2026-08-16_065c69502114c20f05876cb82e9e58b0_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_065c69502114c20f05876cb82e9e58b0_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader
Size 632KB
Sample260816-swk8saec49
SHA256 651b34343f7d57cdf8c1208a8899541e9dcdd85a9d275d8b5005482c69b730f2
MD5 065c69502114c20f05876cb82e9e58b0
SHA1 50f3200c5905aa047a56346f116d1f406840cb78
SHA512 08e1ab44d3d58361205526552e796c5938de51653a211b6f0bd93a0dc7f689496af9a1b1e2f43fd79f280dc0827ad474786f29ac3e537a37d3ac2e00ad4b9027
SSDEEP 12288:OIB0t8gIXaaxsGB5UXxRvid16eGDF4lYU0HvOKFr:9BgT6KwqifCAYU0HvO6r
TLSH
T1CBD4D021B762D130F9A201356AEC8AF6197CBD31675544D373A13B5E9E606E0EE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_065c69502114c20f05876cb82e9e58b0_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader

File Explorer

2026-08-16_065c69502114c20f05876cb82e9e58b0_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader

.exe 632KB

2026-08-16_065c69502114c20f05876cb82e9e58b0_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader

IMPHASH 59b66fab76102c07585b1d4153fe9799
SHA256 651b34343f7d57cdf8c1208a8899541e9dcdd85a9d275d8b5005482c69b730f2
MD5 065c69502114c20f05876cb82e9e58b0
SHA1 50f3200c5905aa047a56346f116d1f406840cb78
SHA512 08e1ab44d3d58361205526552e796c5938de51653a211b6f0bd93a0dc7f689496af9a1b1e2f43fd79f280dc0827ad474786f29ac3e537a37d3ac2e00ad4b9027
SSDEEP 12288:OIB0t8gIXaaxsGB5UXxRvid16eGDF4lYU0HvOKFr:9BgT6KwqifCAYU0HvO6r
TLSH
T1CBD4D021B762D130F9A201356AEC8AF6197CBD31675544D373A13B5E9E606E0EE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\bin\build\Release\360Game.pdb

kernel32

MoveFileExW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW InterlockedExchange GetSystemDirectoryW SetCurrentDirectoryW WaitForSingleObject CreateEventW OpenEventW MoveFileW GetCurrentThread CreateMutexW WritePrivateProfileStringW GetCurrentProcess OpenProcess Sleep GetTickCount GetTempPathW GetTempFileNameW LoadLibraryExW ExitProcess ReleaseMutex lstrcpynW ReplaceFileW GetVersionExW VirtualQuery InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteFileW SetFileAttributesW GetProcAddress LeaveCriticalSection EnterCriticalSection FreeLibrary DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW GetModuleHandleW GetCurrentProcessId CloseHandle DeviceIoControl GetWindowsDirectoryW CreateFileW ReadProcessMemory WaitForMultipleObjects IsDebuggerPresent OutputDebugStringW CreateFileA SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetFilePointerEx WriteFile ReadFile GetFileSizeEx FormatMessageW MultiByteToWideChar SetLastError GetCurrentThreadId GetSystemTime TlsGetValue TlsSetValue HeapUnlock OpenThread HeapLock HeapWalk TlsAlloc TlsFree EncodePointer CreateThread ExitThread GetCommandLineW RtlUnwind IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo GetModuleHandleExW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW GetStringTypeW GetStdHandle GetFileType QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers ReadConsoleW SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA CreateDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW

user32

MessageBoxW

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW SHGetValueW PathAddBackslashW PathAppendW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW

advapi32

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

44KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

79KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=199, version=41118,

count=28, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=222, id=224, productName=VS2013 build 21005, version=21005,

count=74, id=225, productName=VS2013 build 21005, version=21005,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=244, id=1, productName=Unmarked objects,

count=33, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,