2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 524KB
Sample260810-hartbsshja
SHA256 f304a64272eacfd0933ad0060da94ea9885b547c51799c020d394fa7f557bf2d
MD5 51eb24fd4caf1ee124c9a5f830747a8b
SHA1 05644ccec849e595a50b33a6fc5f8ebcc990dcee
SHA512 71561a70cbb4ac0920bb1b04f3f8984b1e87357653a79562f52b55fbe7f5ed82a8acbe7e28e91bbe1e17f4eb7fe01624ea4f2dc3b855d70473470b0e082e485a
SSDEEP 12288:H6wzg6qo4h+1GVwqJPIImLfRyh4siGoEPpBjvrEH7n:Hg6qoLGVyLfRyhB7rEH7n
TLSH
T1E6B49D10BBD4C2B6C16625715E96E37566FABE345F2502C7B7C02F2E1E381D29938B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 524KB

2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH c81f2f8663c6c7b41a3690b8f2c92e32
SHA256 f304a64272eacfd0933ad0060da94ea9885b547c51799c020d394fa7f557bf2d
MD5 51eb24fd4caf1ee124c9a5f830747a8b
SHA1 05644ccec849e595a50b33a6fc5f8ebcc990dcee
SHA512 71561a70cbb4ac0920bb1b04f3f8984b1e87357653a79562f52b55fbe7f5ed82a8acbe7e28e91bbe1e17f4eb7fe01624ea4f2dc3b855d70473470b0e082e485a
SSDEEP 12288:H6wzg6qo4h+1GVwqJPIImLfRyh4siGoEPpBjvrEH7n:Hg6qoLGVyLfRyhB7rEH7n
TLSH
T1E6B49D10BBD4C2B6C16625715E96E37566FABE345F2502C7B7C02F2E1E381D29938B0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

20:f6:63:9a:ef:6e:d8:18:0f:71:ab:2e:b3:f9:46:ba:4b:1e:08:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 16, 2013

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

48:d6:38:3a:8d:14:9c:1c:dc:e6:9a:72:8b:dd:24:f6

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2012 - Apr 25, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

187979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\UU_code\相关代码分支\HostlessSuite_SoftBank\bin\CheckNDISPort_df.pdb

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW CM_Get_Child CM_Get_Device_IDW CM_Get_Sibling CM_Get_Parent SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

kernel32

GetFileAttributesW GetFileSizeEx GetFileTime SetErrorMode GetTickCount GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc GetSystemTimeAsFileTime RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize SetStdHandle GetFileType VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA GetLastError FindResourceW LoadResource SizeofResource GetLogicalDrives GetDriveTypeW LockResource FindFirstFileW FindClose GetDiskFreeSpaceExW CloseHandle CreateMutexW CreateThread WaitForSingleObject GetModuleFileNameW MultiByteToWideChar Sleep OutputDebugStringW GetVersionExW OutputDebugStringA GetPrivateProfileIntW GetTempPathW DeleteFileW CopyFileW GetSystemTime GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFlags GetThreadLocale lstrlenA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FileTimeToLocalFileTime GetCurrentThreadId ReleaseMutex GetPrivateProfileStringW WritePrivateProfileStringW FileTimeToSystemTime GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetModuleHandleA InterlockedDecrement GlobalAddAtomW FreeResource GlobalDeleteAtom ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW lstrlenW MulDiv LocalFree LocalAlloc GetCurrentThread CreateDirectoryW GetCurrentProcess GetCurrentProcessId WideCharToMultiByte CreateProcessW SetLastError LoadLibraryW CreateFileW FreeLibrary GetProcAddress GetModuleHandleW LCMapStringA

user32

ReleaseCapture SetCapture InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW LoadCursorW GetSysColorBrush RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect CopyRect PtInRect DefWindowProcW CallWindowProcW GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetNextDlgGroupItem BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetWindowTextW SetFocus ShowWindow MoveWindow SetWindowLongW GetDlgCtrlID SetWindowTextW IsDialogMessageW SendDlgItemMessageW GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus MessageBeep CharUpperW UnregisterClassW DestroyMenu RegisterClipboardFormatW PostThreadMessageW ModifyMenuW EnableMenuItem GetSysColor CheckMenuItem GetWindow SetWindowContextHelpId GetParent MapDialogRect SetWindowPos PostMessageW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu TranslateMessage PeekMessageW DispatchMessageW EnableWindow PostQuitMessage KillTimer DrawIcon GetClientRect GetSystemMetrics IsIconic SetTimer SendMessageW LoadIconW EndPaint

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetWindowExtEx GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode GetViewportExtEx GetObjectW DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegEnumKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathFileExistsW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard

oleaut32

SysAllocString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy VariantInit VariantChangeType VariantClear SysAllocStringLen SysFreeString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_51eb24fd4caf1ee124c9a5f830747a8b_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

iphlpapi

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic