2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 416KB
Sample260808-sva2eseb56
SHA256 0518fd2abfb089ed72a8a09fb5feaf3271025bd6398aba48fa0d14822ba9d760
MD5 e94508897a4811ea0302966b31dcf7d6
SHA1 4d2567dd1e9622dd971db2abfec25f8d929285a0
SHA512 a31fbded22ebcf593eeb302ea6c744ec56ce7cd3393f273d8eeb9f6d20839e150f8cf9b74e623d4e819db7dfa8a94bcbd4dc8c475ea09f01b124f4f758344658
SSDEEP 12288:7k5XlDFJjLKrhGKv8XKWwVEXeDuUlAaBjvrEH7FS:7sFjL3aryXVsrEH70
TLSH
T153948D1137D0CAB6C26235322926E77566EABD358D36434B77803B6DDE385928F2831F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 416KB

2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 92a37498d153eae94799926db3a88bc6
SHA256 0518fd2abfb089ed72a8a09fb5feaf3271025bd6398aba48fa0d14822ba9d760
MD5 e94508897a4811ea0302966b31dcf7d6
SHA1 4d2567dd1e9622dd971db2abfec25f8d929285a0
SHA512 a31fbded22ebcf593eeb302ea6c744ec56ce7cd3393f273d8eeb9f6d20839e150f8cf9b74e623d4e819db7dfa8a94bcbd4dc8c475ea09f01b124f4f758344658
SSDEEP 12288:7k5XlDFJjLKrhGKv8XKWwVEXeDuUlAaBjvrEH7FS:7sFjL3aryXVsrEH70
TLSH
T153948D1137D0CAB6C26235322926E77566EABD358D36434B77803B6DDE385928F2831F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f7:21:a7:15:1d:b0:55:12:13:09:99:82:e3:99:da:24:29:8a:a0:aa

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Jan 14, 2014

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Serial Number

20:9b:db:ea:f1:6c:06:f5:54:4a:b9:a1:bf:d3:2c:38

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 29, 2013 - Jan 27, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

124056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\SetupW\Release\SetupW.pdb

kernel32

HeapAlloc HeapFree HeapReAlloc RtlUnwind RaiseException Sleep ExitProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime GetTickCount SetErrorMode CreateFileW GetFullPathNameW GetVolumeInformationW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFlags GetModuleHandleA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement FileTimeToSystemTime GetThreadLocale lstrlenA GlobalFindAtomW GetVersionExW CompareStringW LoadLibraryA GetVersionExA InterlockedDecrement GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange lstrcmpW FreeLibrary GetModuleHandleW GetProcAddress GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv WideCharToMultiByte MultiByteToWideChar CloseHandle WaitForSingleObject CreateProcessW GetWindowsDirectoryW FindFirstFileW FindResourceW LoadResource LockResource TerminateProcess SizeofResource

user32

RegisterClipboardFormatW PostThreadMessageW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW ReleaseCapture SetCapture ClientToScreen LoadCursorW GetDC ReleaseDC GetSysColorBrush ShowWindow MoveWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA IsIconic LoadIconW SendMessageW PostMessageW EnableWindow GetWindowPlacement GetWindowRect GetSystemMetrics UnhookWindowsHookEx GetWindowThreadProcessId GetLastActivePopup MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DestroyMenu UnregisterClassW CharUpperW SetPropW GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState PostQuitMessage SetWindowPos MapDialogRect GetParent SetWindowContextHelpId GetWindow EndDialog GetNextDlgTabItem IsWindowEnabled GetDlgItem GetWindowLongW IsWindow DestroyWindow CreateDialogIndirectParamW SetActiveWindow GetActiveWindow GetDesktopWindow CheckMenuItem EnableMenuItem ModifyMenuW GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible DispatchMessageW SendDlgItemMessageW

gdi32

ExtSelectClipRgn DeleteDC GetStockObject GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape GetBkColor GetDeviceCaps TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleIsCurrentClipboard CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_e94508897a4811ea0302966b31dcf7d6_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

generic