2026-09-11_10c5f9d3942231b1550c77a93ccb1a3f_amadey_darkgate_elex_glassworm_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-11_10c5f9d3942231b1550c77a93ccb1a3f_amadey_darkgate_elex_glassworm_maze_smoke-loader
Size 628KB
Sample260912-qcsgmscc72
SHA256 ed2302c0431f93d33ee7aa0f7caab5d701ca169fb089979f4ff499bd4a1ea326
MD5 10c5f9d3942231b1550c77a93ccb1a3f
SHA1 a93f7d54247409f086e09478c5a184579dce977e
SHA512 aee5d93ce48fedfc2321746fd6a5356388cac7d6d4156ba2dd8573267eb84b50e8150a3c112cd60974253a852f4b0ddcb8842c0ba40290501e716a6ec6d51663
SSDEEP 12288:hIO0tcg+XaaxsGB5UXxRvid16eGDF4KYU0Hv0D8:iOgzkKwqifCjYU0Hv0
TLSH
T1F6D4C021B762D130F9A201356AAC86F6593CBD312B6640D373953B5E9E715E0EE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-11_10c5f9d3942231b1550c77a93ccb1a3f_amadey_darkgate_elex_glassworm_maze_smoke-loader

File Explorer

2026-09-11_10c5f9d3942231b1550c77a93ccb1a3f_amadey_darkgate_elex_glassworm_maze_smoke-loader

.exe 628KB

2026-09-11_10c5f9d3942231b1550c77a93ccb1a3f_amadey_darkgate_elex_glassworm_maze_smoke-loader

IMPHASH 59b66fab76102c07585b1d4153fe9799
SHA256 ed2302c0431f93d33ee7aa0f7caab5d701ca169fb089979f4ff499bd4a1ea326
MD5 10c5f9d3942231b1550c77a93ccb1a3f
SHA1 a93f7d54247409f086e09478c5a184579dce977e
SHA512 aee5d93ce48fedfc2321746fd6a5356388cac7d6d4156ba2dd8573267eb84b50e8150a3c112cd60974253a852f4b0ddcb8842c0ba40290501e716a6ec6d51663
SSDEEP 12288:hIO0tcg+XaaxsGB5UXxRvid16eGDF4KYU0Hv0D8:iOgzkKwqifCjYU0Hv0
TLSH
T1F6D4C021B762D130F9A201356AAC86F6593CBD312B6640D373953B5E9E715E0EE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\bin\build\Release\360Game.pdb

kernel32

MoveFileExW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW InterlockedExchange GetSystemDirectoryW SetCurrentDirectoryW WaitForSingleObject CreateEventW OpenEventW MoveFileW GetCurrentThread CreateMutexW WritePrivateProfileStringW GetCurrentProcess OpenProcess Sleep GetTickCount GetTempPathW GetTempFileNameW LoadLibraryExW ExitProcess ReleaseMutex lstrcpynW ReplaceFileW GetVersionExW VirtualQuery InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteFileW SetFileAttributesW GetProcAddress LeaveCriticalSection EnterCriticalSection FreeLibrary DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW GetModuleHandleW GetCurrentProcessId CloseHandle DeviceIoControl GetWindowsDirectoryW CreateFileW ReadProcessMemory WaitForMultipleObjects IsDebuggerPresent OutputDebugStringW CreateFileA SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetFilePointerEx WriteFile ReadFile GetFileSizeEx FormatMessageW MultiByteToWideChar SetLastError GetCurrentThreadId GetSystemTime TlsGetValue TlsSetValue HeapUnlock OpenThread HeapLock HeapWalk TlsAlloc TlsFree EncodePointer CreateThread ExitThread GetCommandLineW RtlUnwind IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo GetModuleHandleExW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW GetStringTypeW GetStdHandle GetFileType QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers ReadConsoleW SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA CreateDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW

user32

MessageBoxW

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW SHGetValueW PathAddBackslashW PathAppendW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW

advapi32

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

44KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

75KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=199, version=41118,

count=28, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=222, id=224, productName=VS2013 build 21005, version=21005,

count=74, id=225, productName=VS2013 build 21005, version=21005,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=244, id=1, productName=Unmarked objects,

count=33, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,