2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 416KB
Sample260808-yvdefatfkd
SHA256 f9000838935513fff2f8121f1999e69391368b0bc3cd9cee204dcb4ff4d7a051
MD5 6d2919106e43eae716f08dfa37918c9c
SHA1 df5778a7582af691cd0da8eaf58975df1671aee9
SHA512 a36a3525a44923deacd601d32d7048ea792a0a6d9cc1b6fcfa90ab2a90b7eda78175c7776f15d41e515d038369c2eb4d890911e6ff0cb07f384dfa93d2fda729
SSDEEP 12288:nk5XlDFJjLKrhGKv8+jWwVEXeDuUlACBjvrEH7FS:nsFjL3KryXVkrEH70
TLSH
T100948D1137D0CAB6C26231322926E77566EABD358D76434B67803B6DDE38592CF2831F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 416KB

2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 92a37498d153eae94799926db3a88bc6
SHA256 f9000838935513fff2f8121f1999e69391368b0bc3cd9cee204dcb4ff4d7a051
MD5 6d2919106e43eae716f08dfa37918c9c
SHA1 df5778a7582af691cd0da8eaf58975df1671aee9
SHA512 a36a3525a44923deacd601d32d7048ea792a0a6d9cc1b6fcfa90ab2a90b7eda78175c7776f15d41e515d038369c2eb4d890911e6ff0cb07f384dfa93d2fda729
SSDEEP 12288:nk5XlDFJjLKrhGKv8+jWwVEXeDuUlACBjvrEH7FS:nsFjL3KryXVkrEH70
TLSH
T100948D1137D0CAB6C26231322926E77566EABD358D76434B67803B6DDE38592CF2831F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7d:64:a1:60:40:4d:83:ef:52:6c:31:dc:c2:79:da:d2:c6:40:ac:15

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Jan 14, 2014

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Samsung Electronics CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Serial Number

20:9b:db:ea:f1:6c:06:f5:54:4a:b9:a1:bf:d3:2c:38

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 29, 2013 - Jan 27, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

124056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\SetupW\Release\SetupW.pdb

kernel32

HeapAlloc HeapFree HeapReAlloc RtlUnwind RaiseException Sleep ExitProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime GetTickCount SetErrorMode CreateFileW GetFullPathNameW GetVolumeInformationW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFlags GetModuleHandleA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement FileTimeToSystemTime GetThreadLocale lstrlenA GlobalFindAtomW GetVersionExW CompareStringW LoadLibraryA GetVersionExA InterlockedDecrement GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange lstrcmpW FreeLibrary GetModuleHandleW GetProcAddress GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv WideCharToMultiByte MultiByteToWideChar CloseHandle WaitForSingleObject CreateProcessW GetWindowsDirectoryW FindFirstFileW FindResourceW LoadResource LockResource TerminateProcess SizeofResource

user32

RegisterClipboardFormatW PostThreadMessageW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW ReleaseCapture SetCapture ClientToScreen LoadCursorW GetDC ReleaseDC GetSysColorBrush ShowWindow MoveWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA IsIconic LoadIconW SendMessageW PostMessageW EnableWindow GetWindowPlacement GetWindowRect GetSystemMetrics UnhookWindowsHookEx GetWindowThreadProcessId GetLastActivePopup MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DestroyMenu UnregisterClassW CharUpperW SetPropW GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState PostQuitMessage SetWindowPos MapDialogRect GetParent SetWindowContextHelpId GetWindow EndDialog GetNextDlgTabItem IsWindowEnabled GetDlgItem GetWindowLongW IsWindow DestroyWindow CreateDialogIndirectParamW SetActiveWindow GetActiveWindow GetDesktopWindow CheckMenuItem EnableMenuItem ModifyMenuW GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible DispatchMessageW SendDlgItemMessageW

gdi32

ExtSelectClipRgn DeleteDC GetStockObject GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape GetBkColor GetDeviceCaps TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleIsCurrentClipboard CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6d2919106e43eae716f08dfa37918c9c_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

generic