2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader

General

Target
2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader
Size 5.4MB
Sample260813-plpxfayvcs
SHA256 372ec8488db0da287cd66c541f41719afbd284ed1bab1bfdf38361cd28dff6d7
MD5 a8fab6768c7a4f03baeb03521a1a5fcf
SHA1 5c62c2294c5927ea07c2b4ebfba76aac37f072ce
SHA512 67872928b5ff45dc65d8e81489b04eb06244e27760286f409156d357e96e4935b747ee815ff2756aa4df470e169251dedc3c96ab7e6ec09334d9138047fad043
SSDEEP 98304:TwQ3H1Uhbq3bBEvjCgKJYMjgAaEwjevaez:MJvjUjlwjsae
TLSH
T159467D227245A43FD0972F36982BA764993ABF303A12C957ABF41D8C4F35A41793E353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader

File Explorer

2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader

.exe 5.4MB

2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader

IMPHASH 17f0bc35fe4bb4c862fceb99ecd14825
SHA256 372ec8488db0da287cd66c541f41719afbd284ed1bab1bfdf38361cd28dff6d7
MD5 a8fab6768c7a4f03baeb03521a1a5fcf
SHA1 5c62c2294c5927ea07c2b4ebfba76aac37f072ce
SHA512 67872928b5ff45dc65d8e81489b04eb06244e27760286f409156d357e96e4935b747ee815ff2756aa4df470e169251dedc3c96ab7e6ec09334d9138047fad043
SSDEEP 98304:TwQ3H1Uhbq3bBEvjCgKJYMjgAaEwjevaez:MJvjUjlwjsae
TLSH
T159467D227245A43FD0972F36982BA764993ABF303A12C957ABF41D8C4F35A41793E353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessA GetLastError SizeofResource GetModuleHandleA CloseHandle WriteFile LoadResource FreeResource FindResourceA CreateFileA LockResource GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapAlloc HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetCurrentThreadId InterlockedDecrement GetProcAddress ExitProcess GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind HeapSize LoadLibraryW SetStdHandle WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers CreateFileW

user32

MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_a8fab6768c7a4f03baeb03521a1a5fcf_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader

kernel32

user32

generic