2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 26.0MB
Sample260720-l4gr1ad18m
SHA256 24412b7a0c5a101b57012ae36c38356da3f5639590f6293611ab4dd4cb6c2742
MD5 3c9a8370bb28141ab9c71af543d4a76d
SHA1 35194fa5856744cf84b866dc3c430c6b06586c86
SHA512 223b105dc5afaba3fd7cbc84106d96e80bb7227f79609e6810105a4175bec329bde2eaf6fd2d4d70a47e4ad74bd2eef50620017c434a36803308e0e519995646
SSDEEP 786432:Tb80b4sC3nq5l0wSA3RseGsdOedFA7RdtF:TbD473nP2RseGUFU9
TLSH
T1A557331696E4C1A2E310D0750063F3198925BDB91BB1E6F7E79A3D3ADE782D1233D12B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 26.0MB

2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 54998152ee3f5b795ec318ddb7b72dc1
SHA256 24412b7a0c5a101b57012ae36c38356da3f5639590f6293611ab4dd4cb6c2742
MD5 3c9a8370bb28141ab9c71af543d4a76d
SHA1 35194fa5856744cf84b866dc3c430c6b06586c86
SHA512 223b105dc5afaba3fd7cbc84106d96e80bb7227f79609e6810105a4175bec329bde2eaf6fd2d4d70a47e4ad74bd2eef50620017c434a36803308e0e519995646
SSDEEP 786432:Tb80b4sC3nq5l0wSA3RseGsdOedFA7RdtF:TbD473nP2RseGUFU9
TLSH
T1A557331696E4C1A2E310D0750063F3198925BDB91BB1E6F7E79A3D3ADE782D1233D12B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dd:2e:ca:f3:0e:e6:55:1a:f6:98:0a:10:6c:80:71:85:da:8f:11:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Chains

Sep 5, 2013

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Roman Svihalek,O=Roman Svihalek,POSTALCODE=10200,STREET=U dvojdomu 862/10,L=Praha 10 - Hostivar,ST=Praha,C=CZ

Serial Number

a6:e2:7c:fe:35:24:62:de:4e:83:ee:ea:83:9a:f7:30

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2012 - Sep 12, 2013

Minor OS version

0

Major OS version

5

Entry point

281874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Builds\Temporary\activitymon20\MSVC\Builds\x86\Release\Setup\selfex.pdb

comctl32

InitCommonControlsEx

kernel32

CloseHandle ReadFile MultiByteToWideChar GetACP WriteFile DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesW CreateProcessW WaitForSingleObject WideCharToMultiByte InitializeCriticalSection TerminateThread DeleteCriticalSection ResumeThread EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount QueryPerformanceCounter SetFilePointer GlobalMemoryStatus FreeLibrary GetProcAddress LoadLibraryA GetVersionExA FlushConsoleInputBuffer CompareStringW CompareStringA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA CreateFileW GetModuleFileNameW RemoveDirectoryW FindClose FindNextFileW OutputDebugStringW FindFirstFileW SetCurrentDirectoryW CreateDirectoryW GetCurrentProcessId DeleteFileW GetTempFileNameW GetLastError GetTempPathW GetCurrentDirectoryW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree GetConsoleCP GetConsoleMode ExitThread CreateThread GetStartupInfoW HeapReAlloc GetSystemTimeAsFileTime SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode RaiseException RtlUnwind CreateFileA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetModuleFileNameA VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess SetHandleCount GetStartupInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetModuleHandleA GetCPInfo GetOEMCP IsValidCodePage FlushFileBuffers SetEnvironmentVariableA

user32

MessageBoxA GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW SendMessageW SetWindowLongW GetWindowLongW GetDlgItem SetDlgItemTextW EndDialog SetTimer SetWindowPos GetSystemMetrics GetWindowRect DialogBoxParamW PostMessageW

advapi32

ReportEventA RegisterEventSourceA DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_3c9a8370bb28141ab9c71af543d4a76d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

comctl32

kernel32

user32

advapi32

generic