2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 14.8MB
Sample260928-2kl6dawthy
SHA256 a4cb6bc6c180574d5667d6c7278872a8364f301f3a449b7cbf7cb27d9c5d2e18
MD5 e91119a3dd1739c45b14b41e27eed573
SHA1 e4d54dc714571a61613acdc395927c076d927564
SHA512 024c3361f45bade1486bcf22930f836343a47f1a7d8dc3f9dfd52c1c7ea15a2273b2f65cbd0d43d72835322f020d51b08fae867919af3b20fe96468ae52f8c17
SSDEEP 393216:crJsHSbJtkiwsDejCodWGeopdGQ64VjIw0yz70LJuXA+ur:R4wsDudWOpdr1IVyzAaM
TLSH
T134F63330B7C5C22AF623393762A6CA5799565D5C6B88B4FB9049B50EDF7B0F1BC30209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop

.exe 14.8MB

2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 4ac2ab595dd79a6402cba6b431d0a230
SHA256 a4cb6bc6c180574d5667d6c7278872a8364f301f3a449b7cbf7cb27d9c5d2e18
MD5 e91119a3dd1739c45b14b41e27eed573
SHA1 e4d54dc714571a61613acdc395927c076d927564
SHA512 024c3361f45bade1486bcf22930f836343a47f1a7d8dc3f9dfd52c1c7ea15a2273b2f65cbd0d43d72835322f020d51b08fae867919af3b20fe96468ae52f8c17
SSDEEP 393216:crJsHSbJtkiwsDejCodWGeopdGQ64VjIw0yz70LJuXA+ur:R4wsDudWOpdr1IVyzAaM
TLSH
T134F63330B7C5C22AF623393762A6CA5799565D5C6B88B4FB9049B50EDF7B0F1BC30209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

5a:4b:51:28:2f:ff:b4:94:c1:91:25:c8:40:46:97:59:e3:47:14:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Advanced System Repair Inc,O=Advanced System Repair Inc,L=Newport Coast,ST=California,C=US

Chains

Apr 18, 2022

CN=Advanced System Repair Inc,O=Advanced System Repair Inc,L=Newport Coast,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=Advanced System Repair Inc,O=Advanced System Repair Inc,L=Newport Coast,ST=California,C=US

Serial Number

0a:96:b3:7a:c2:79:36:d5:57:6c:9e:9d:c2:53:01:fb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2022 - Mar 6, 2024

Minor OS version

Major OS version

Entry point

168612

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdiplus

GdipDisposeImage GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdipAlloc GdipFree GdipCreateBitmapFromStream GdiplusShutdown GdiplusStartup GdipBitmapLockBits

kernel32

LoadLibraryExW EnumResourceLanguagesW ConvertDefaultLocale InterlockedIncrement GetCurrentProcessId TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree lstrlenA GlobalFlags GetCurrentThreadId SetErrorMode GetStartupInfoW ExitThread CreateThread HeapReAlloc VirtualProtect GetSystemInfo VirtualQuery UnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind ExitProcess HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW LoadLibraryA FreeLibrary lstrcmpW GetVersionExA GetModuleHandleA SetLastError GlobalFree lstrcmpA InitializeCriticalSection DeleteCriticalSection VirtualFree VirtualAlloc IsBadReadPtr SetFilePointer lstrlenW InterlockedDecrement GetSystemTimeAsFileTime GetLocaleInfoW GetCommandLineW SetUnhandledExceptionFilter FormatMessageW WritePrivateProfileStringW GlobalUnlock ResumeThread FindResourceExW GetSystemDirectoryW FileTimeToSystemTime SystemTimeToFileTime GetLocalTime HeapFree GetProcessHeap HeapAlloc GetCurrentThread WideCharToMultiByte FreeResource Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot GetTempPathW CreateProcessW ReadFile LocalFree LocalAlloc CreateDirectoryW MultiByteToWideChar FindClose FindNextFileW SetFileAttributesW RemoveDirectoryW FindFirstFileW CloseHandle FlushFileBuffers WriteFile CreateFileW DeleteFileW CopyFileW MulDiv GlobalLock GlobalAlloc InterlockedExchange LeaveCriticalSection EnterCriticalSection GetLastError GetModuleFileNameW GetTickCount GetCurrentProcess TerminateProcess Sleep WaitForSingleObject GetProcAddress LoadLibraryW GetModuleHandleW FindResourceW LoadResource LockResource SizeofResource

user32

DestroyMenu GetWindowThreadProcessId GetSysColorBrush GetMessageW TranslateMessage ValidateRect PostQuitMessage WindowFromPoint SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem ShowWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow CreateWindowExW GetClassInfoExW GetClassInfoW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SystemParametersInfoA GetWindowPlacement GetWindowTextW GetWindow GetClientRect KillTimer SetTimer PostMessageW SetFocus GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetWindowLongW GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog EndPaint BeginPaint ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetSysColor PtInRect GetCursorPos LoadBitmapW IsRectEmpty BringWindowToTop SetWindowPos IsWindowVisible ScreenToClient DrawIcon IsIconic LoadIconW UnregisterClassW ReleaseDC RegisterClassW EnableWindow GetWindowRect GetParent FindWindowW SendMessageTimeoutW MessageBoxW GetSystemMetrics RedrawWindow InvalidateRect UpdateWindow SetCursor LoadCursorW SendMessageW SetRect LoadImageW GetDC

gdi32

CreateBitmap Escape ScaleWindowExtEx TextOutW RectVisible PtVisible SetTextColor SetBkMode SetBkColor RestoreDC SaveDC GetStockObject CreateCompatibleBitmap CreateFontW GetTextExtentPoint32W BitBlt GetDeviceCaps SetDIBColorTable SelectObject DeleteObject CreateDIBSection CreateCompatibleDC DeleteDC CreatePatternBrush SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx ExtTextOutW SetViewportOrgEx GetObjectW PatBlt CreateSolidBrush GetClipBox SetMapMode

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

DeleteService RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegFlushKey StartServiceW RegDeleteValueW RegSetValueExW ChangeServiceConfig2W CreateServiceW AdjustTokenPrivileges GetTokenInformation OpenProcessToken CloseServiceHandle CryptAcquireContextW ControlService QueryServiceStatusEx OpenServiceW OpenSCManagerW RegQueryValueExW RegCloseKey RegCreateKeyExW FreeSid SetFileSecurityW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid CryptDecrypt CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptImportKey

shell32

ShellExecuteW SHGetSpecialFolderPathW

comctl32

_TrackMouseEvent

shlwapi

SHGetValueW PathFileExistsW SHSetValueW SHDeleteKeyW PathFindFileNameW PathFindExtensionW SHDeleteValueW

ole32

CoInitialize CreateStreamOnHGlobal CoCreateInstance StringFromCLSID CoTaskMemFree

oleaut32

LoadTypeLi RegisterTypeLi SysFreeString VariantInit VariantClear SysAllocString VariantChangeType

crypt32

CryptDecodeObject CryptMsgClose CryptMsgGetParam CryptQueryObject CertCloseStore

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_e91119a3dd1739c45b14b41e27eed573_amadey_darkgate_elex_hijackloader_remcos_rhadamanthys_smoke-loader_stealc_stop

gdiplus

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

crypt32

generic