General

  • Target
    2026-07-20_fbf9de1aa5f99eee94fe7d74b2716561_amadey_darkgate_elex_smoke-loader
  • Size 15.0MB
  • Sample260720-srjjdset4p
  • SHA256 f207e3ac3665cd69f81f9a0d6fb92e9afcf161b7087f5fdfa6d60ab6c4e93c62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Detects executables packed with VMProtect. 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • 2026-07-20_fbf9de1aa5f99eee94fe7d74b2716561_amadey_darkgate_elex_smoke-loader
    .exe 15.0MB

2026-07-20_fbf9de1aa5f99eee94fe7d74b2716561_amadey_darkgate_elex_smoke-loader

  • IMPHASH f630819bf7c877b4529bb4d3cb6bf165
  • SHA256 f207e3ac3665cd69f81f9a0d6fb92e9afcf161b7087f5fdfa6d60ab6c4e93c62
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects executables packed with VMProtect.

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
fb:03:85:6c:9a:42:de:0e:42:70:fb:76:4c:6c:8a:76:dc:b9:aa:21
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
Chains

Jan 1, 0001

Minor OS version
1
Major OS version
5
Entry point
14864930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\BuildAgent\work\e24c22475d51aa9b\Client\WindowsClient\Win32\Release\RobloxPlayerBetaRaw.pdb