2026-09-25_ff7a1fb4564eb807cbf746691cb4f589_amadey_darkgate_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_ff7a1fb4564eb807cbf746691cb4f589_amadey_darkgate_elex_smoke-loader_stop
Size 933KB
Sample260925-t67efa1dpd
SHA256 855563bd19525dde740486405cf1df2a7fd058d22f43f20762c85d90791fa1bf
MD5 ff7a1fb4564eb807cbf746691cb4f589
SHA1 cd72ccb93ca9119abcea63ea98a2f44b5dde7f47
SHA512 b7207332bff2ee9711122a06913635aaefca841e421b48a100b3f0ed542b04269ca023f1c6a2d6b042f148d45c74b898bfd1fcad6cffcf39d47c0a13dff1d681
SSDEEP 24576:bNfk9jTsgA8dAQ+nf3c5vcyj9UbtMOgohQJJABvk:W8JdMeGPgvk
TLSH
T14F158D51BBF681F2E68214B4247BF73B6C39728E1314C6C7E3A46D294B112D0A97939F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-25_ff7a1fb4564eb807cbf746691cb4f589_amadey_darkgate_elex_smoke-loader_stop

.exe 933KB

2026-09-25_ff7a1fb4564eb807cbf746691cb4f589_amadey_darkgate_elex_smoke-loader_stop

IMPHASH b699309d4a21289347f1c982b096e4fe
SHA256 855563bd19525dde740486405cf1df2a7fd058d22f43f20762c85d90791fa1bf
MD5 ff7a1fb4564eb807cbf746691cb4f589
SHA1 cd72ccb93ca9119abcea63ea98a2f44b5dde7f47
SHA512 b7207332bff2ee9711122a06913635aaefca841e421b48a100b3f0ed542b04269ca023f1c6a2d6b042f148d45c74b898bfd1fcad6cffcf39d47c0a13dff1d681
SSDEEP 24576:bNfk9jTsgA8dAQ+nf3c5vcyj9UbtMOgohQJJABvk:W8JdMeGPgvk
TLSH
T14F158D51BBF681F2E68214B4247BF73B6C39728E1314C6C7E3A46D294B112D0A97939F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

64:13:35:79:bd:f4:25:66:08:a9:47:19:25:95:29:ff:8d:32:39:7a:b2:53:f9:ec:c5:b6:bd:c4:88:e5:ea:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shandong China Soft Goldencis Software Co.\,ltd.,O=Shandong China Soft Goldencis Software Co.\,ltd.,L=济南市,ST=山东省,C=CN

Chains

Dec 21, 2020

CN=Shandong China Soft Goldencis Software Co.\,ltd.,O=Shandong China Soft Goldencis Software Co.\,ltd.,L=济南市,ST=山东省,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

ae:e5:41:f1:55:ba:91:d0:d9:20:b5:e5:c3:3a:70:d4:b6:9f:f1:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Shandong China Soft Goldencis Software Co.\,ltd.,O=Shandong China Soft Goldencis Software Co.\,ltd.,L=济南市,ST=山东省,C=CN

Chains

Dec 21, 2020

CN=Shandong China Soft Goldencis Software Co.\,ltd.,O=Shandong China Soft Goldencis Software Co.\,ltd.,L=济南市,ST=山东省,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Shandong China Soft Goldencis Software Co.\,ltd.,O=Shandong China Soft Goldencis Software Co.\,ltd.,L=济南市,ST=山东省,C=CN

Serial Number

0e:1b:ec:ac:a9:f3:8f:48:2a:d1:8a:e0:8b:07:eb:89

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2020 - Sep 22, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

639067

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\WorkSpace\Code\NacpClient\client10\trunk\plugins\gdremoteassistrequest\Release\gdremoteassistrequest.pdb

ws2_32

recvfrom sendto getaddrinfo freeaddrinfo getpeername getsockopt ntohs getsockname send select __WSAFDIsSet accept listen ioctlsocket htonl ntohl gethostname htons setsockopt WSAStartup WSACleanup WSAIoctl connect inet_addr recv bind socket WSASetLastError closesocket WSAGetLastError

advapi32

CryptHashData OpenProcessToken CryptDestroyHash CryptGetHashParam CryptAcquireContextA CryptGenRandom CryptReleaseContext CreateProcessAsUserW SetTokenInformation DuplicateTokenEx CryptCreateHash

wldap32

ord60 ord22 ord211 ord143 ord26 ord50 ord30 ord32 ord35 ord79 ord200 ord33 ord46 ord41 ord27 ord301

