2026-08-15_0d1232fb200e44b043e01a6ec99f416b_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_0d1232fb200e44b043e01a6ec99f416b_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Size 1.7MB
Sample260815-lt7knsfa89
SHA256 55ef9ae81bd2b895b2bd0eced671b68c3174c3029c8aad9365e242d11e425091
MD5 0d1232fb200e44b043e01a6ec99f416b
SHA1 a442843c0f5d25f77f90b655bbb30104b9410f69
SHA512 7b3d75543fc190f344a00dcf6801840e8a91d2050b5ce71941205f96f8d07201332fbf0b7e8a0506d866ccf2859473547be12209f859abeaeaef0ce6f17d9152
SSDEEP 49152:GVqKl+5+T7Q8jWA7uXNdfYM6ZkHnuWINHLhUZC1t:GVqKTs2WA7UNdfY1ZAnuWihUEj
TLSH
T1B1858D323A90C03BC2733535964FA379F2E9E9705D75468767900F392E34543AA6CBAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-15_0d1232fb200e44b043e01a6ec99f416b_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 1.7MB

2026-08-15_0d1232fb200e44b043e01a6ec99f416b_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 0afcda7e3880d6c82574526275199876
SHA256 55ef9ae81bd2b895b2bd0eced671b68c3174c3029c8aad9365e242d11e425091
MD5 0d1232fb200e44b043e01a6ec99f416b
SHA1 a442843c0f5d25f77f90b655bbb30104b9410f69
SHA512 7b3d75543fc190f344a00dcf6801840e8a91d2050b5ce71941205f96f8d07201332fbf0b7e8a0506d866ccf2859473547be12209f859abeaeaef0ce6f17d9152
SSDEEP 49152:GVqKl+5+T7Q8jWA7uXNdfYM6ZkHnuWINHLhUZC1t:GVqKTs2WA7UNdfY1ZAnuWihUEj
TLSH
T1B1858D323A90C03BC2733535964FA379F2E9E9705D75468767900F392E34543AA6CBAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f5:81:11:3d:3d:e2:4c:de:3b:f0:7f:2c:f9:e8:f5:3a:e2:56:0f:72:ce:af:23:ef:d1:8a:35:71:ef:e6:12:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=110111-1712911,CN=Kings Information & Network Co.\,Ltd.,O=Kings Information & Network Co.\,Ltd.,L=Hanam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Dec 16, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

25:f3:16:d3:9f:87:a7:cd:18:50:d0:5d:b2:01:95:13:5b:5e:21:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Dec 16, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

08:c6:f3:f5:b7:58:59:9b:ad:c0:b0:77:7e:3a:a1:60

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 15, 2026

Minor OS version

Major OS version

Entry point

1060768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\svn\bin\Release\KESM_LogAnalyzer_release\KESM_LogAnalyzer.pdb

kernel32

IsValidCodePage GetTimeZoneInformation InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW VirtualFree GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA HeapCreate GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle CreateEventW GetFileType SetStdHandle VirtualQuery GetSystemInfo VirtualAlloc HeapSize HeapReAlloc RaiseException ExitProcess RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter GetOEMCP TerminateProcess ExitThread GetSystemTimeAsFileTime GetStartupInfoW FindResourceExW VirtualProtect GetProfileIntW GetTickCount SearchPathW GetTempPathW GetTempFileNameW GetFileTime GetFileSizeEx SetErrorMode lstrlenA GlobalGetAtomNameW lstrcpyW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetCurrentDirectoryW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile GetACP GetCPInfo QueryPerformanceCounter UnhandledExceptionFilter FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GetModuleHandleA GlobalSize FormatMessageW LocalFree MulDiv GetCurrentProcessId ResumeThread SetThreadPriority GlobalUnlock GlobalFree FreeResource GlobalAddAtomW GlobalFindAtomW GetVersionExW CompareStringW LoadLibraryA GetVersionExA InterlockedDecrement SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW lstrlenW FlushFileBuffers InitializeSRWLock GetComputerNameW GetFileAttributesExW WriteFile CreateFileA OutputDebugStringW GetExitCodeProcess CreateProcessA SetFilePointer CopyFileW HeapFree GetProcessHeap HeapAlloc WideCharToMultiByte ReadFile GetFileSize CreateFileW CreateDirectoryW RemoveDirectoryW MultiByteToWideChar GetProcAddress LoadLibraryW LeaveCriticalSection GetPrivateProfileSectionW GetFileAttributesW EnterCriticalSection WritePrivateProfileStringW GetPrivateProfileIntW DeleteFileW Sleep CreateThread GetModuleFileNameW GetLastError CreateMutexW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection FreeLibrary SetEvent CloseHandle ReleaseMutex InitializeCriticalSection WaitForSingleObject GetUserDefaultLCID

