2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop
Size 10.5MB
Sample260922-y45v2sef68
SHA256 8629369621886c8db847937ac3527693192610dc12ae29729af4e42888a8744c
MD5 5a9e3934481a02d4484b211b78175b31
SHA1 e61f2f0997be4495e31d111462371c945ff62b19
SHA512 961f923323a2d5a23c34e186e5ba09fbe0356a35ee21b613a05bdef4a8b79db901688af0ac8f7164013d1d00f755f79a1c56323406d7bf2ae0cbc95f2c42c5c7
SSDEEP 196608:KcoB61ugS+5JSe6IV7xhnNipGGl5MZMb12q3Qu9CehYePbtf:YgS++e6cxhnspGGlwMb1vgu9LvR
TLSH
T191B612233A908C7EC73725365149B379E2A99E308D3452D7A7907E382E7858285FF61F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop

File Explorer

2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop

.exe 10.5MB

2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop

IMPHASH 8916f234ec2c739866776422fdd710a0
SHA256 8629369621886c8db847937ac3527693192610dc12ae29729af4e42888a8744c
MD5 5a9e3934481a02d4484b211b78175b31
SHA1 e61f2f0997be4495e31d111462371c945ff62b19
SHA512 961f923323a2d5a23c34e186e5ba09fbe0356a35ee21b613a05bdef4a8b79db901688af0ac8f7164013d1d00f755f79a1c56323406d7bf2ae0cbc95f2c42c5c7
SSDEEP 196608:KcoB61ugS+5JSe6IV7xhnNipGGl5MZMb12q3Qu9CehYePbtf:YgS++e6cxhnspGGlwMb1vgu9LvR
TLSH
T191B612233A908C7EC73725365149B379E2A99E308D3452D7A7907E382E7858285FF61F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6a:15:1e:15:3f:55:22:f4:85:73:54:22:78:2a:d5:bc:eb:55:8a:17:f4:c8:37:b5:c9:53:8c:b8:7d:e3:dd:13

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

May 2, 2023

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

fb:0e:02:33:cc:05:e9:b4:ea:fe:b4:2c:63:e1:d1:07:f7:58:2a:b6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

May 2, 2023

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

SERIALNUMBER=135-81-89111,CN=Interezen. Co.\,Ltd,O=Interezen. Co.\,Ltd,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

38:22:b5:b0:85:ec:63:83:c5:d3:d5:73:52:f0:b8:b7

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2023 - Mar 30, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1080635

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ipinside_windows_client\trunk\client\LWS\Windows_original\I3GSvcManager\Release\I3GSvcManager.pdb

ws2_32

inet_ntoa ntohs

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

iphlpapi

GetTcpTable

kernel32

GetConsoleMode GetConsoleCP WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetDriveTypeA CompareStringW GetCurrentProcess SizeofResource LockResource LoadResource FindResourceA MultiByteToWideChar WideCharToMultiByte Sleep GetEnvironmentStringsW RemoveDirectoryA DeleteFileA SetFileAttributesA CloseHandle FreeLibrary GetProcAddress LoadLibraryA MoveFileExA CreateDirectoryA GetVersionExA GetSystemDirectoryA WriteFile MoveFileA CreateFileA InitializeCriticalSectionAndSpinCount Process32Next TerminateProcess GetPriorityClass OpenProcess Process32First FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStringTypeW GetStringTypeA VirtualFree HeapCreate GetStdHandle SetHandleCount LCMapStringW LCMapStringA IsValidCodePage GetACP GetFileType SetStdHandle HeapSize HeapReAlloc VirtualQuery VirtualAlloc ExitThread ExitProcess GetStartupInfoA GetCommandLineA RaiseException IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind GetSystemTimeAsFileTime GetTimeZoneInformation FindResourceExA CreateToolhelp32Snapshot WaitForSingleObject GetLastError QueryPerformanceCounter VirtualProtect GetWindowsDirectoryA CopyFileA GetModuleFileNameA GetProfileIntA GetTickCount SearchPathA GetTempPathA GetTempFileNameA GetOEMCP GetCPInfo GetFileTime GetFileSizeEx SetErrorMode GetModuleHandleW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle TlsGetValue LocalAlloc GetPrivateProfileIntA GlobalFlags DeleteCriticalSection InitializeCriticalSection GlobalReAlloc EnterCriticalSection LeaveCriticalSection lstrcpyA FreeResource GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetFullPathNameA GetVolumeInformationA DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers FindFirstFileA FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileA FindClose InterlockedDecrement GetModuleFileNameW GlobalFree GlobalSize GlobalUnlock FormatMessageA LocalFree lstrlenW MulDiv GetCurrentProcessId GetModuleHandleA SetLastError GlobalAddAtomA GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA CompareStringA InterlockedExchange GlobalLock lstrcmpA GlobalAlloc CreateThread SetThreadPriority ResumeThread SetFileTime GetCurrentDirectoryA GetFileAttributesA LocalFileTimeToFileTime SystemTimeToFileTime ReadFile SetFilePointer GetPrivateProfileStringA GetPrivateProfileSectionNamesA WritePrivateProfileStringA lstrlenA GetProcessHeap HeapAlloc HeapFree GetSystemInfo CreateMutexA ReleaseMutex

