2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader

General

Target
2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader
Size 98KB
Sample260820-cdb96axhpd
SHA256 2c686df3e774dcc2ae5d15ad27da8cc24676a9a66fb370fd3423a92d8788ed98
MD5 1ae32aad7d90e70887461362cca8e3ae
SHA1 302e3d8d46254770abf0d05dfbe26bf10a2e730a
SHA512 4e9306e3909c7c55dafadab6b5033657433401a2a85bca9a48e72dfdbd4cf2638f1e104098032f5d6e710a99afab143a77a6f67c8e32db38a924126bac426cb5
SSDEEP 1536:rvfCVk5QM0VzTMZWGYWSJHb+C47VBCO3nO9gIwcCrlNsWjcdwNTE:rH7QM4ypYXKC47LCO8krlyET
TLSH
T18EA37D1277D18075E0B30A315CA98E62463EFD764AB18E5FB394018E09746D1AB3BFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader

File Explorer

2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader

.exe 98KB

2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader

IMPHASH a17dfd5ea24c1c0828bc372c3389e515
SHA256 2c686df3e774dcc2ae5d15ad27da8cc24676a9a66fb370fd3423a92d8788ed98
MD5 1ae32aad7d90e70887461362cca8e3ae
SHA1 302e3d8d46254770abf0d05dfbe26bf10a2e730a
SHA512 4e9306e3909c7c55dafadab6b5033657433401a2a85bca9a48e72dfdbd4cf2638f1e104098032f5d6e710a99afab143a77a6f67c8e32db38a924126bac426cb5
SSDEEP 1536:rvfCVk5QM0VzTMZWGYWSJHb+C47VBCO3nO9gIwcCrlNsWjcdwNTE:rH7QM4ypYXKC47LCO8krlyET
TLSH
T18EA37D1277D18075E0B30A315CA98E62463EFD764AB18E5FB394018E09746D1AB3BFB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetWindowsDirectoryW DeleteFileW LocalFree ExpandEnvironmentStringsW CreateThread ExitProcess lstrlenA FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleW HeapReAlloc WriteConsoleW SetStdHandle OutputDebugStringW RtlUnwind LoadLibraryExW FindNextFileW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection TlsFree TlsSetValue TlsGetValue FindClose GetLastError GetFileSizeEx FlushFileBuffers CreateFileW Sleep WriteFile GetProcessHeap HeapFree GetCurrentProcess HeapAlloc FindFirstFileW GetSystemTimeAsFileTime GetCommandLineA IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetLastError GetCurrentThreadId GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc HeapSize

user32

EndPaint DestroyWindow GetMessageW PostQuitMessage FillRect DrawTextW LoadCursorW SetFocus SendMessageA BeginPaint TranslateMessage RegisterClassExW LoadIconW SetRect CreateWindowExA SetWindowLongW RedrawWindow ShowWindow CreateWindowExW MessageBoxW SendMessageW UpdateWindow CallWindowProcW DefWindowProcW DispatchMessageW

advapi32

RegCloseKey AdjustTokenPrivileges RegEnumKeyExW RegOpenKeyExW FreeSid SetEntriesInAclW AllocateAndInitializeSid LookupPrivilegeValueW SetNamedSecurityInfoW RegDeleteKeyW GetTokenInformation OpenProcessToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader

kernel32

user32

advapi32

generic