user32

CreateMenu GetDoubleClickTime GetIconInfo SubtractRect CopyIcon CharUpperBuffW GetUpdateRect FrameRect TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW IsClipboardFormatAvailable MapVirtualKeyExW GetKeyNameTextW IsCharLowerW GetMenuDefaultItem SetMenuDefaultItem UpdateLayeredWindow EnableScrollBar UnionRect SetCursorPos SetRect DrawFocusRect DrawFrameControl DrawEdge DrawIconEx UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW GetMenuItemInfoW UnregisterClassW EmptyClipboard CloseClipboard SetClipboardData LoadImageW DestroyIcon CopyImage OpenClipboard DrawStateW RegisterClipboardFormatW EnumChildWindows LockWindowUpdate BringWindowToTop IsRectEmpty KillTimer SetTimer InvalidateRect InflateRect IsMenu GetSystemMenu SetClassLongW SetParent CreatePopupMenu NotifyWinEvent SetWindowRgn CreateAcceleratorTableW LoadAcceleratorsW DestroyAcceleratorTable GetAsyncKeyState GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW DestroyMenu PostThreadMessageW LoadMenuW GetSysColorBrush SetRectEmpty DeleteMenu WaitMessage ReleaseCapture LoadCursorW WindowFromPoint SetCapture CharUpperW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect GetMenuStringW AppendMenuW InsertMenuW RemoveMenu GetWindowThreadProcessId ShowOwnedPopups SetCursor GetMessageW TranslateMessage GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW IsWindowEnabled GetNextDlgTabItem EndDialog RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar IsWindowVisible UpdateWindow GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx GetNextDlgGroupItem DestroyCursor GetWindowRgn MapDialogRect GetParent ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu GetWindowLongW SetWindowLongW SetWindowPos IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindow UnhookWindowsHookEx WinHelpW SystemParametersInfoW OffsetRect MessageBeep RedrawWindow IsZoomed PostMessageW EnableWindow wsprintfW FindWindowW DrawIcon GetClientRect GetSystemMetrics IsIconic PostQuitMessage SendMessageW LoadIconW GetClassInfoW

gdi32

CreateDIBitmap CreateFontIndirectW CreateCompatibleBitmap GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo CreateRoundRectRgn GetTextColor GetTextExtentPoint32W SetDIBColorTable PatBlt GetDIBits RealizePalette CombineRgn StretchBlt Escape SetPixel CreateDIBSection SetRectRgn DPtoLP CreateEllipticRgn CreatePolygonRgn GetBkColor Polyline Ellipse Polygon Rectangle RoundRect CreatePalette GetRgnBox GetWindowOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect GetViewportOrgEx LPtoDP ExtFloodFill SetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW GetTextFaceW SetPixelV ExtTextOutW TextOutW RectVisible CreateRectRgnIndirect OffsetRgn PtVisible CreateHatchBrush CreateSolidBrush CreatePen GetObjectType SelectPalette GetStockObject CreateCompatibleDC CreatePatternBrush DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetPaletteEntries GetDCOrgEx GetPixel BitBlt GetWindowExtEx GetViewportExtEx CreateRectRgn SelectClipRgn DeleteObject SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC CopyMetaFileW GetDeviceCaps CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox SelectObject

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegQueryValueW RegSetValueExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW RegOpenKeyW RegEnumKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW

comctl32

ImageList_GetIconSize

shlwapi

PathIsUNCW PathStripToRootW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleGetClipboard DoDragDrop OleLockRunning CreateStreamOnHGlobal OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx RevokeDragDrop CoLockObjectExternal RegisterDragDrop

oleaut32

SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantInit VariantChangeType VariantClear

gdiplus

GdipDrawImageI GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipCloneImage

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_0d1232fb200e44b043e01a6ec99f416b_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

gdiplus

imm32

winmm

generic