2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop
Size 1.1MB
Sample260811-dl6dmsvana
SHA256 f316de1c50cc50af7dd562a3f03655882e0c4d7a14340c13ba785f2ea659dc8e
MD5 647587b4cc94a1c7f6a59483d00b55b3
SHA1 6af352c367ca6aa27cdc2af54bd96ab3af024f35
SHA512 8502123d596956cfab5f553a5ef949a6d4d214eb2193596aa5be051a7056df5d47fb1b05aff8315f044b52f5b054feb907ef8bda00641bc7da3df6b7657e7991
SSDEEP 24576:t3B5KmVj8VypgP1JZztCx6NzK4fQbdHRtZ++PQpJvIYJp7+KpPEe5p/OYNqH2wSM:dfKmVj8VyezFtG6YY8dHRtZ++ILv1Psx
TLSH
T18E45BF13B3C184B3E456497951B7D77A0E3AEA22473BC5C7ABE129208D316D16B3E3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop

.exe 1.1MB

2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop

IMPHASH e654f41baebdf9bfbda30e17cfec3d61
SHA256 f316de1c50cc50af7dd562a3f03655882e0c4d7a14340c13ba785f2ea659dc8e
MD5 647587b4cc94a1c7f6a59483d00b55b3
SHA1 6af352c367ca6aa27cdc2af54bd96ab3af024f35
SHA512 8502123d596956cfab5f553a5ef949a6d4d214eb2193596aa5be051a7056df5d47fb1b05aff8315f044b52f5b054feb907ef8bda00641bc7da3df6b7657e7991
SSDEEP 24576:t3B5KmVj8VypgP1JZztCx6NzK4fQbdHRtZ++PQpJvIYJp7+KpPEe5p/OYNqH2wSM:dfKmVj8VyezFtG6YY8dHRtZ++ILv1Psx
TLSH
T18E45BF13B3C184B3E456497951B7D77A0E3AEA22473BC5C7ABE129208D316D16B3E3C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

644973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\windows\main_noxmllog\bin\output\ug_agent_main\Release\ug_agent_main.pdb

ws2_32

WSAGetLastError setsockopt closesocket recv WSACleanup WSAIoctl getservbyname htons inet_ntop ntohs getsockname send WSAStartup htonl shutdown connect WSASetLastError getsockopt gethostbyname ioctlsocket socket gethostname

zlibwapi

ord62 ord72 ord68 ord79 ord67 ord64 ord63 ord61 ord66

kernel32

GetModuleHandleA GlobalMemoryStatus QueryPerformanceFrequency QueryPerformanceCounter WritePrivateProfileStringA GetPrivateProfileStringA GetTempPathA Sleep GetDiskFreeSpaceExA GetLogicalDriveStringsA GetCurrentProcess GetSystemInfo GetVersionExA WinExec GetModuleFileNameA GetPrivateProfileIntA GetWindowsDirectoryA GetSystemTimes WriteFile CreateFileA SizeofResource LockResource LoadResource FindResourceA GlobalMemoryStatusEx LeaveCriticalSection GetLocalTime EnterCriticalSection GetExitCodeProcess WaitForSingleObject CreateProcessA LoadLibraryA CompareFileTime SystemTimeToFileTime GetSystemTime GetFileTime GetLastError DeleteFileA DeleteCriticalSection InitializeCriticalSection CreateThread FindClose FindNextFileA FindFirstFileA CopyFileA GetFullPathNameA CreateDirectoryA GetCurrentThreadId GetVersion GetFileType GetStdHandle FlushConsoleInputBuffer MultiByteToWideChar GetCurrentProcessId FreeLibrary SetLastError LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoW GetProcAddress CreateToolhelp32Snapshot Process32First CloseHandle Process32Next OpenProcess QueryDosDeviceA GetConsoleCP GetTickCount HeapSize GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW LoadLibraryW GetLocaleInfoW FlushFileBuffers CreateFileW SetStdHandle GetStringTypeW GetUserDefaultLCID GetLocaleInfoA SetEnvironmentVariableA EnumSystemLocalesA IsValidLocale WriteConsoleW GetDriveTypeW SetEndOfFile InitializeCriticalSectionAndSpinCount SetHandleCount SetFilePointer InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent HeapCreate GetModuleFileNameW TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetTimeZoneInformation GetConsoleMode SetConsoleMode ReadConsoleInputA HeapReAlloc SetConsoleCtrlHandler ExitProcess GetModuleHandleW GetProcessHeap CompareStringW GetFileSize HeapSetInformation GetCommandLineA FindFirstFileExA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime DecodePointer EncodePointer WideCharToMultiByte ReadFile RtlUnwind GetSystemTimeAsFileTime HeapAlloc HeapFree RaiseException

user32

GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW GetSystemMetrics MessageBoxA

advapi32

SetServiceStatus ReadEventLogA OpenEventLogA RegisterServiceCtrlHandlerA RegisterEventSourceA DeregisterEventSource StartServiceCtrlDispatcherA StartServiceA ControlService OpenServiceA DeleteService OpenSCManagerA CreateServiceA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA CloseEventLog

psapi

GetProcessImageFileNameA

shlwapi

StrTrimA

netapi32

NetUserGetInfo NetApiBufferFree NetUserEnum

libxml2

xmlStrcasecmp xmlFree xmlTextWriterWriteAttribute xmlStrcmp xmlFreeDoc xmlInitParser xmlCleanupParser xmlBufferCreateSize xmlNewTextWriterMemory xmlTextWriterStartElement xmlDocGetRootElement xmlParseMemory xmlBufferFree xmlFreeTextWriter xmlTextWriterEndElement xmlGetProp

iconv

libiconv libiconv_open libiconv_close

fltlib

FilterConnectCommunicationPort FilterSendMessage

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_647587b4cc94a1c7f6a59483d00b55b3_amadey_darkgate_elex_glassworm_karagany_mafia_rhadamanthys_smoke-loader_stop

ws2_32

zlibwapi

kernel32

user32

advapi32

psapi

shlwapi

netapi32

libxml2

iconv

fltlib

generic