systex | 2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 376KB
Sample260803-ljpl4stdmd
SHA256 10e3ae93d19ea9f2e366d0ab6616afe51c3cdd3e0117526390d2c00a2ea41698
MD5 0c0b7d312e2702e9ffbb43df1b3d0398
SHA1 487df936dd2f5396aef59a29175ae9d7244fff5c
SHA512 44beb7f558795b4777e5edb291e0125347393e0a9e4e5a771c29e6f465ad5b03cb589306071b0fb19fa39dd4380d193d210dbd81f8d70e8de412f9d8845b0f60
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan systex

Malware Config

Extracted

Family

systex

C2

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 376KB

2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 52a948b5de7cc38ae8e6110ce48389ff
SHA256 10e3ae93d19ea9f2e366d0ab6616afe51c3cdd3e0117526390d2c00a2ea41698
MD5 0c0b7d312e2702e9ffbb43df1b3d0398
SHA1 487df936dd2f5396aef59a29175ae9d7244fff5c
SHA512 44beb7f558795b4777e5edb291e0125347393e0a9e4e5a771c29e6f465ad5b03cb589306071b0fb19fa39dd4380d193d210dbd81f8d70e8de412f9d8845b0f60
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameW CreateFileW MultiByteToWideChar GetLastError GetProcAddress Process32FirstW ReadFile Process32NextW CreateToolhelp32Snapshot WinExec CloseHandle DeleteFileW GetVersionExW Sleep LoadLibraryW WriteFile GetTickCount WaitForSingleObject GetCurrentProcess UnmapViewOfFile MapViewOfFile GetFileSize CreateFileA CreateFileMappingW ExitProcess GetFileAttributesA HeapFree HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA LCMapStringA WideCharToMultiByte GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateDirectoryA

advapi32

AdjustTokenPrivileges ChangeServiceConfigW StartServiceW LookupPrivilegeValueW RegCreateKeyExW OpenServiceW OpenSCManagerW OpenProcessToken CloseServiceHandle CreateServiceW RegSetValueExW

netapi32

NetUserDel

imagehlp

CheckSumMappedFile

Sharing