2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop
Size 1.8MB
Sample260810-a2n8hs11bx
SHA256 f0ff77368d81f0584781a9d32ee5e290bf83d5c62685cbd178f95d029b0d0423
MD5 eac6cec364d68d0236b84d0b30ad1c94
SHA1 fa2d833c4ee4e72fb4fc1ca7aa8c1490ff6b380b
SHA512 a16bb7989a7368909f160ef9bcd034628aa1d929b25106214df3198bab7536d036ca7df45b5618d218e61fc5cbc81d2445e4755ff8a0bd0d91360434a4deeff9
SSDEEP 49152:745sFR984DMbwUVJsv6tWKFdu9CPTtunLyvL/6mShMZtmjNUVrciV5P+7QVg07tz:7ECs4kfJsv6tWKFdu9C
TLSH
T1E0858C10A3E641B7F5F76A7559BF522A8A3BBE62473190DF12CC790A59303E09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop

.exe 1.8MB

2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH e2c4aee6b11aa562d0b602802205c8c4
SHA256 f0ff77368d81f0584781a9d32ee5e290bf83d5c62685cbd178f95d029b0d0423
MD5 eac6cec364d68d0236b84d0b30ad1c94
SHA1 fa2d833c4ee4e72fb4fc1ca7aa8c1490ff6b380b
SHA512 a16bb7989a7368909f160ef9bcd034628aa1d929b25106214df3198bab7536d036ca7df45b5618d218e61fc5cbc81d2445e4755ff8a0bd0d91360434a4deeff9
SSDEEP 49152:745sFR984DMbwUVJsv6tWKFdu9CPTtunLyvL/6mShMZtmjNUVrciV5P+7QVg07tz:7ECs4kfJsv6tWKFdu9C
TLSH
T1E0858C10A3E641B7F5F76A7559BF522A8A3BBE62473190DF12CC790A59303E09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

743057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\_projects\RedefineBSTSVT\Script\vbkrn2.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

ws2_32

WSAAsyncSelect

kernel32

WideCharToMultiByte SizeofResource GetVersionExW GetLastError FindClose LockResource FindNextFileW GetCurrentProcessId LocalFree MultiByteToWideChar InterlockedIncrement InterlockedDecrement LoadLibraryW GetProcAddress Sleep WaitForSingleObjectEx CreateFileA GetFileSize HeapAlloc HeapFree GetModuleHandleW GetProcessHeap WriteFile GetFileAttributesW TerminateProcess ReadFile GetModuleFileNameW CreateFileW FlushFileBuffers GetTempPathW DeviceIoControl GetSystemInfo WaitForMultipleObjects GetFileAttributesExW DeleteFileW GetPrivateProfileStringW InitializeCriticalSection InterlockedExchange SetFilePointer GetSystemTimeAsFileTime SetLastError TerminateThread GetModuleFileNameA DeleteFileA InterlockedCompareExchange FindResourceW GetSystemDirectoryW CreateThread GetUserDefaultLCID GetLocaleInfoW GetSystemTime SetUnhandledExceptionFilter GetTickCount VerifyVersionInfoW VerSetConditionMask FormatMessageW CompareStringW GetCommandLineW TlsFree TlsSetValue GetCurrentThreadId SwitchToThread GetCurrentThread TlsAlloc SetThreadPriority ResumeThread GetThreadPriority TlsGetValue DuplicateHandle QueryPerformanceFrequency QueryPerformanceCounter GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultUILanguage GetFileType SetEndOfFile GetLogicalDrives MapViewOfFile UnmapViewOfFile SetErrorMode GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW CompareStringA CreateEventA ReleaseMutex GetVersionExA AreFileApisANSI UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetTempPathA FormatMessageA GetFullPathNameA GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileMappingA FreeResource VirtualAlloc VirtualFree RaiseException SetEvent WaitForSingleObject FindResourceExW FindFirstFileW CloseHandle DeleteCriticalSection CreateEventW ResetEvent GetCurrentProcess LoadResource EnterCriticalSection LeaveCriticalSection HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter IsDebuggerPresent ExitThread ExitProcess GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetStringTypeW GetACP GetOEMCP IsValidCodePage HeapCreate GetStdHandle GetStringTypeA SetHandleCount GetStartupInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetPrivateProfileIntW CreateMutexA

user32

PeekMessageW PostMessageW CharNextExA SetTimer CallNextHookEx KillTimer GetQueueStatus DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW RegisterClassW UnregisterClassW DestroyWindow UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx

advapi32

CopySid OpenProcessToken FreeSid GetLengthSid GetTokenInformation

ole32

CoInitialize CoCreateInstance CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_eac6cec364d68d0236b84d0b30ad1c94_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop

shlwapi

ws2_32

kernel32

user32

advapi32

ole32

generic