2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader

General

Target
2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader
Size 1.3MB
Sample260718-a3ytcaex2w
SHA256 f1177db3dd349cd5ee57b5470f54d887e757e6b5557540306dbffcbf556bda28
MD5 e488c5f01111a734ec35e841c56ffb50
SHA1 b778737cd3b68d088a0758326560d25a09946de3
SHA512 a0d5eca0e6f8b2f917469093f31e13dce5322b69898a3c01283f66b08ebac2ffd73b3e826d782b2de77059f506559df96e244926a8da240930b1dc6e79ea951d
SSDEEP 24576:W5+t0pOdRFE6Ehg7mM+M6RkMkIM7gE6Eh67WGaewsAjud:teODv0g7mM+M6RkMkIM7I067cljg
TLSH
T1B0559E11F7A0D076D0B70A711B72D735167ABD604B100A9FB3A8BA5E6D303C26736E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader

File Explorer

2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader

.exe 1.3MB

2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader

IMPHASH 92f377bec2fd08bb16ed274dff1cdbcc
SHA256 f1177db3dd349cd5ee57b5470f54d887e757e6b5557540306dbffcbf556bda28
MD5 e488c5f01111a734ec35e841c56ffb50
SHA1 b778737cd3b68d088a0758326560d25a09946de3
SHA512 a0d5eca0e6f8b2f917469093f31e13dce5322b69898a3c01283f66b08ebac2ffd73b3e826d782b2de77059f506559df96e244926a8da240930b1dc6e79ea951d
SSDEEP 24576:W5+t0pOdRFE6Ehg7mM+M6RkMkIM7gE6Eh67WGaewsAjud:teODv0g7mM+M6RkMkIM7I067cljg
TLSH
T1B0559E11F7A0D076D0B70A711B72D735167ABD604B100A9FB3A8BA5E6D303C26736E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW GetModuleFileNameW SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW GetFileType SignalObjectAndWait CreateFileW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetModuleHandleExW SetLastError GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW TerminateProcess ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW HeapFree EncodePointer DecodePointer HeapAlloc HeapReAlloc IsProcessorFeaturePresent LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_e488c5f01111a734ec35e841c56ffb50_amadey_darkgate_elex_glassworm_hawkeye_maze_rhadamanthys_smoke-loader

kernel32

winmm

advapi32

generic