2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop
Size 1.5MB
Sample260722-3f9xbade37
SHA256 9f4821e7af91a8a3c9b414ad58d5504513560052d3091af22f282ea77b20ccc8
MD5 a5645f6701150c90e9d5c7e902ac2d64
SHA1 326f61c383dfdd89818ac758c37fe4e5e7629206
SHA512 5157472d083377d9bc4d3be9e6c754359fcd48519fdc487fb50a377f5358d44a65b4d94342f9d6ae6a875023c675e4421126901773b2b3df3a18010ca7aacfc8
SSDEEP 12288:k/ZfvoRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4fvoRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E752335B288C0B2D4621574C5ADE66A581B7D219B3444C3BB992AFFBFB02D04F39367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 1.5MB

2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 8abbf1d35b1e2d3c19bc4cc4fce34a6c
SHA256 9f4821e7af91a8a3c9b414ad58d5504513560052d3091af22f282ea77b20ccc8
MD5 a5645f6701150c90e9d5c7e902ac2d64
SHA1 326f61c383dfdd89818ac758c37fe4e5e7629206
SHA512 5157472d083377d9bc4d3be9e6c754359fcd48519fdc487fb50a377f5358d44a65b4d94342f9d6ae6a875023c675e4421126901773b2b3df3a18010ca7aacfc8
SSDEEP 12288:k/ZfvoRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4fvoRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E752335B288C0B2D4621574C5ADE66A581B7D219B3444C3BB992AFFBFB02D04F39367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\SVN\SmartDefrag\SD5 Engine\sdcore\Release\sdproxy.pdb

kernel32

lstrlenA GetFileAttributesW GetModuleFileNameW MultiByteToWideChar GetTempPathW LocalFree ExpandEnvironmentStringsW WaitForSingleObject GetPrivateProfileIntW DeleteFileW ResumeThread CreateMutexW GetLastError CloseHandle TransactNamedPipe ResetEvent SetEvent WaitForMultipleObjects WaitNamedPipeW SetStdHandle WriteConsoleW SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSection CreateSemaphoreW RtlCaptureContext CreateFileW VirtualQueryEx ExitThread GetCurrentThreadId CreateThread MoveFileW GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc IsProcessorFeaturePresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError InterlockedDecrement GetProcAddress ExitProcess Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection RtlUnwind HeapSize LoadLibraryW HeapReAlloc LCMapStringW GetStringTypeW ReleaseSemaphore GetProcessId SetNamedPipeHandleState

user32

SendMessageW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

sdcore

SDAPI_CreateResultList SDAPI_SaveResultList SDAPI_SetConfigPath SDAPI_SetCallbackFunc SDAPI_SetMaxMemorySize SDAPI_DeleteResultList SDAPI_GetFragmentInfo SDAPI_Defrag

dataexchange

DCAPI_GetNotifyMsg DCAPI_SetCurrentPos DCAPI_SetFragmentInfo DCAPI_SetMapCellInfo DCAPI_GetNotifyWnd DCAPI_SetCurrentPath

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_a5645f6701150c90e9d5c7e902ac2d64_amadey_darkgate_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

shell32

sdcore

dataexchange

generic