2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop
Size 4.8MB
Sample260820-217f9azzcv
SHA256 0b68e20387fae05aff48e73f0f8f144e09d737fbccc4d2e548f615c84d5a4e03
MD5 f59da3ddfc2bec3b9b5b6c8aa341486c
SHA1 a63b740f1a6741ef430d25bcf5f2822c4bd726e4
SHA512 3a14a0c3f283f5ea66ae1e7525b7729c5e2933a72d0c768e6071eee91d3e98ab3d57962bfd5bae0a155078492db4c1cb1ec000ad0c534bdd218e8e9b68eb0cf5
SSDEEP 98304:Ltr4t84tQSkY3LcKoYUSLpEPnd8cc2zKM0w14FaIjm/M:LtG84JkMILYUPfd8chWu1OI/M
TLSH
T1D636CF2072E4C232F2B317703A35D662AA7EBE94E538C51D3A56425D16F3B84D67CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop

File Explorer

2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop

.exe 4.8MB

2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop

IMPHASH afc0ae393ac34d8f12ef0a6a57541b29
SHA256 0b68e20387fae05aff48e73f0f8f144e09d737fbccc4d2e548f615c84d5a4e03
MD5 f59da3ddfc2bec3b9b5b6c8aa341486c
SHA1 a63b740f1a6741ef430d25bcf5f2822c4bd726e4
SHA512 3a14a0c3f283f5ea66ae1e7525b7729c5e2933a72d0c768e6071eee91d3e98ab3d57962bfd5bae0a155078492db4c1cb1ec000ad0c534bdd218e8e9b68eb0cf5
SSDEEP 98304:Ltr4t84tQSkY3LcKoYUSLpEPnd8cc2zKM0w14FaIjm/M:LtG84JkMILYUPfd8chWu1OI/M
TLSH
T1D636CF2072E4C232F2B317703A35D662AA7EBE94E538C51D3A56425D16F3B84D67CF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA VerInstallFileA

kernel32

LoadResource FindResourceA GetModuleHandleA SetErrorMode CreateDirectoryA GetModuleFileNameA CreateFileA InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency CreateEventA CloseHandle WriteFile Sleep ReadFile FreeLibrary RemoveDirectoryA DeleteFileA GetTempPathA LeaveCriticalSection EnterCriticalSection CreateThread GetWindowsDirectoryA GetTickCount GetFileAttributesA GetTempFileNameA CreateMutexA WaitForSingleObject ReleaseMutex InitializeCriticalSection DeleteCriticalSection lstrlenW SetEvent OpenEventA CreateProcessA GetCurrentThreadId LockResource GetSystemInfo HeapCreate GetFileSize lstrcpynA lstrcatA WritePrivateProfileStringA FindClose FindFirstFileA SetFilePointer GetShortPathNameA GetProcAddress LoadLibraryA GetSystemDefaultLangID MoveFileA HeapDestroy FindResourceExA UnmapViewOfFile MapViewOfFile CreateFileMappingA SizeofResource FindNextFileA lstrcmpA GetVersion GetStartupInfoA ExitProcess GetCommandLineA DebugBreak HeapReAlloc HeapFree VirtualQuery VirtualProtect SearchPathA ResetEvent QueryPerformanceCounter SystemTimeToFileTime GetCurrentProcess GetCurrentThread RtlUnwind lstrcpyA GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetVersionExA CompareStringW CompareStringA WideCharToMultiByte lstrlenA GetLastError SetLastError lstrcmpiA GetPrivateProfileIntA GetPrivateProfileStringA MultiByteToWideChar GetStringTypeA GetStringTypeW HeapAlloc IsBadReadPtr

user32

KillTimer DestroyWindow GetWindowTextA SetTimer SetWindowRgn GetDesktopWindow DialogBoxIndirectParamA SetActiveWindow ShowWindow CharNextA MoveWindow GetDlgItem SendMessageA SetDlgItemTextA LoadIconA GetWindowRect SystemParametersInfoA SetWindowPos wsprintfA LoadStringA MsgWaitForMultipleObjects CharLowerBuffA SetWindowTextA MessageBoxA PeekMessageA CharUpperA PostThreadMessageA CreateDialogIndirectParamA GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC EndDialog ScreenToClient

gdi32

GetTextExtentPoint32A LPtoDP DeleteObject CreateFontIndirectA GetObjectA

advapi32

RegCreateKeyExA GetTokenInformation AllocateAndInitializeSid OpenThreadToken EqualSid FreeSid RegCloseKey RegOpenKeyExA RegSetValueExA OpenProcessToken RegDeleteKeyA RegEnumKeyExA RegQueryValueExA RegOpenKeyA RegQueryValueA

shell32

SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation

ole32

CoCreateGuid CoCreateInstance CoRevokeClassObject CoRegisterClassObject StringFromCLSID CoTaskMemFree StringFromGUID2 GetRunningObjectTable CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream CoReleaseMarshalData CoInitialize CoGetInterfaceAndReleaseStream CoUninitialize

oleaut32

RegisterTypeLi LoadTypeLi LoadRegTypeLi SysFreeString VariantCopy SysAllocStringLen SysAllocString SysStringLen VariantClear

lz32

LZOpenFileA LZCopy LZClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

generic