2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader
Size 604KB
Sample260729-nc6cdsseqh
SHA256 53e7c20886a5fce6eaa8e99df7f765300e6530ff799ab0ab364a92f860d3fe72
MD5 268de36fd87785a06066205a8e54baa4
SHA1 952dc26c5fd909ff11ecced369d85f069d8e878f
SHA512 9aa6877db5820be71355515a1b6a0b3d103cd06f6fa68556d9f758790aeb163c35dd419f5dda44879319e9543d758b5e2a5985964a49be224b68cbe8ee9cbab1
SSDEEP 12288:zUN3atQPLTNlO5myAYENleRDGo5bxExoglseXj:vQPNg5mZYENleRDGoNxEjrXj
TLSH
T13ED48F16E155F277E16B49F2259BA3322078BF74622AD413BF44CF1AAB706F0923570B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader

File Explorer

2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader

.exe 604KB

2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader

IMPHASH aecd24e51502ded29f286cb2eb4c1ac3
SHA256 53e7c20886a5fce6eaa8e99df7f765300e6530ff799ab0ab364a92f860d3fe72
MD5 268de36fd87785a06066205a8e54baa4
SHA1 952dc26c5fd909ff11ecced369d85f069d8e878f
SHA512 9aa6877db5820be71355515a1b6a0b3d103cd06f6fa68556d9f758790aeb163c35dd419f5dda44879319e9543d758b5e2a5985964a49be224b68cbe8ee9cbab1
SSDEEP 12288:zUN3atQPLTNlO5myAYENleRDGo5bxExoglseXj:vQPNg5mZYENleRDGoNxEjrXj
TLSH
T13ED48F16E155F277E16B49F2259BA3322078BF74622AD413BF44CF1AAB706F0923570B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA DeleteFileW CreateFileW SetFilePointer SetFilePointerEx GetTempPathW GetFileSize GetCommandLineW GetTickCount ReleaseMutex SetCurrentDirectoryW SystemTimeToFileTime CreateFileMappingW VirtualQuery UnmapViewOfFile Sleep CreateThread GetLocaleInfoW WideCharToMultiByte GlobalFree lstrcpynW FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc RtlUnwind GetCurrentProcessId QueryPerformanceCounter GetFileType InterlockedIncrement GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange GetConsoleCP GetConsoleMode LCMapStringW SetStdHandle WriteConsoleW ReadFile InterlockedDecrement GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary lstrcmpiW GetLastError SetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection SetHandleCount lstrlenW FlushFileBuffers CloseHandle

user32

GetClassNameW GetDlgItem SetFocus IsChild EndPaint FillRect BeginPaint RegisterWindowMessageW RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SendMessageW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow MsgWaitForMultipleObjects PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW GetWindowLongW DefWindowProcW CreateWindowExW DestroyWindow LoadCursorW GetClassInfoExW RegisterClassExW SetTimer KillTimer SetWindowLongW GetSysColor UnregisterClassA

gdi32

GetStockObject GetDeviceCaps GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CLSIDFromString CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VarUI4FromStr OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysStringLen VariantCopy LoadRegTypeLi

shlwapi

PathFileExistsW

Name

.text

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_268de36fd87785a06066205a8e54baa4_amadey_darkgate_elex_smoke-loader

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

shlwapi

generic