2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader

General

Target
2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader
Size 359KB
Sample260807-mdyhhawtes
SHA256 e74bb7bcb077275a66546c64f8eca189d95e379e251eec2b7fe38538119a8de1
MD5 1e6a3259b3313f29ebca47192aa82644
SHA1 3ecd02e675f6713d77b21e4e19b9ad71a5ca8a47
SHA512 c530eff3107f7d775b09a216588dd05e565c45f3a24fcd3178d18d1121197bb4de6c454ea08f09663482d9b34c5f6fefb09e2d0acf1b135dd67b85ce58370e07
SSDEEP 6144:ZW/zr8SfxL/2Dc33CuU4tLsUL6mmt0fSoD78uLwsehNjjv:ZawSfxL/2Dc3bDLLmt0LDQewsAjjv
TLSH
T1CF746B31FE74E436C2BF0DB61B36C716547DB9204B611AC3E3A88E9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader

File Explorer

2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader

.exe 359KB

2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader

IMPHASH ead69853b7cb1b3bd5e661d99b54cf07
SHA256 e74bb7bcb077275a66546c64f8eca189d95e379e251eec2b7fe38538119a8de1
MD5 1e6a3259b3313f29ebca47192aa82644
SHA1 3ecd02e675f6713d77b21e4e19b9ad71a5ca8a47
SHA512 c530eff3107f7d775b09a216588dd05e565c45f3a24fcd3178d18d1121197bb4de6c454ea08f09663482d9b34c5f6fefb09e2d0acf1b135dd67b85ce58370e07
SSDEEP 6144:ZW/zr8SfxL/2Dc33CuU4tLsUL6mmt0fSoD78uLwsehNjjv:ZawSfxL/2Dc3bDLLmt0LDQewsAjjv
TLSH
T1CF746B31FE74E436C2BF0DB61B36C716547DB9204B611AC3E3A88E9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

114646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mavinject32.pdb

kernel32

RaiseException GetLastError DecodePointer HeapSetInformation InitializeCriticalSectionEx CloseHandle LocalFree WriteProcessMemory ReadProcessMemory WideCharToMultiByte DeleteCriticalSection OpenProcess CreateFileW FlushFileBuffers SetUnhandledExceptionFilter OutputDebugStringW FreeLibrary LoadLibraryW GetProcAddress GetCurrentProcess WaitForSingleObject GetModuleHandleW CreateRemoteThread VirtualFreeEx VirtualAllocEx DuplicateHandle ExitProcess VirtualQueryEx TerminateProcess SetLastError VirtualProtectEx IsWow64Process VirtualQuery LoadLibraryExW IsDebuggerPresent EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStringTypeW EncodePointer HeapFree GetCommandLineW IsProcessorFeaturePresent GetCPInfo RtlUnwind HeapAlloc UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCurrentThreadId GetProcessHeap GetModuleHandleExW HeapSize GetStdHandle GetFileType GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW

shell32

CommandLineToArgvW

ntdll

NtQueryInformationProcess RtlNtStatusToDosError

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_1e6a3259b3313f29ebca47192aa82644_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader

kernel32

shell32

ntdll

advapi32

generic