user32

DefFrameProcA IsClipboardFormatAvailable MapVirtualKeyExA GetKeyNameTextA IsCharLowerA UnpackDDElParam ReuseDDElParam InsertMenuItemA TranslateAcceleratorA GetMenuDefaultItem SetMenuDefaultItem UpdateLayeredWindow EnableScrollBar UnionRect SetCursorPos DrawIconEx DrawFocusRect DrawFrameControl DrawEdge GetMenuItemInfoA UnregisterClassA EmptyClipboard CloseClipboard SetClipboardData LoadImageA DestroyIcon CopyImage OpenClipboard DrawStateA RegisterClipboardFormatA EnumChildWindows LockWindowUpdate BringWindowToTop IsRectEmpty KillTimer SetTimer InflateRect ReleaseCapture IsMenu SetCapture GetSystemMenu DeleteMenu SetClassLongA WindowFromPoint SetParent CreatePopupMenu NotifyWinEvent SetWindowRgn CreateAcceleratorTableA LoadAcceleratorsA DestroyAcceleratorTable GetAsyncKeyState GetKeyboardState GetKeyboardLayout MapVirtualKeyA ToAsciiEx CopyAcceleratorTableA DestroyMenu GetDesktopWindow WaitMessage PostThreadMessageA LoadMenuA GetSysColorBrush ShowWindow MoveWindow SetWindowTextA IsDialogMessageA CheckDlgButton RegisterWindowMessageA LoadIconA SendDlgItemMessageA IsChild GetCapture GetClassLongA GetClassNameA DefMDIChildProcA GetPropA RemovePropA IsWindow SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow GetClientRect CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect GetMenu SetWindowLongA IntersectRect IsIconic GetWindowPlacement GetWindowRect GetWindow GetSysColor EndPaint BeginPaint GetWindowDC ClientToScreen ScreenToClient GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect CharUpperA UnhookWindowsHookEx GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA GetMenuItemCount GetSubMenu RemoveMenu GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled ShowOwnedPopups DrawMenuBar TranslateMDISysAccel FrameRect GetUpdateRect EndDialog GetNextDlgTabItem CreateDialogIndirectParamA CharUpperBuffA CopyIcon SubtractRect GetIconInfo GetDoubleClickTime CreateMenu MapDialogRect GetWindowRgn SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA DestroyCursor GetNextDlgGroupItem SetPropA DrawIcon GetCursorPos ValidateRect PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions GetFocus GetParent ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem WinHelpA SystemParametersInfoA OffsetRect MessageBeep RedrawWindow IsZoomed SendMessageA SetWindowPos EnableWindow LoadCursorA InvalidateRect ReleaseDC GetDC LoadBitmapA SetRect wsprintfA GetSystemMetrics MessageBoxA FindWindowA PostMessageA ExitWindowsEx SetRectEmpty

gdi32

SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutA ExtTextOutA Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush SelectPalette GetObjectType CreatePen CreateSolidBrush CreateHatchBrush GetDCOrgEx CreateRectRgnIndirect OffsetRgn GetRgnBox CreateDIBitmap CreateCompatibleBitmap GetTextMetricsA EnumFontFamiliesA GetTextCharsetInfo CreateRoundRectRgn GetTextColor SetDIBColorTable PatBlt GetDIBits CombineRgn StretchBlt SetPixel CreateDIBSection SetRectRgn DPtoLP CreateEllipticRgn CreatePolygonRgn GetBkColor Polyline Ellipse Polygon Rectangle RoundRect GetPaletteEntries GetWindowOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect GetViewportOrgEx LPtoDP ExtFloodFill SetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExA GetTextFaceA SetPixelV SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CopyMetaFileA GetDeviceCaps CreateBitmap GetStockObject DeleteObject BitBlt RealizePalette CreateCompatibleDC CreatePalette GetTextExtentPoint32A GetObjectA CreateFontIndirectA

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegOpenKeyA GetTokenInformation RegQueryValueExA RegQueryValueA RegEnumKeyA RegDeleteKeyA AdjustTokenPrivileges RegCreateKeyExA RegEnumKeyExA RegDeleteValueA RegSetValueExA

shell32

DragFinish SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHAppBarMessage ShellExecuteA DragQueryFileA SHGetSpecialFolderPathA SHBrowseForFolderA SHGetPathFromIDListA

comctl32

ImageList_GetIconSize

shlwapi

PathFileExistsA PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA PathAppendA PathRemoveFileSpecW

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx OleGetClipboard DoDragDrop OleLockRunning CreateStreamOnHGlobal OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoCreateInstance CoUninitialize RevokeDragDrop CoLockObjectExternal RegisterDragDrop

oleaut32

VariantInit SysAllocString VariantChangeType VariantClear SysFreeString SysStringLen SysAllocStringLen

gdiplus

GdipDrawImageI GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipCloneImage

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_5a9e3934481a02d4484b211b78175b31_amadey_darkgate_elex_floxif_hijackloader_smoke-loader_stop

PE Signature issue

PE Signature issue

ws2_32

version

iphlpapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

imm32

winmm

generic