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos PeekMessageA DispatchMessageA RegisterWindowMessageA GetWindowLongA GetWindowTextA SendMessageA GetMenuItemCount GetMenuItemID GetSubMenu PostQuitMessage PostMessageA GetParent GetWindowThreadProcessId GetWindow GetClientRect PtInRect

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutA TextOutA PtVisible SetMapMode SelectObject SaveDC RestoreDC RectVisible GetDeviceCaps SetBkColor SetTextColor CreateBitmap DeleteObject DeleteDC Escape GetClipBox GetStockObject

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

OpenSCManagerA GetTokenInformation GetUserNameA CheckTokenMembership CreateWellKnownSid RegEnumValueA RegQueryValueA RegEnumKeyA RegDeleteValueA RegOpenKeyExA AdjustTokenPrivileges DuplicateTokenEx LookupPrivilegeValueA SetTokenInformation CreateProcessAsUserA ControlService OpenProcessToken SetServiceStatus RegisterServiceCtrlHandlerExA StartServiceA CreateServiceA DeleteService StartServiceCtrlDispatcherA CloseServiceHandle OpenServiceA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegDeleteKeyA RegQueryValueExA RegSetValueExA

shell32

ord680 SHGetKnownFolderPath SHGetSpecialFolderPathA

shlwapi

PathFindFileNameA PathIsUNCA PathStripToRootA PathFindExtensionA

ole32

CoCreateGuid CoUninitialize CoTaskMemFree CoCreateInstance CoInitialize

oleaut32

SysFreeString SysAllocStringLen VariantInit VariantClear VariantChangeType

httpapi

HttpSendResponseEntityBody HttpSendHttpResponse HttpRemoveUrl HttpAddUrl HttpReceiveHttpRequest HttpTerminate HttpCreateHttpHandle HttpDeleteServiceConfiguration HttpSetServiceConfiguration HttpInitialize HttpReceiveRequestEntityBody

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertDeleteCertificateFromStore

cryptui

CryptUIWizImport

ws2_32

inet_addr htons

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_af8cddde3f23f05add6494e404b9b7bb_amadey_darkgate_elex_floxif_silence_smoke-loader

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

httpapi

wtsapi32

userenv

crypt32

cryptui

ws2_32

oleacc

generic