2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop

General

Target
2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop
Size 3.5MB
Sample260930-y9b5xswalg
SHA256 a1ab766dfb8fbd9b21da1a6131e0325c11a318427a2079277246353aac55f3c6
MD5 5af2fccd19a7d9811cc39d8046c11785
SHA1 0d0a343ce654ffa94b7d1a65eb86569354490ebe
SHA512 3cae673c964c58a823cc7d231de5df65ef47be53f7c481f3ed3cf7f0b2d2885cdf30f785faef764638320a2b7ef141d25e59cefc8394c3e4d577268905bdd88b
SSDEEP 24576:lt1LA5rXVav9MkLaewsAjlCqnstLyUktHIiLy/S+d4KplkLVCh:ljRv9MLljQqnstLet3LypXpF
TLSH
T182F594035EAD4231D06FBD302DA0C39E08A57E518D22B95ABFC0BE9DE5759D176BC231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop

File Explorer

2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop

.exe 3.5MB

2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop

SHA256 a1ab766dfb8fbd9b21da1a6131e0325c11a318427a2079277246353aac55f3c6
MD5 5af2fccd19a7d9811cc39d8046c11785
SHA1 0d0a343ce654ffa94b7d1a65eb86569354490ebe
SHA512 3cae673c964c58a823cc7d231de5df65ef47be53f7c481f3ed3cf7f0b2d2885cdf30f785faef764638320a2b7ef141d25e59cefc8394c3e4d577268905bdd88b
SSDEEP 24576:lt1LA5rXVav9MkLaewsAjlCqnstLyUktHIiLy/S+d4KplkLVCh:ljRv9MLljQqnstLet3LypXpF
TLSH
T182F594035EAD4231D06FBD302DA0C39E08A57E518D22B95ABFC0BE9DE5759D176BC231
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

177464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5af2fccd19a7d9811cc39d8046c11785_amadey_darkgate_elex_emotet_glassworm_hawkeye_smoke-loader_stop

generic