2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample261002-tb4easvhpc
SHA256 b5ef19e1bc2c021d9582cfde2df3d02818492990a4743dde7b53d2659fe35d09
MD5 42674dcf4b61e7c0dde0388a70f52f97
SHA1 b077bbfb29c509e28f1a97b48124a71883fcd9c4
SHA512 bad41d8b886803c56712eddee22a4cdebc52b3b1a26665f6ec52a11132837ce2065f294bc263aa5f056db22ccc905818116eca74e1515b873de56dd597f86278
SSDEEP 24576:g7roejNzjMDk/w5Qkmbx4EiWk4ZxxCNPvEDJv751edcllmjEvmAty:g7roG7/w5obxgWk4ZxUN3c6GllvS
TLSH
T18255E0017BA0C27ADB45433509A6E76A6566EDB81B5485CFF3E43E3D5D302C36A3B20E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH 7ed175cadfdfb4e740a248a4a01e1470
SHA256 b5ef19e1bc2c021d9582cfde2df3d02818492990a4743dde7b53d2659fe35d09
MD5 42674dcf4b61e7c0dde0388a70f52f97
SHA1 b077bbfb29c509e28f1a97b48124a71883fcd9c4
SHA512 bad41d8b886803c56712eddee22a4cdebc52b3b1a26665f6ec52a11132837ce2065f294bc263aa5f056db22ccc905818116eca74e1515b873de56dd597f86278
SSDEEP 24576:g7roejNzjMDk/w5Qkmbx4EiWk4ZxxCNPvEDJv751edcllmjEvmAty:g7roG7/w5obxgWk4ZxUN3c6GllvS
TLSH
T18255E0017BA0C27ADB45433509A6E76A6566EDB81B5485CFF3E43E3D5D302C36A3B20E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

245152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\261389\out\Release\SecurityProxy.pdb

kernel32

MulDiv lstrcmpW SetFileAttributesW DeleteFileW GetFileSizeEx ReadFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalFree OpenThread CreateFileMappingW GetModuleHandleExW lstrcpynW InterlockedCompareExchange GetLogicalDriveStringsW CreateFileA FindFirstFileW FindNextFileW FindClose RemoveDirectoryW GetLongPathNameW IsBadReadPtr DeviceIoControl HeapAlloc GetProcessHeap HeapFree LocalFree SystemTimeToFileTime SetFilePointerEx GetLocalTime SetUnhandledExceptionFilter VirtualProtect GetThreadLocale SetThreadLocale SetErrorMode InitializeCriticalSection GetModuleFileNameW LoadLibraryExW WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA SetStdHandle FlushFileBuffers GetLocaleInfoW GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID TerminateProcess GetStringTypeA InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetStdHandle HeapCreate GetStringTypeW LCMapStringW LCMapStringA GetCPInfo RtlUnwind GetStartupInfoW IsDebuggerPresent UnhandledExceptionFilter CreateThread ExitThread TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW GetAtomNameW GlobalUnlock GlobalLock GlobalAlloc CreateProcessW Sleep CreateEventW SetEvent SetCurrentDirectoryW GetCurrentDirectoryW GetTickCount WriteFile lstrcmpiW GetModuleHandleW lstrlenW CreateMutexW MoveFileExW GetCommandLineW ExitProcess WaitForSingleObject OpenProcess GetCurrentProcessId FreeLibrary GetProcAddress RaiseException SetLastError FlushInstructionCache GetCurrentProcess GetCurrentThreadId WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource FlushViewOfFile SizeofResource GetLastError MultiByteToWideChar lstrlenA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection OpenFileMappingW SetFilePointer MapViewOfFile SetEndOfFile CloseHandle UnmapViewOfFile TlsSetValue TlsGetValue GetSystemTime FormatMessageW LocalFileTimeToFileTime GetSystemTimeAsFileTime InterlockedExchange HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA CreateFileW OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW LoadLibraryW InterlockedIncrement InterlockedDecrement

user32

GetDesktopWindow SendNotifyMessageW IsWindow IsWindowVisible SendMessageTimeoutW DestroyAcceleratorTable IsRectEmpty GetClientRect CharNextW LoadCursorW DefWindowProcW FindWindowW ReleaseDC GetDC InvalidateRect InvalidateRgn FillRect ReleaseCapture SetCapture DispatchMessageW MoveWindow ScreenToClient GetParent ClientToScreen CreateAcceleratorTableW FindWindowExW PostMessageW RedrawWindow SetWindowPos GetSysColor GetClassNameW GetDlgItem GetWindow SetFocus GetFocus IsChild EndPaint BeginPaint SetWindowTextW SetWindowLongW GetWindowLongW CreateWindowExW CallWindowProcW ShowWindow UpdateWindow GetMessageW TranslateMessage UnregisterClassA GetClassInfoExW RegisterClassExW PostQuitMessage DestroyWindow SendMessageW MessageBoxW GetWindowThreadProcessId RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW

gdi32

DeleteObject CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject GetDeviceCaps BitBlt DeleteDC GetStockObject GetObjectW

advapi32

RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegQueryValueExA

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ord165 ShellExecuteW

ole32

CoInitialize CoTaskMemAlloc CreateStreamOnHGlobal CoUnmarshalInterface CoTaskMemRealloc CoUninitialize CoCreateInstance CoTaskMemFree OleInitialize StringFromGUID2 OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString OleUninitialize

oleaut32

VariantInit VariantClear SysAllocStringByteLen SysStringByteLen VariantCopy SysStringLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysAllocStringLen SysAllocString SysFreeString VarUI4FromStr

shlwapi

PathIsPrefixW PathRemoveExtensionW PathRemoveBackslashW PathCanonicalizeW PathIsRootW PathFindFileNameW PathCombineW PathAppendW PathFileExistsW StrToIntW PathRemoveFileSpecW PathIsDirectoryW StrStrIW PathAddBackslashW

oleacc

LresultFromObject

imm32

ImmDisableIME

urlmon

ObtainUserAgentString UrlMkSetSessionOption

wininet

InternetSetOptionW InternetSetCookieExW InternetSetCookieW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_42674dcf4b61e7c0dde0388a70f52f97_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

imm32

urlmon

wininet

psapi

version

generic