2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 723KB
Sample260728-lvlplatela
SHA256 80dc634c06c27d7d9d4863cedaa14b647a23c103f2da44afa733cc21bca6b54c
MD5 a1dd73f8af66812f39b19575accc5237
SHA1 72e9cc93f1832c2a8a1b588c8bd718392242b84c
SHA512 168f86fcae8e637682638da09056cad977f1fd5707498f0f38eeff210dded365c8670cc7a2dc0294709ce40ada697392046eb50fc602b2b8fe1b19cd48aa62ca
SSDEEP 12288:7Ub6gRu8fffozRBSnJg47CbEqAP2Z/xoL5dJZ04fnk/6o:7UbHffqwnJg4n2Z/xcbZfk3
TLSH
T1ACF45C01B754C07BC69232708E66D675D66BEC604F3146873FE03E6F6E782D29A39B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 723KB

2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH fe7333b0d52b24c148e6deb1f49e364e
SHA256 80dc634c06c27d7d9d4863cedaa14b647a23c103f2da44afa733cc21bca6b54c
MD5 a1dd73f8af66812f39b19575accc5237
SHA1 72e9cc93f1832c2a8a1b588c8bd718392242b84c
SHA512 168f86fcae8e637682638da09056cad977f1fd5707498f0f38eeff210dded365c8670cc7a2dc0294709ce40ada697392046eb50fc602b2b8fe1b19cd48aa62ca
SSDEEP 12288:7Ub6gRu8fffozRBSnJg47CbEqAP2Z/xoL5dJZ04fnk/6o:7UbHffqwnJg4n2Z/xcbZfk3
TLSH
T1ACF45C01B754C07BC69232708E66D675D66BEC604F3146873FE03E6F6E782D29A39B06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f9:d2:e9:d5:24:ab:09:98:0f:43:01:7e:34:9a:91:5b:a1:f6:c4:01:c1:3b:ed:da:e6:8c:c8:64:15:43:b9:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Dec 17, 2013

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

PE Signature issue

Digest

38:80:dd:d7:fa:00:bb:a3:bb:7b:4e:8f:8d:7f:a7:cb:98:03:57:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Dec 17, 2013

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2011 - Sep 1, 2014

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Pikachu Time Sub CA,OU=Pikachu Certification Authority,O=Pikachu Trust Network CA,C=CN,2.5.4.13=#0c29e79aaee58da1e4b898e697b6e997b4e688b3e7adbee7bdb2e4b8ade997b44341e5ad90e8af81e4b9a6,2.5.4.13=#131c50696b616368752054696d65205369676e6e696e6720537562204341,1.2.840.113549.1.9.1=#0c1274696d6563614063657274732e75732e6b67

Serial Number

13:eb:7d:76:5d:e6:a4:d2

Issuer

CN=Pikachu Test CA RSA,OU=Pikachu Certification Authority,O=Pikachu Trust Network CA,C=CN,2.5.4.13=#0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a620525341,2.5.4.13=#131c50696b61636875205075626c6963205465737420526f6f7420525341,1.2.840.113549.1.9.1=#0c127465737463614063657274732e75732e6b67

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2000 - Dec 31, 2099

Minor OS version

Major OS version

Entry point

211235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Programing\7、Others[Ring3]\A1SysTest\Release\A1SysTest.pdb

kernel32

ExitProcess HeapReAlloc RaiseException HeapSize VirtualProtect VirtualAlloc VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA HeapFree HeapAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW GetComputerNameW GetFileTime GetFileSizeEx GetFileAttributesW SetErrorMode lstrlenA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale FindNextFileW GetModuleHandleA GetTickCount InterlockedDecrement GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA CopyFileW MulDiv GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW FreeResource GlobalFree GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW CompareStringA MultiByteToWideChar WideCharToMultiByte InterlockedExchange lstrcmpW GetCurrentProcess GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExW GlobalSize GlobalUnlock GlobalLock GlobalAlloc LocalFree LocalSize lstrlenW LocalAlloc FormatMessageW QueryDosDeviceW CloseHandle DeviceIoControl CreateFileW FindClose FindFirstFileW FreeLibrary GetVersionExW Sleep WaitForSingleObject CreateThread GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError FindResourceW LoadResource LockResource SizeofResource LCMapStringW

user32

PostThreadMessageW UnregisterClassW GetSysColorBrush MessageBeep GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW SetRect IsRectEmpty CharNextW LoadCursorW WindowFromPoint DestroyMenu IsClipboardFormatAvailable CharUpperW EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW TabbedTextOutW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx ScreenToClient EqualRect RegisterWindowMessageW CallWindowProcW EnableWindow LoadIconW GetDlgCtrlID DefWindowProcW GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetMenuItemID GetMenuItemCount GetWindowThreadProcessId GetLastActivePopup SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW IsWindowVisible PeekMessageW ValidateRect SetMenuItemBitmaps SendMessageW GetClientRect GetWindowRect SetWindowLongW IsIconic GetSystemMetrics DrawIcon EnableMenuItem MessageBoxW RedrawWindow PostMessageW FillRect DrawTextW GetSysColor SetCaretPos ShowCaret DestroyCaret SetScrollPos DragDetect SetCapture CreateCaret PtInRect SetScrollInfo EnableScrollBar ReleaseCapture GetKeyState LoadMenuW GetSubMenu RegisterClipboardFormatW EmptyClipboard SystemParametersInfoW InvalidateRect GetWindowLongW GetCursorPos PostQuitMessage SetWindowPos MapDialogRect GetParent SetWindowContextHelpId GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState CheckMenuItem ReleaseDC GetDC CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetWindow SendDlgItemMessageW

gdi32

GetMapMode GetRgnBox GetTextColor GetBkColor GetStockObject DeleteDC ExtSelectClipRgn CreateFontW ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CopyMetaFileW GetDeviceCaps CreateBitmap CreateRectRgnIndirect BitBlt TextOutW GetTextExtentPoint32W GetCharWidthW SetBoundsRect CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueExW OpenSCManagerW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW CloseServiceHandle RegCloseKey InitiateSystemShutdownExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken DeleteService ControlService StartServiceW CreateServiceW OpenServiceW

shell32

ShellExecuteW DragQueryFileW DragAcceptFiles

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW PathRemoveExtensionW PathFindFileNameW StrStrIA PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleFlushClipboard OleIsCurrentClipboard OleGetClipboard CoInitializeEx CoCreateInstance CoUninitialize OleInitialize CoFreeUnusedLibraries CoRevokeClassObject OleSetClipboard OleUninitialize OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CreateStreamOnHGlobal

oleaut32

SysFreeString SysAllocStringLen SysStringLen VariantClear VariantChangeType VariantInit OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy SysAllocString VariantCopy

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupOpenInfFileW SetupFindFirstLineW SetupGetStringFieldW SetupCloseInfFile SetupDiDestroyDeviceInfoList SetupDiDestroyClassImageList SetupDiGetClassImageList SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetClassImageIndex CM_Get_DevNode_Status SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiCallClassInstaller SetupDiRemoveDevice CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex SetupFindNextLine SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_a1dd73f8af66812f39b19575accc5237_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

newdev

setupapi

generic