2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 1.7MB
Sample260905-fdcsgaep2y
SHA256 ee52513216fae7b629596532e89454eb9bbd11d9c5b3bdae73f0baa46e544160
MD5 8631b2de83f53d2a541d6a017b3e4791
SHA1 484394865a29f29780c79c3f033793c7d373cb86
SHA512 ac56551614dba0ffa5618c5b0d527c8069bf42f2280b95fcde2efb9f976f5e9eea27cfb62c749b18d34ca14de7004212599d17048fc57fb648b038b3a768a2f8
SSDEEP 49152:wNZCWOLT4/jGSzmGK2MtEN4OTxdiXYyE:GwnLTMGSOET3m
TLSH
T1F9856B1667F95128F1F37B71EEB992645A77BC71AE3AC50E6280025E0CB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 1.7MB

2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 5b02d930e340e0ac871ec494d50401a7
SHA256 ee52513216fae7b629596532e89454eb9bbd11d9c5b3bdae73f0baa46e544160
MD5 8631b2de83f53d2a541d6a017b3e4791
SHA1 484394865a29f29780c79c3f033793c7d373cb86
SHA512 ac56551614dba0ffa5618c5b0d527c8069bf42f2280b95fcde2efb9f976f5e9eea27cfb62c749b18d34ca14de7004212599d17048fc57fb648b038b3a768a2f8
SSDEEP 49152:wNZCWOLT4/jGSzmGK2MtEN4OTxdiXYyE:GwnLTMGSOET3m
TLSH
T1F9856B1667F95128F1F37B71EEB992645A77BC71AE3AC50E6280025E0CB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

364036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\CB\ARM_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord119 ord118 ord16 ord171 ord70 ord205 ord123 ord120 ord114 ord160 ord159 ord141 ord8 ord116 ord32 ord92 ord115 ord131 ord150 ord78 ord181 ord195 ord281 ord240 ord88

psapi

GetModuleFileNameExW GetModuleBaseNameW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetConnectW HttpOpenRequestW InternetOpenW InternetErrorDlg InternetSetOptionW InternetCloseHandle DeleteUrlCacheEntryW InternetCrackUrlW InternetReadFile HttpQueryInfoW HttpSendRequestW

sensapi

IsNetworkAlive

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData

kernel32

FlushFileBuffers LockFile UnlockFile DuplicateHandle GetFullPathNameW GetModuleFileNameW InterlockedExchange CompareStringA LoadLibraryExW GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThreadId GlobalDeleteAtom FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime SetThreadPriority ResumeThread SuspendThread GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA CompareStringW FreeResource GetFileAttributesExW GetFileSizeEx GetFileTime InterlockedIncrement LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree SetErrorMode GlobalFlags GetStartupInfoW GetSystemTimeAsFileTime SetEnvironmentVariableW ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentDirectoryA GetDriveTypeA GetCPInfo GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv InterlockedDecrement GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW UnmapViewOfFile OpenFileMappingW MapViewOfFile GetVolumeInformationW HeapFree GetProcessHeap HeapAlloc OpenEventW Module32NextW Module32FirstW Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot FindResourceExW lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetVersionExW lstrlenA WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary GetPrivateProfileSectionNamesW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW GetCurrentThread GetCurrentProcess GetLocalTime MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LocalFree FormatMessageW GetThreadLocale GetModuleHandleW VirtualAlloc VirtualFree GetTempPathW WaitForSingleObject OpenProcess CopyFileW GetProcAddress GetACP LoadLibraryW lstrlenW GetTickCount CreateEventW SetLastError Sleep SetEvent GetThreadPriority MultiByteToWideChar CloseHandle CreateFileW ReadFile SetFilePointer GetFileSize CreateFileA FindClose FindFirstFileW DeleteFileW SetFileAttributesW SetFileTime WriteFile GetLastError CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource GlobalFindAtomW

user32

GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu ShowScrollBar CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SystemParametersInfoA GetWindowPlacement CopyRect GetSysColor EndPaint BeginPaint ReleaseDC GetDC ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetWindowTextLengthW SetFocus ShowWindow SetWindowLongW GetDlgCtrlID IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuStringW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow KillTimer DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow UnregisterClassW PostMessageW SetWindowPos GetForegroundWindow GetSysColorBrush DestroyMenu MessageBoxW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem SendDlgItemMessageA EndDialog WinHelpW

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject GetTextExtentPoint32W CreateFontIndirectW GetObjectW Escape

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegCloseKey RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegFlushKey ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW ConvertSidToStringSidW LookupAccountNameW RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegDeleteValueW RegOpenKeyExW RegQueryInfoKeyW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountSidW GetUserNameW OpenThreadToken OpenProcessToken DuplicateToken CheckTokenMembership IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ShellExecuteW SHGetFolderPathW SHCreateDirectoryExW SHFileOperationW SHAppBarMessage Shell_NotifyIconW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathStripToRootW PathFindFileNameW PathFindExtensionW PathIsUNCW SHDeleteKeyW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance CoInitialize OleRun

oleaut32

SysAllocString VariantChangeType VariantCopy VariantInit SysStringByteLen SysAllocStringByteLen VariantClear SysFreeString GetErrorInfo

urlmon

URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

crypt32

CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CryptUnprotectData CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertFreeCertificateContext

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_8631b2de83f53d2a541d6a017b3e4791_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

generic