2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader
Size 604KB
Sample260730-lzef3sfd63
SHA256 fc93395805878d2d4a52ddb7d55e3a6283cc36b2f414ec91dad02b3f5459179b
MD5 6ea0f8266a1bf920e8dfd6c6d5b7b22c
SHA1 20bb77da30ad5842e6892f2ec07ab19a1e950043
SHA512 126630891733512da599da2bc29de865eea1dcde00d3d363273a21f3abe61dda26f788efbb433c88f167bdd242594d9313c4cc98e19d7b9a4c7762a86c4e5808
SSDEEP 12288:TUN3/tQPLTNlK5myAvENleRDro5bxExoglseX6:uQPNI5mZvENleRDroNxEjrX6
TLSH
T165D48E56E155F277E1AB09F2269BA37220787F386226D413BF84CF1AAB706F0513570B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader

File Explorer

2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader

.exe 604KB

2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader

IMPHASH aecd24e51502ded29f286cb2eb4c1ac3
SHA256 fc93395805878d2d4a52ddb7d55e3a6283cc36b2f414ec91dad02b3f5459179b
MD5 6ea0f8266a1bf920e8dfd6c6d5b7b22c
SHA1 20bb77da30ad5842e6892f2ec07ab19a1e950043
SHA512 126630891733512da599da2bc29de865eea1dcde00d3d363273a21f3abe61dda26f788efbb433c88f167bdd242594d9313c4cc98e19d7b9a4c7762a86c4e5808
SSDEEP 12288:TUN3/tQPLTNlK5myAvENleRDro5bxExoglseX6:uQPNI5mZvENleRDroNxEjrX6
TLSH
T165D48E56E155F277E1AB09F2269BA37220787F386226D413BF84CF1AAB706F0513570B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA DeleteFileW CreateFileW SetFilePointer SetFilePointerEx GetTempPathW GetFileSize GetCommandLineW GetTickCount ReleaseMutex SetCurrentDirectoryW SystemTimeToFileTime CreateFileMappingW VirtualQuery UnmapViewOfFile Sleep CreateThread GetLocaleInfoW WideCharToMultiByte GlobalFree lstrcpynW FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc RtlUnwind GetCurrentProcessId QueryPerformanceCounter GetFileType InterlockedIncrement GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange GetConsoleCP GetConsoleMode LCMapStringW SetStdHandle WriteConsoleW ReadFile InterlockedDecrement GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary lstrcmpiW GetLastError SetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection SetHandleCount lstrlenW FlushFileBuffers CloseHandle

user32

GetClassNameW GetDlgItem SetFocus IsChild EndPaint FillRect BeginPaint RegisterWindowMessageW RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SendMessageW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow MsgWaitForMultipleObjects PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW GetWindowLongW DefWindowProcW CreateWindowExW DestroyWindow LoadCursorW GetClassInfoExW RegisterClassExW SetTimer KillTimer SetWindowLongW GetSysColor UnregisterClassA

gdi32

GetStockObject GetDeviceCaps GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CLSIDFromString CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VarUI4FromStr OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysStringLen VariantCopy LoadRegTypeLi

shlwapi

PathFileExistsW

Name

.text

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_6ea0f8266a1bf920e8dfd6c6d5b7b22c_amadey_darkgate_elex_smoke-loader

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

shlwapi

generic