2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader
Size 1.1MB
Sample260720-vr61sshs3r
SHA256 f5b7969f3b65d1a2429b62a313633b97c1f3bde175b8e6c13751d92bf258e41e
MD5 a1540971557d0258dfb29b043a3046ea
SHA1 7257ce5bce11a40ae748b1e9bcb2b570940d228c
SHA512 6f4412514dac5469f7c6edcd585ba6ee16ca1872bcfd0347887bf94a4f793a70d28c45bfb9fd2e103294ad3ce905df1beeedc7be66083e2f1cde7fb6916f8331
SSDEEP 24576:O00rBSzVNbUbHuDXigXzVgJFPd/MgsSy0TupQuu7rEH7K:YHuDyoLSy0TuyuuL
TLSH
T14C356D5037D4823AF2710A715DBC962A047EBEB94F3386CFA2D84A5D29749C15E32B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader

File Explorer

2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader

.exe 1.1MB

2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader

IMPHASH 266737338ded73b3108ba88ec52ba6fc
SHA256 f5b7969f3b65d1a2429b62a313633b97c1f3bde175b8e6c13751d92bf258e41e
MD5 a1540971557d0258dfb29b043a3046ea
SHA1 7257ce5bce11a40ae748b1e9bcb2b570940d228c
SHA512 6f4412514dac5469f7c6edcd585ba6ee16ca1872bcfd0347887bf94a4f793a70d28c45bfb9fd2e103294ad3ce905df1beeedc7be66083e2f1cde7fb6916f8331
SSDEEP 24576:O00rBSzVNbUbHuDXigXzVgJFPd/MgsSy0TupQuu7rEH7K:YHuDyoLSy0TuyuuL
TLSH
T14C356D5037D4823AF2710A715DBC962A047EBEB94F3386CFA2D84A5D29749C15E32B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0d:63:a1:47:49:11:0d:63:96:6f:5b:25:5a:6e:d5:c8:47:ed:6e:ad

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hewlett-Packard Company,OU=HP Cyber Security,O=Hewlett-Packard Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

Chains

Jun 3, 2016

CN=Hewlett-Packard Company,OU=HP Cyber Security,O=Hewlett-Packard Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Hewlett-Packard Company,OU=HP Cyber Security,O=Hewlett-Packard Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=Hewlett-Packard Company,OU=HP Cyber Security,O=Hewlett-Packard Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

Serial Number

34:2f:d1:43:10:8e:b1:fc:25:18:7e:f4:7e:44:88:27

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 10, 2015 - Jun 9, 2016

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

454722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\PROG\HPCASL\Release\hpqwmiex.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW CM_Get_DevNode_Status CM_Get_Sibling SetupDiOpenDeviceInfoW CM_Get_Child CM_Get_Parent CM_Locate_DevNodeW CM_Get_Device_IDW CM_Get_Device_ID_Size SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

kernel32

CreateTimerQueueTimer WaitForSingleObject GetCommandLineW CreateThread LocalFree lstrlenW FormatMessageW LoadLibraryW CreateTimerQueue GetExitCodeProcess IsDebuggerPresent OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime QueryPerformanceCounter CreateEventW ProcessIdToSessionId GetSystemPowerStatus LocalAlloc GetCurrentThread GetCurrentProcess SetEnvironmentVariableW GetCurrentProcessId K32GetProcessImageFileNameW OpenProcess K32EnumProcesses GetCurrentThreadId DeleteTimerQueue DecodePointer DeleteFileW CreateFileW GetModuleFileNameW LoadLibraryExW MultiByteToWideChar RaiseException lstrcmpiW FreeLibrary GetLocalTime LeaveCriticalSection EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionEx DeleteCriticalSection TerminateThread WaitForMultipleObjects SetEvent Sleep GetModuleHandleW GetProcAddress CloseHandle PulseEvent OpenEventW GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize SetEndOfFile HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetConsoleCP GetConsoleMode ReadFile ReadConsoleW CreateProcessW DeviceIoControl GetFirmwareEnvironmentVariableW GlobalFree GlobalAlloc ExpandEnvironmentStringsW VerifyVersionInfoW VerSetConditionMask MoveFileW QueryUnbiasedInterruptTime CreateMutexW GetFileType WriteFile GetStdHandle GetOEMCP GetACP IsValidCodePage GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc ReleaseMutex GetTempFileNameW GetFullPathNameW GetFileAttributesExW FindNextFileW FindFirstFileW FindClose CreateDirectoryW FlushFileBuffers WriteConsoleW SetStdHandle WideCharToMultiByte GetStringTypeW EncodePointer ExitThread ResumeThread IsProcessorFeaturePresent GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery RtlUnwind GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TerminateProcess SetFilePointerEx

user32

PostThreadMessageW CharNextW LoadStringW CharUpperW GetMessageW TranslateMessage UnregisterDeviceNotification RegisterDeviceNotificationW DispatchMessageW

advapi32

QueryServiceStatus EqualSid FreeSid CryptAcquireContextW DeregisterEventSource ReportEventW RegisterEventSourceW StartServiceW InitializeAcl GetAclInformation GetAce AddAce AddAccessAllowedAce SetSecurityDescriptorDacl CreateWellKnownSid OpenThreadToken OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner IsValidSid GetLengthSid CopySid SetSecurityDescriptorGroup InitializeSecurityDescriptor StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ChangeServiceConfigW DeleteService ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptDestroyKey CryptImportKey CryptCreateHash CryptHashData CryptDestroyHash CryptVerifySignatureW AllocateAndInitializeSid

ole32

CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeSecurity CoInitializeEx CoResumeClassObjects CoRevokeClassObject CoAddRefServerProcess CoReleaseServerProcess OleRun CLSIDFromString CoInitialize CoCreateInstance CoSetProxyBlanket CoDisconnectObject CoRegisterClassObject StringFromGUID2 CoTaskMemFree

shell32

CommandLineToArgvW SHGetFolderPathW SHCreateDirectoryExW

oleaut32

VarBstrCat SafeArrayDestroy SafeArrayGetElement SafeArrayPutElement SafeArrayCreateVector UnRegisterTypeLi RegisterTypeLi LoadTypeLi LoadRegTypeLi VarUI4FromStr VarCmp SysStringByteLen SysAllocStringByteLen SysAllocStringLen SysStringLen SysAllocString SysFreeString VariantCopy VariantClear VariantInit GetErrorInfo SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData

shlwapi

StrCmpNIW StrTrimW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_a1540971557d0258dfb29b043a3046ea_amadey_darkgate_elex_floxif_glassworm_maze_smoke-loader

PE Signature issue

setupapi

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

version

generic