2026-07-27_775474b2c3de063cabf1fefcc92c53ba_amadey_darkgate_elex_hellokitty_manuscrypt

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_775474b2c3de063cabf1fefcc92c53ba_amadey_darkgate_elex_hellokitty_manuscrypt
Size 108KB
Sample260727-heaevaxcqd
SHA256 0d3d8816c7fed3acc0cadf11bb4058accf9c6768e0bde4bd221dc563b5b31183
MD5 775474b2c3de063cabf1fefcc92c53ba
SHA1 9a3cd98a0b914355c156f11c2a2213e97ba4f798
SHA512 59318ec3a7a568173adcea5578a67ac8a85a4cc00e6c5d3879e2e8e02c074ab1cbb0f3b400f3011e379196913f649035522afd1637c3a6a76412c17cc20c60c8
SSDEEP 3072:y0mTXuafO4VkCGn0m+IXYxNsyfMnYHjk4:LZBu9IIfKYHjn
TLSH
T1B4B37D2175E18472F9B209705CB4EFB6863DFD319F704ADB5398864A09392C25E32FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-27_775474b2c3de063cabf1fefcc92c53ba_amadey_darkgate_elex_hellokitty_manuscrypt

.exe 108KB

2026-07-27_775474b2c3de063cabf1fefcc92c53ba_amadey_darkgate_elex_hellokitty_manuscrypt

IMPHASH 2ce0782bf880ef9e8ce9d8a49acc53d9
SHA256 0d3d8816c7fed3acc0cadf11bb4058accf9c6768e0bde4bd221dc563b5b31183
MD5 775474b2c3de063cabf1fefcc92c53ba
SHA1 9a3cd98a0b914355c156f11c2a2213e97ba4f798
SHA512 59318ec3a7a568173adcea5578a67ac8a85a4cc00e6c5d3879e2e8e02c074ab1cbb0f3b400f3011e379196913f649035522afd1637c3a6a76412c17cc20c60c8
SSDEEP 3072:y0mTXuafO4VkCGn0m+IXYxNsyfMnYHjk4:LZBu9IIfKYHjn
TLSH
T1B4B37D2175E18472F9B209705CB4EFB6863DFD319F704ADB5398864A09392C25E32FA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

08:57:a4:00:de:83:1f:0d:81:66:28:f0:cc:64:ed:45:5a:be:3e:ee:36:48:59:de:43:9b:3b:2d:0b:29:8b:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 11, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

47632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\1\s\core-setup\Bin\obj\win-x86.Release\corehost\cli\exe\dotnet\Release\dotnet.pdb

kernel32

GetEnvironmentVariableW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetLastError GetCurrentProcess GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwind RaiseException InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetModuleHandleW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount

api-ms-win-crt-runtime-l1-1-0

exit _configure_wide_argv _initterm _exit __p___argc __p___wargv _errno _c_exit _set_app_type _seh_filter_exe terminate _register_thread_local_exe_atexit_callback _initterm_e _controlfp_s _invalid_parameter_noinfo_noreturn _get_initial_wide_environment abort _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_wide_environment _cexit

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh calloc malloc

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-stdio-l1-1-0

fputwc __acrt_iob_func __stdio_common_vsprintf_s __p__commode _set_fmode fflush __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp wcsnlen _wcsdup strcspn memset _wcsicmp strcpy_s

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func ___lc_locale_name_func __pctype_func _unlock_locales _lock_locales localeconv setlocale ___lc_codepage_func _configthreadlocale

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_775474b2c3de063cabf1fefcc92c53ba_amadey_darkgate_elex_hellokitty_manuscrypt

kernel32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic