2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 2.8MB
Sample260929-xfb3dsdc62
SHA256 69e4018b58a95a0c08cc098ce04017b22aa583c55147f6d099804f496c51da34
MD5 a9810729139d6474f4af2c4b9160276d
SHA1 58db7757db184ea5f23d59679bba8f838381e1a7
SHA512 2551ecb122c79689bd642bfcd9e9cf99b17cfa7563ab60fb010156af6a2fb6dc714c3c38ae250f8a77b41bba34dca43f55df3242cc5e18ff434bc6776bd96eea
SSDEEP 49152:2rxRP9sg+B/Vmg+J3A9n/TDbXNKdh05w8t5GN/AxsMRqhqA9n/TDbXNKd:23MBVmmfb9s65w8tANYiMRqhbfb9s
TLSH
T15FD5C00277F94179F2F37BB19EB893645A77BC71AD39C50E2281215E09B4A80DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 2.8MB

2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 471d93489b0717c80993a900990decbb
SHA256 69e4018b58a95a0c08cc098ce04017b22aa583c55147f6d099804f496c51da34
MD5 a9810729139d6474f4af2c4b9160276d
SHA1 58db7757db184ea5f23d59679bba8f838381e1a7
SHA512 2551ecb122c79689bd642bfcd9e9cf99b17cfa7563ab60fb010156af6a2fb6dc714c3c38ae250f8a77b41bba34dca43f55df3242cc5e18ff434bc6776bd96eea
SSDEEP 49152:2rxRP9sg+B/Vmg+J3A9n/TDbXNKdh05w8t5GN/AxsMRqhqA9n/TDbXNKd:23MBVmmfb9s65w8tANYiMRqhbfb9s
TLSH
T15FD5C00277F94179F2F37BB19EB893645A77BC71AD39C50E2281215E09B4A80DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

283744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\CB\ARM\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord16 ord118 ord171 ord141 ord115 ord119 ord88 ord240 ord281 ord205 ord123 ord120 ord114 ord160 ord159 ord32 ord92 ord8 ord116 ord70 ord181 ord195

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW

sensapi

IsNetworkAlive

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData

kernel32

ResumeThread SuspendThread GlobalAddAtomW InterlockedDecrement GetModuleHandleA GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW FreeResource FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime InterlockedIncrement LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue SetThreadPriority DeleteCriticalSection TlsFree SetErrorMode GlobalFlags GetStartupInfoW SetEnvironmentVariableW GetSystemTimeAsFileTime ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate QueryPerformanceCounter GetCurrentDirectoryA GetDriveTypeA GetCPInfo GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GlobalDeleteAtom GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GetModuleFileNameW GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetCurrentThread UnmapViewOfFile OpenFileMappingW MapViewOfFile GetVolumeInformationW HeapFree GetProcessHeap HeapAlloc OpenEventW Module32NextW Module32FirstW Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW SetLastError OpenMutexW CreateMutexW GetThreadPriority RemoveDirectoryW GetVersionExW WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary lstrlenA GetPrivateProfileSectionNamesW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LocalFree FormatMessageW GetThreadLocale VirtualAlloc VirtualFree GetTempPathW OpenProcess CopyFileW GetACP LoadLibraryW lstrlenW WaitForSingleObject GetTickCount SetEvent CreateEventW GetProcAddress GetModuleHandleW Sleep MultiByteToWideChar CloseHandle CreateFileW ReadFile SetFilePointer GetFileSize CreateFileA FindClose FindFirstFileW DeleteFileW SetFileAttributesW SetFileTime WriteFile GetLastError CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource LocalReAlloc

user32

DestroyMenu GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu ShowScrollBar CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SystemParametersInfoA GetWindowPlacement CopyRect GetSysColor EndPaint BeginPaint ReleaseDC GetDC ScreenToClient GrayStringW DrawTextW TabbedTextOutW UnhookWindowsHookEx GetLastActivePopup SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState ValidateRect SetMenuItemBitmaps GetSysColorBrush LoadBitmapW EnableMenuItem CheckMenuItem GetWindowTextLengthW SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongW GetDlgCtrlID GetWindowLongW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetDlgItem GetWindow PostQuitMessage CharUpperW GetMenuState GetMenuStringW ExitWindowsEx RegisterWindowMessageW EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow KillTimer DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus GetWindowRect IsWindow SendMessageW EnableWindow PostMessageW LoadIconW GetForegroundWindow SetForegroundWindow SetTimer MessageBoxW UnregisterClassW GetMenuCheckMarkDimensions DrawTextExW

gdi32

GetStockObject ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap DeleteDC ScaleWindowExtEx SetWindowExtEx GetDeviceCaps GetTextExtentPoint32W CreateFontIndirectW GetObjectW DeleteObject PtVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

GetSidSubAuthority RegCreateKeyW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid OpenThreadToken DuplicateToken CheckTokenMembership IsValidSid GetLengthSid ConvertSidToStringSidW LookupAccountNameW CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeSid GetSidLengthRequired RegEnumKeyExW RegCreateKeyExW RegDeleteValueW RegEnumValueW RegQueryInfoKeyW CreateProcessAsUserW OpenProcessToken DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountSidW GetUserNameW RegQueryValueExW RegFlushKey RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW Shell_NotifyIconW SHCreateDirectoryExW SHAppBarMessage SHFileOperationW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathStripToRootW PathFindFileNameW PathFindExtensionW PathIsUNCW SHDeleteKeyW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

VariantClear VariantInit VariantChangeType

urlmon

URLDownloadToFileW

crypt32

CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CryptProtectData CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptUnprotectData CertGetNameStringW

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

crypt32

wintrust

userenv

generic