2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader

General

Target
2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader
Size 1012KB
Sample260730-vghv8awvey
SHA256 d2ff4b22ee9b7773295db880429d054ff7caec4ca612de2aa1cc42fd56b6ed46
MD5 d02754a0bfd6cc456871b28d571dbf32
SHA1 1436ca022231982c436faf5beb10d3a532966ecd
SHA512 06e4c256a4c6968658ab6f02748d24c7c677a255dec9f1e58497407e6c526a11323bb34d451230dea38d0b6880795107830a4798d6268a23c9ef32efb98b2a65
SSDEEP 12288:MwOATJPv0AhS3NHm8DTWnBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwae:MwTdPObnWnB6mctvE/BT76+1NCE
TLSH
T10725BF9876625473C5B40AB05BB0FFD8423A4FF33F09219672433A6B7D79B42E91B096
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader

File Explorer

2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader

.exe 1012KB

2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader

IMPHASH b59c86b8cbac7eea0f14db3e6ac54f84
SHA256 d2ff4b22ee9b7773295db880429d054ff7caec4ca612de2aa1cc42fd56b6ed46
MD5 d02754a0bfd6cc456871b28d571dbf32
SHA1 1436ca022231982c436faf5beb10d3a532966ecd
SHA512 06e4c256a4c6968658ab6f02748d24c7c677a255dec9f1e58497407e6c526a11323bb34d451230dea38d0b6880795107830a4798d6268a23c9ef32efb98b2a65
SSDEEP 12288:MwOATJPv0AhS3NHm8DTWnBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwae:MwTdPObnWnB6mctvE/BT76+1NCE
TLSH
T10725BF9876625473C5B40AB05BB0FFD8423A4FF33F09219672433A6B7D79B42E91B096
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\Squirrel.Windows\Squirrel.Windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetFileAttributesW GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle MultiByteToWideChar WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader

kernel32

user32

generic