2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop
Size 2.7MB
Sample260922-rlcm8avvht
SHA256 95388ec2bb756755cd1d45b154030ff2e355866d06626a356df58d125f655cc5
MD5 2ca3b4b82850879672656bcdc85884bb
SHA1 f7e3bdc9fd5bf1477cbcd4cb6eac960652f6c4d8
SHA512 d53d52784a83f90b2ca049125f06bf40bdc71ca333d05f153c3b1f8b48c32368be3a07cbf92521d50b79b53587ed198dcabef28c5beeb13fee0b8b6a1e213865
SSDEEP 49152:oiEzz7D9NzDGgQOvVqcYjYjKgGhBQOw3QZzCckUeCjL:xqfXzDGgQOvkcaYj4hBQOw3ktkUP
TLSH
T1EAD5D3B1E1AB4866E3139530D3C6D33C93656DA165A8C9CE33AA3F3407740F259267BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 2.7MB

2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 2be14a877e1721c92e18dd3a09ed16a1
SHA256 95388ec2bb756755cd1d45b154030ff2e355866d06626a356df58d125f655cc5
MD5 2ca3b4b82850879672656bcdc85884bb
SHA1 f7e3bdc9fd5bf1477cbcd4cb6eac960652f6c4d8
SHA512 d53d52784a83f90b2ca049125f06bf40bdc71ca333d05f153c3b1f8b48c32368be3a07cbf92521d50b79b53587ed198dcabef28c5beeb13fee0b8b6a1e213865
SSDEEP 49152:oiEzz7D9NzDGgQOvVqcYjYjKgGhBQOw3QZzCckUeCjL:xqfXzDGgQOvkcaYj4hBQOw3ktkUP
TLSH
T1EAD5D3B1E1AB4866E3139530D3C6D33C93656DA165A8C9CE33AA3F3407740F259267BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fa:44:e0:f7:a9:62:b6:6b:b4:a8:25:ef:fd:23:16:89:a8:cf:d1:b7

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=HANCOM. INC\,,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HANCOM. INC\,,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Oct 6, 2013

CN=HANCOM. INC\,,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HANCOM. INC\,,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=HANCOM. INC\,,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HANCOM. INC\,,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

41:03:3e:f6:19:8f:3c:99:5a:5c:4f:36:9f:30:5e:d0

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2012 - Jun 3, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1048490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Git Repository\install\HOffice90\Setup\Release\Setup.pdb

kernel32

GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA GetLocaleInfoA GetConsoleMode GetConsoleCP GetTimeZoneInformation LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount GetLastError QueryPerformanceCounter VirtualFree HeapCreate GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle GetFileType SetStdHandle VirtualQuery WriteConsoleW VirtualAlloc GetSystemTimeAsFileTime HeapSize CreateThread ExitThread ExitProcess HeapReAlloc RaiseException RtlUnwind HeapFree HeapAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW FindResourceExW VirtualProtect GetFileTime GetFileSizeEx FileTimeToLocalFileTime Sleep GetProfileIntW GetTickCount SearchPathW GetSystemDirectoryW GetTempPathW GetTempFileNameW SetErrorMode GetProcessHeap CreateFileA SetEnvironmentVariableA GetSystemInfo GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileW GetFileSize GetFileAttributesW lstrcpyW GetCurrentDirectoryW WritePrivateProfileStringW FileTimeToSystemTime lstrlenA GlobalGetAtomNameW InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags ResumeThread SetThreadPriority CloseHandle GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange InterlockedDecrement GetCurrentProcessId GetModuleHandleA CopyFileW GlobalSize GlobalAlloc MulDiv GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA FreeLibrary lstrcmpW MultiByteToWideChar GetVersionExA GlobalLock GlobalUnlock GlobalFree FreeResource lstrcpynW WideCharToMultiByte GetProcAddress GetModuleHandleW LoadLibraryW SetLastError lstrlenW GetVersionExW FindClose FindFirstFileW GetUserDefaultLangID GetPrivateProfileIntW GetPrivateProfileStringW GetModuleFileNameW WaitForSingleObject GetUserDefaultLCID CreateMutexW FindResourceW LoadResource LockResource SizeofResource LocalFree FormatMessageW