kernel32

LCMapStringA LCMapStringW GetCPInfo FindFirstFileA lstrcmpA OutputDebugStringW lstrcmpiA CreateEventW lstrcpyW OutputDebugStringA CloseHandle lstrcpynA GetLocalTime lstrcmpiW lstrlenA GetProcAddress GetModuleHandleA lstrcpyA WideCharToMultiByte MultiByteToWideChar HeapReAlloc CreateFileA SetFilePointer VirtualQuery SetEndOfFile FindResourceW FreeLibrary LoadResource HeapAlloc SystemTimeToFileTime GetCurrentProcess HeapFree GlobalLock WaitForSingleObject TlsGetValue GetTickCount GetProcessHeap WriteFile GetDriveTypeA GlobalAlloc LoadLibraryW Sleep SizeofResource GetExitCodeProcess lstrcpynW TerminateProcess FileTimeToSystemTime ReadFile GetModuleFileNameW CreateFileW RtlUnwind GetACP lstrlenW GlobalUnlock GetLastError SetLastError FindClose LockResource Module32FirstW CreateToolhelp32Snapshot OpenEventW GetCurrentThreadId Module32NextW FileTimeToLocalFileTime GetCurrentProcessId GetFileInformationByHandle MulDiv InterlockedIncrement InterlockedDecrement GetFileSize FreeResource GetCurrentDirectoryW TlsAlloc DosDateTimeToFileTime GetFileType DuplicateHandle LoadLibraryA VerifyVersionInfoA VerSetConditionMask DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SleepEx FormatMessageA PeekNamedPipe WaitForMultipleObjects GetStdHandle ExpandEnvironmentStringsA TlsSetValue TlsFree GetSystemTimeAsFileTime ExitThread HeapSize GetModuleFileNameA GetOEMCP IsValidCodePage GetTimeZoneInformation CreateThread RaiseException InterlockedExchange UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA HeapCreate VirtualFree VirtualAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetFullPathNameA GetCurrentDirectoryA GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA GetModuleHandleW ExitProcess

user32

GetCaretPos EnableWindow GetCaretBlinkTime SetWindowTextW IsRectEmpty GetParent IntersectRect MonitorFromWindow GetCursorPos MapWindowPoints GetMonitorInfoW SetCursor CharNextW LoadCursorW EndPaint ClientToScreen DestroyWindow SetTimer FillRect SetCapture InvalidateRgn CreateAcceleratorTableW SetFocus BeginPaint PtInRect GetDC GetGUIThreadInfo InvalidateRect ReleaseDC GetWindowTextW DefWindowProcW GetWindowRect GetFocus GetWindowTextLengthW SetCaretPos CreateCaret GetSysColor GetWindowLongW ShowCaret GetWindowRgn SetWindowPos ShowWindow IsWindow SendMessageW MoveWindow ScreenToClient PostQuitMessage IsIconic GetClientRect MessageBoxW wsprintfA wvsprintfW OffsetRect DrawTextW CharPrevW SetRect KillTimer GetUpdateRect UnionRect GetActiveWindow IsWindowVisible GetMessageW LoadImageW PostMessageW GetClassInfoExW SetPropW TranslateMessage RegisterClassExW SetWindowLongW CreateWindowExW RegisterClassW GetSystemMetrics GetPropW CallWindowProcW GetWindow DispatchMessageW HideCaret ReleaseCapture GetKeyState

gdi32

BitBlt SetStretchBltMode GetTextMetricsW DeleteDC SelectObject CreateCompatibleDC GetCharABCWidthsW ExtTextOutW CombineRgn CreateRectRgnIndirect CreateCompatibleBitmap CreatePenIndirect SetWindowOrgEx GdiFlush SetBkColor GetClipBox CreateDIBSection LineTo GetTextExtentPoint32W MoveToEx Rectangle SaveDC CreatePen CreateRectRgn PtInRegion CreateRoundRectRgn SelectClipRgn TextOutW CreateFontIndirectW GetObjectW GetStockObject GetObjectA SetTextColor ExtSelectClipRgn StretchBlt RoundRect SetBkMode RestoreDC CreatePatternBrush CreateSolidBrush DeleteObject GetDeviceCaps

ole32

CoCreateGuid OleLockRunning CoCreateInstance CLSIDFromString CreateStreamOnHGlobal CoInitialize CLSIDFromProgID CoUninitialize

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

gdiplus

GdipFree GdipDeletePen GdipCloneBrush GdipDeleteBrush GdipGetImageHeight GdipCreateMatrix GdipDeleteGraphics GdipSetWorldTransform GdipSetSmoothingMode GdipCreatePen2 GdipTranslateMatrix GdipAlloc GdipRotateMatrix GdipCreateFromHDC GdipDrawImageRect GdipDrawArc GdipDeleteMatrix GdipImageRotateFlip GdipGetImageWidth GdipCreatePen1 GdipSetLineBlend GdipLoadImageFromStream GdipDrawImageRectI GdipImageGetFrameDimensionsList GdipImageSelectActiveFrame GdipGetPropertyItem GdipDisposeImage GdipGetPropertyItemSize GdipImageGetFrameDimensionsCount GdipCloneImage GdipImageGetFrameCount GdiplusShutdown GdipCreateFontFromLogfontA GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdiplusStartup GdipCreateFontFromDC GdipDeleteStringFormat GdipSetPixelOffsetMode GdipCreateStringFormat GdipSetInterpolationMode GdipCreateLineBrushI GdipSetCompositingQuality GdipDrawString GdipDeleteFontFamily GdipGetFamily GdipDrawImage GdipGraphicsClear GdipSetStringFormatAlign GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateLineBrushFromRectWithAngle GdipDeleteFont

shlwapi

PathAddBackslashW SHGetValueW SHSetValueW SHGetValueA PathFindFileNameW wvnsprintfW wnsprintfA SHDeleteValueA PathAppendW StrNCatW wnsprintfW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

comctl32

_TrackMouseEvent ord17

imm32

ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_ff7a1fb4564eb807cbf746691cb4f589_amadey_darkgate_elex_smoke-loader_stop

ws2_32

advapi32

wldap32

kernel32

user32

gdi32

ole32

oleaut32

gdiplus

shlwapi

wtsapi32

userenv

comctl32

imm32

generic