2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop
Size 448KB
Sample260804-246dcssfmc
SHA256 ec1ba72067fd92c4e23e673393b2d28c0815ef291a3997f9470e0c57f35484e6
MD5 37836d6be4672b0d01d04633b4a54028
SHA1 6c27a5b60f8c415c10f3d89760b360826b5ccd2a
SHA512 7db1dd922b4b5f36980fc99b65e03a4b23ddcdfee3ca0450f84ac78817d714ffdbc9350b895422147416156376285b8a8040ee670dad2bbdcfc690dc45f6c98f
SSDEEP 12288:0a3URwVcQcZ+X9Ktg4HpKIi7rzMO9UBjvrEH7bs:GqWZ+Xkq4HpKIFqerEH7Q
TLSH
T1B2A4BF1077D0C7B2D65225326856E73965F6AD3C4F2586C7A7802E6DAE3D3C29A3830F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop

File Explorer

2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop

.exe 448KB

2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop

IMPHASH 967c17497d1d22a2f6382a860e7a26a9
SHA256 ec1ba72067fd92c4e23e673393b2d28c0815ef291a3997f9470e0c57f35484e6
MD5 37836d6be4672b0d01d04633b4a54028
SHA1 6c27a5b60f8c415c10f3d89760b360826b5ccd2a
SHA512 7db1dd922b4b5f36980fc99b65e03a4b23ddcdfee3ca0450f84ac78817d714ffdbc9350b895422147416156376285b8a8040ee670dad2bbdcfc690dc45f6c98f
SSDEEP 12288:0a3URwVcQcZ+X9Ktg4HpKIi7rzMO9UBjvrEH7bs:GqWZ+Xkq4HpKIFqerEH7Q
TLSH
T1B2A4BF1077D0C7B2D65225326856E73965F6AD3C4F2586C7A7802E6DAE3D3C29A3830F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

28:33:d8:4d:f8:b6:a1:7d:8a:cd:aa:fa:0e:a8:8a:b6:74:47:01:54

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Jan 11, 2018

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 11, 2018 - Apr 11, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

116233

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Source\altools\common\alupdate\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

ExitThread GetStartupInfoW RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA IsDebuggerPresent GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW ProcessIdToSessionId lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess HeapFree DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CloseHandle TerminateThread WaitForSingleObject GetLastError GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource QueryPerformanceCounter SizeofResource

user32

GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetWindow GetCapture GetWindowRect GetWindowLongW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostQuitMessage PostMessageW LoadCursorW SetCursor WinHelpW LoadIconW RegisterWindowMessageW GetDlgCtrlID DestroyMenu ShowWindow

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shell32

ShellExecuteExW

shlwapi

PathFindExtensionW PathQuoteSpacesW PathFindFileNameW

oleaut32

VariantChangeType VariantInit VariantClear

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_37836d6be4672b0d01d04633b4a54028_amadey_darkgate_elex_floxif_rhadamanthys_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

userenv

generic