user32

IsClipboardFormatAvailable MapVirtualKeyExW IsCharLowerW GetMenuDefaultItem SetMenuDefaultItem UpdateLayeredWindow EnableScrollBar UnionRect SetCursorPos SetRect DrawFocusRect DrawFrameControl DrawIconEx UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW EmptyClipboard CloseClipboard SetClipboardData DestroyIcon CopyImage OpenClipboard DrawStateW RegisterClipboardFormatW EnumChildWindows LockWindowUpdate IsRectEmpty IsMenu GetSystemMenu SetClassLongW SetParent CreatePopupMenu NotifyWinEvent SetWindowRgn CreateAcceleratorTableW LoadAcceleratorsW DestroyAcceleratorTable GetAsyncKeyState CharUpperW GetKeyboardState GetKeyboardLayout ToUnicodeEx CopyAcceleratorTableW PostThreadMessageW SetRectEmpty DeleteMenu WaitMessage ReleaseCapture WindowFromPoint SetCapture UnregisterClassW GetSysColorBrush GetMenuItemInfoW MapVirtualKeyW GetKeyNameTextW ShowOwnedPopups SetCursor GetMessageW TranslateMessage ValidateRect SystemParametersInfoW MessageBeep RedrawWindow IsZoomed PostQuitMessage GetWindowThreadProcessId EndPaint BeginPaint GetWindowDC ClientToScreen GetMenuStringW AppendMenuW InsertMenuW RemoveMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState CheckMenuItem ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange GetScrollPos SetForegroundWindow ShowScrollBar IsWindowVisible PostMessageW GetMenuItemID GetMenuItemCount CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel GetUpdateRect CharUpperBuffW CopyIcon SubtractRect GetIconInfo GetDoubleClickTime CreateMenu MapDialogRect GetWindowRgn SystemParametersInfoA GetWindowPlacement GetWindow LoadMenuW GetSubMenu GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow DestroyCursor GetNextDlgGroupItem EnableMenuItem GetWindowLongW GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog UpdateWindow ReleaseDC FillRect GetDC PtInRect GetFocus LoadCursorW FrameRect DrawEdge GrayStringW DrawTextExW TabbedTextOutW DrawTextW InflateRect InvalidateRect GetSysColor ScreenToClient GetCursorPos KillTimer GetParent SetTimer SetScrollPos BringWindowToTop GetWindowRect IsWindow RegisterWindowMessageW DrawIcon GetClientRect GetSystemMetrics IsIconic LoadIconW MessageBoxW LoadImageW SendMessageW EnableWindow DestroyMenu

gdi32

DPtoLP GetTextMetricsW OffsetRgn GetRgnBox CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo CreateRoundRectRgn GetTextColor SetDIBColorTable GetDIBits RealizePalette StretchBlt SetPixel CreateDIBSection CreateEllipticRgn CreatePolygonRgn Polyline Ellipse Polygon Rectangle RoundRect CreatePalette GetPaletteEntries GetWindowOrgEx PtInRegion FillRgn GetBoundsRect GetViewportOrgEx LPtoDP ExtFloodFill SetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW GetTextFaceW SetPixelV SetRectRgn CombineRgn PatBlt CreateRectRgnIndirect CreateHatchBrush CreateSolidBrush CreatePen GetObjectType SelectPalette CreatePatternBrush DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject GetPixel GetWindowExtEx GetViewportExtEx SelectClipRgn FrameRgn CreateCompatibleDC SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC CopyMetaFileW GetDeviceCaps CreateBitmap SetBkColor SetTextColor GetClipBox GetDCOrgEx CreateFontIndirectW CreateRectRgn Escape ExtTextOutW TextOutW RectVisible PtVisible GetTextExtentPoint32W GetBkColor GetObjectW GetCurrentObject BitBlt CreateCompatibleBitmap GetStockObject CreateFontW DeleteObject

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegCloseKey RegDeleteKeyW RegCreateKeyW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegOpenKeyW

shell32

DragFinish ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW DragQueryFileW SHGetFolderPathW SHGetFileInfoW SHAppBarMessage

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW PathFileExistsW PathRemoveFileSpecW

ole32

OleCreateMenuDescriptor CoInitializeEx CoUninitialize OleGetClipboard DoDragDrop OleLockRunning CreateStreamOnHGlobal CoCreateInstance OleDestroyMenuDescriptor OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree OleTranslateAccelerator IsAccelerator RevokeDragDrop CoLockObjectExternal RegisterDragDrop

oleaut32

SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantInit VariantChangeType VariantClear

gdiplus

GdipBitmapUnlockBits GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCloneImage GdipDrawImageI GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipFree GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream

msi

ord70 ord92 ord78 ord150 ord32 ord159 ord160 ord118 ord8

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_2ca3b4b82850879672656bcdc85884bb_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

msi

version

imm32

winmm

generic