2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop

General

Target
2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop
Size 2.9MB
Sample260818-v6c19sxbjd
SHA256 99f1458e4e2d5561c6f34d344937a2ad5e42f30a791271d12d99bffe1f47a59d
MD5 79c6a98599362f07d36716079461c750
SHA1 ab0c741b6eb014be33805e4065ee6440571609b8
SHA512 8cb0d7a74b9df1ccc58648287da8b2a545b2d1e29feeb613723301a4ad04bbbb56694aced6917c13351c6ac991721c41deaa443665aa8e19a84e9d144f7b408c
SSDEEP 49152:Dk1KxzrmUi6AjW/MUSdGRf3/WhKPgssSt2gKDzx:YjjxAZWhv7St8DF
TLSH
T1AAE5F9116AEF9232DC7216708F7CD29805657C909BF6CD1B32903E9DEAB2588652F733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop

.exe 2.9MB

2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop

IMPHASH 6475c67b13bd524a574fee91f1de7cd5
SHA256 99f1458e4e2d5561c6f34d344937a2ad5e42f30a791271d12d99bffe1f47a59d
MD5 79c6a98599362f07d36716079461c750
SHA1 ab0c741b6eb014be33805e4065ee6440571609b8
SHA512 8cb0d7a74b9df1ccc58648287da8b2a545b2d1e29feeb613723301a4ad04bbbb56694aced6917c13351c6ac991721c41deaa443665aa8e19a84e9d144f7b408c
SSDEEP 49152:Dk1KxzrmUi6AjW/MUSdGRf3/WhKPgssSt2gKDzx:YjjxAZWhv7St8DF
TLSH
T1AAE5F9116AEF9232DC7216708F7CD29805657C909BF6CD1B32903E9DEAB2588652F733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryA CreateFileMappingA MapViewOfFile GetLastError CloseHandle MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsA GetProcAddress LoadLibraryA WriteConsoleW GetModuleFileNameA SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc OutputDebugStringW RtlUnwind LoadLibraryExW GetShortPathNameA GetFullPathNameA SetFilePointerEx GetCommandLineW LCMapStringW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW EncodePointer DecodePointer HeapAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetStringTypeW RaiseException ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection CreateFileW

user32

SetForegroundWindow ShowWindow IsIconic DefWindowProcA PostQuitMessage IsWindow CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DispatchMessageA TranslateMessage GetMessageA GetDesktopWindow SetTimer

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_79c6a98599362f07d36716079461c750_amadey_bkransomware_darkgate_elex_glassworm_karagany_maze_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

generic