2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader
Size 3.6MB
Sample260821-bt3xdatxbx
SHA256 e01b9ffab9537deaa6345a68b9fc1db4507b69108383b0680e23f3191f9a65ec
MD5 da288e5fe76c19935a657b952fb8bcdb
SHA1 5787e99a85aa2672f80af390b1a4f9f017c63393
SHA512 2c280803e852e5adbf859e03e1d305f4341349006aa76eda34ff581e1e2a5fed5b8f9c062212ae2589f0d6a404bda8c85ecacbba00c7e1befc19abbfb1f4faf6
SSDEEP 49152:xQJvfW/5UUCFzQ7wxCLVd93US/japFsB6hxT+XZIKousiItr41FBo7/B3+PGCvUa:xSvuXCOwbs2FsghYjb7Itr41Po9uugN
TLSH
T1730622062FC375A8D88BB9304716ED6FF9BA5662D720CDC748A82F434C636BC5439792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader

File Explorer

2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader

.exe 3.6MB

2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader

IMPHASH beb7facab7f07127d1fb5ca83d498e9f
SHA256 e01b9ffab9537deaa6345a68b9fc1db4507b69108383b0680e23f3191f9a65ec
MD5 da288e5fe76c19935a657b952fb8bcdb
SHA1 5787e99a85aa2672f80af390b1a4f9f017c63393
SHA512 2c280803e852e5adbf859e03e1d305f4341349006aa76eda34ff581e1e2a5fed5b8f9c062212ae2589f0d6a404bda8c85ecacbba00c7e1befc19abbfb1f4faf6
SSDEEP 49152:xQJvfW/5UUCFzQ7wxCLVd93US/japFsB6hxT+XZIKousiItr41FBo7/B3+PGCvUa:xSvuXCOwbs2FsghYjb7Itr41Po9uugN
TLSH
T1730622062FC375A8D88BB9304716ED6FF9BA5662D720CDC748A82F434C636BC5439792
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109298

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode OpenFileMappingW SetFilePointer SetEndOfFile GlobalLock GlobalUnlock GetLocalTime QueryDosDeviceW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW FindFirstFileW FindClose FindNextFileW FlushFileBuffers SetFileTime GetFileTime CreateDirectoryW ExpandEnvironmentStringsW GetProcessHeap HeapFree QueryPerformanceFrequency QueryPerformanceCounter GetOverlappedResult ConnectNamedPipe GetConsoleOutputCP FreeConsole GetStdHandle GlobalAlloc GlobalFree GetSystemDirectoryW GetModuleHandleW GetWindowsDirectoryW RemoveDirectoryW GetComputerNameW OutputDebugStringW lstrcmpiW ResumeThread lstrcpynA VirtualProtect DisconnectNamedPipe CreateThread lstrcmpA ExitThread IsProcessorFeaturePresent HeapReAlloc GetStringTypeW LCMapStringW HeapSize RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo IsDebuggerPresent UnhandledExceptionFilter LoadLibraryW GetSystemTimeAsFileTime GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer HeapCreate DecodePointer GetStartupInfoW HeapSetInformation GetCommandLineW HeapAlloc QueueUserAPC GetQueuedCompletionStatus GetCurrentThread TerminateThread CreateIoCompletionPort LocalReAlloc PostQueuedCompletionStatus LocalUnlock MapViewOfFile CreateFileMappingW VirtualFree VirtualAlloc LeaveCriticalSection EnterCriticalSection GetSystemInfo GetSystemDefaultLCID GetSystemTime GetModuleHandleA GlobalMemoryStatus lstrcpyW GetModuleFileNameW DeleteFileW OpenProcess GetVersionExW GetCurrentThreadId SetUnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar WideCharToMultiByte lstrlenW WriteFile SetFileAttributesW ReadFile GetFileSize CreateFileW lstrcpyA lstrcmpW lstrcpynW WaitForMultipleObjects GetTickCount CreateEventW CreateProcessW GetCurrentProcessId GetLastError ExitProcess GetCurrentProcess TerminateProcess lstrlenA CloseHandle WaitForSingleObject SetEvent GetProcAddress LoadLibraryA Sleep ResetEvent VirtualQuery LocalLock LocalFree LocalAlloc SetLastError

user32

CreateDesktopW CloseClipboard GetClipboardData OpenClipboard CloseDesktop CreateWindowExW SetWindowLongW SetTimer SetWindowsHookExW GetMessageW TranslateMessage DispatchMessageW KillTimer UnhookWindowsHookEx CallNextHookEx DefWindowProcW PostQuitMessage GetForegroundWindow GetWindowTextW GetClassNameW GetWindowThreadProcessId GetAsyncKeyState GetSystemMetrics wsprintfW wsprintfA PostMessageA CloseWindowStation SetThreadDesktop GetThreadDesktop OpenInputDesktop SetProcessWindowStation GetProcessWindowStation OpenWindowStationW keybd_event mouse_event SetCursorPos SetCapture WindowFromPoint EnumDisplayMonitors GetMonitorInfoW LoadCursorW DestroyIcon GetIconInfo MessageBoxW ExitWindowsEx GetKeyState

gdi32

CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap GdiFlush BitBlt GetDeviceCaps DeleteDC DeleteObject GetDIBits CreateDCW SelectObject

advapi32

RevertToSelf RegOverridePredefKey RegOpenCurrentUser ImpersonateLoggedOnUser RegEnumValueA RegOpenKeyW GetLengthSid LookupAccountSidW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken ChangeServiceConfigW StartServiceW ControlService QueryServiceConfig2W QueryServiceConfigW EnumServicesStatusExW RegQueryValueExW RegEnumKeyExW RegCreateKeyExW InitiateSystemShutdownA RegDeleteValueW RegSetValueExW RegOpenKeyExW RegDeleteValueA RegOpenKeyA RegCloseKey DeleteService CloseServiceHandle OpenServiceW OpenSCManagerW RegEnumValueW

shell32

ExtractIconExW SHFileOperationW

odbc32

ord61 ord2 ord157 ord31 ord171 ord24 ord75 ord141 ord111 ord9 ord18 ord127 ord13 ord43 ord136

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

mpr

WNetOpenEnumW WNetCloseEnum WNetEnumResourceW

ws2_32

WSAStartup WSARecvFrom closesocket WSASocketA getsockname bind WSASendTo WSACleanup WSAGetLastError htons WSAIoctl setsockopt

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_da288e5fe76c19935a657b952fb8bcdb_amadey_darkgate_elex_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

odbc32

wtsapi32

mpr

ws2_32

generic