2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader
Size 2.1MB
Sample260809-xd4dvstenh
SHA256 603d91a2c8395ff45cfbbe09155c5c1013fd5d5b3e27938e9cc3b4168d385a1b
MD5 2334acdab0ada8744f330dfa33614488
SHA1 ba88c39b551ada6a1b615c82e14cad8d6684e316
SHA512 9cc3fa7266fa7cd69d66ab713b738ee82af76613723e049172071a9d024176409e1f4e19467d66cab58046a8a62ce4e65e8a7e4c19cd8b7ac7bc332fc124890b
SSDEEP 49152:j0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3XQ/lFTjN4:j0pxfbf+/4h9hNhBX38Lm
TLSH
T126A5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader

File Explorer

2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader

.exe 2.1MB

2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader

IMPHASH 4e5ac3b35d8d46874dcf133ae994c8c6
SHA256 603d91a2c8395ff45cfbbe09155c5c1013fd5d5b3e27938e9cc3b4168d385a1b
MD5 2334acdab0ada8744f330dfa33614488
SHA1 ba88c39b551ada6a1b615c82e14cad8d6684e316
SHA512 9cc3fa7266fa7cd69d66ab713b738ee82af76613723e049172071a9d024176409e1f4e19467d66cab58046a8a62ce4e65e8a7e4c19cd8b7ac7bc332fc124890b
SSDEEP 49152:j0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3XQ/lFTjN4:j0pxfbf+/4h9hNhBX38Lm
TLSH
T126A5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

484857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedCompareExchange GetACP GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryW lstrlenW GlobalUnlock GlobalLock ExitProcess LocalFileTimeToFileTime GetFileAttributesW SetFileTime MulDiv VerifyVersionInfoW VerSetConditionMask OpenProcess GetCurrentProcessId GlobalAlloc LocalFree FormatMessageW InterlockedIncrement InterlockedDecrement lstrcpyW lstrcmpiW lstrcpynW HeapFree HeapAlloc DecodePointer EncodePointer InitializeCriticalSection ResumeThread CreateThread GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapReAlloc RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy GetStdHandle IsProcessorFeaturePresent GetCPInfo GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId GetCurrentThread LCMapStringW GetLocaleInfoW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW HeapSize FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetConsoleCP GetConsoleMode GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle FlushFileBuffers CreateFileA WriteConsoleW SetEndOfFile GetProcessHeap LockResource SizeofResource LoadResource FindResourceW FreeResource CreateMutexW GetCommandLineW GetLastError GetTickCount SystemTimeToFileTime GetLocalTime UnmapViewOfFile WriteFile MapViewOfFile CreateFileMappingW CreateFileW ReadFile SetFilePointer GetFileSize GetFileInformationByHandle FileTimeToSystemTime GetSystemInfo GetProcAddress GetModuleHandleW CloseHandle CreateProcessW OutputDebugStringA WideCharToMultiByte SetEnvironmentVariableW GetEnvironmentVariableW MultiByteToWideChar CreateDirectoryW ExitThread GetModuleFileNameW

user32

GetPropW SetPropW AdjustWindowRectEx GetMenu RegisterClassW RegisterClassExW GetClassInfoExW MonitorFromPoint FillRect CharPrevW SetRect DrawTextW GetWindowRgn UpdateLayeredWindow MoveWindow IsWindowEnabled CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime GetKeyNameTextW MapVirtualKeyExW GetKeyboardLayout SetWindowTextW SetForegroundWindow DrawTextA wsprintfA InvalidateRgn GetGUIThreadInfo CreateAcceleratorTableW GetWindowTextW GetWindowTextLengthW EqualRect UpdateWindow GetMessageW TranslateMessage DispatchMessageW CallWindowProcW IsIconic GetActiveWindow GetWindow BeginPaint GetUpdateRect IsRectEmpty IsWindowVisible IntersectRect MonitorFromWindow GetMonitorInfoW GetSysColor MapWindowPoints CreateWindowExW GetFocus SetFocus IsZoomed DestroyWindow CharNextW GetCursorPos SendMessageW GetDC ReleaseDC LoadImageW PtInRect GetWindowRect ReleaseCapture SetCapture IsWindow KillTimer SetTimer InvalidateRect GetWindowLongW SetWindowLongW GetKeyState LoadCursorW SetCursor UnionRect InflateRect OffsetRect SetWindowPos PostMessageW PostQuitMessage ScreenToClient GetClientRect ShowWindow GetSystemMetrics EnableWindow DefWindowProcW wsprintfW MessageBoxW GetParent SetWindowRgn EndPaint

advapi32

RegSetValueExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW

shell32

DragQueryFileW CommandLineToArgvW ShellExecuteExW

ole32

DoDragDrop CoCreateGuid CoUninitialize CoInitialize CoCreateInstance OleDuplicateData RevokeDragDrop RegisterDragDrop OleLockRunning CLSIDFromProgID CLSIDFromString ReleaseStgMedium CreateStreamOnHGlobal

shlwapi

PathRemoveFileSpecW PathFileExistsW

wininet

HttpOpenRequestW HttpSendRequestW InternetOpenW InternetConnectW

ws2_32

WSAStartup gethostname gethostbyname

gdi32

Rectangle RestoreDC BitBlt SaveDC CreateRoundRectRgn SelectClipRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox CombineRgn StretchBlt CreateDIBSection SetStretchBltMode CreateSolidBrush LineTo MoveToEx CreateEnhMetaFileW TextOutW GetTextExtentPoint32W GetCharABCWidthsW SetBkColor SetTextColor SetBkMode GetObjectA SelectObject CreateFontIndirectW GetObjectW CreateCompatibleDC GdiFlush PtInRegion CreateRectRgn CloseEnhMetaFile SetWindowOrgEx RemoveFontMemResourceEx AddFontMemResourceEx CreatePen CreateDIBitmap GetBitmapBits SetBitmapBits GetEnhMetaFileHeader GetDeviceCaps CreatePenIndirect GetTextMetricsW GetStockObject DeleteObject DeleteDC PlayEnhMetaFile CreateCompatibleBitmap CreatePatternBrush GetTextExtentPointA

oleaut32

CreateErrorInfo SysFreeString VariantInit VariantClear GetErrorInfo VariantChangeType SetErrorInfo SysAllocString

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

gdiplus

GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdiplusStartup GdiplusShutdown GdipFree GdipAlloc GdipDeleteBrush GdipCreatePen1 GdipDeletePen GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipDeleteGraphics GdipDeleteFont GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDisposeImage GdipCreateSolidFill GdipSetPenMode GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipAddPathLine ord1 GdipCreateFromHDC GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawString GdipMeasureString GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipCloneBrush GdipCloneImage GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawImageRectI GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

674KB

Virtual Size

673KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

ws2_32

gdi32

oleaut32

comctl32

gdiplus

imm32

generic