2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 277KB
Sample261004-eezsysyfqd
SHA256 ae011b2761bfc42e127b36d5da8490bab8cab2071857b98003674804b60e5869
MD5 b4080f1d89cfb09d78ffea57fe84d729
SHA1 5df9eb8bd18d0344fa93c3d221ffe57374129fd3
SHA512 3dcab1a85080a8e8b0ff373ef13cd7a93c232097c46a32fd4f74868b85f3538a15b2b028c410f11f057a8122ab4040b84c95135d851704b4e128004d8c2eb573
SSDEEP 6144:EjkHB+phBeRZusBrAnPmOXG5NCv99IF2xTrEt6S2P+mu:Eoh+phBeRZVBAnP1XMCv99ZxTrSK2mu
TLSH
T12A54BE71B180C072C857483084F9DB7199BABD7A5BB4844FB3E836682EB33D1566A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 277KB

2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH f0faf35141901a7c15fe1bf78565d141
SHA256 ae011b2761bfc42e127b36d5da8490bab8cab2071857b98003674804b60e5869
MD5 b4080f1d89cfb09d78ffea57fe84d729
SHA1 5df9eb8bd18d0344fa93c3d221ffe57374129fd3
SHA512 3dcab1a85080a8e8b0ff373ef13cd7a93c232097c46a32fd4f74868b85f3538a15b2b028c410f11f057a8122ab4040b84c95135d851704b4e128004d8c2eb573
SSDEEP 6144:EjkHB+phBeRZusBrAnPmOXG5NCv99IF2xTrEt6S2P+mu:Eoh+phBeRZVBAnP1XMCv99ZxTrSK2mu
TLSH
T12A54BE71B180C072C857483084F9DB7199BABD7A5BB4844FB3E836682EB33D1566A35F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jdk7_32P\jdk7\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetTickCount GetModuleFileNameA GetThreadLocale WideCharToMultiByte GlobalAlloc MultiByteToWideChar ReadFile CloseHandle WaitForSingleObject CreateProcessA SetHandleInformation CreatePipe CreateDirectoryA GetSystemWindowsDirectoryA FindClose FindFirstFileA GetModuleHandleA GetVersionExA GetLastError CreateFileA GetSystemDirectoryA LocalAlloc lstrlenA FormatMessageA GetLongPathNameA GetShortPathNameA lstrlenW InterlockedDecrement OutputDebugStringA GetCurrentProcessId GetCurrentThreadId SetEnvironmentVariableW CreateFileW WriteConsoleW FlushFileBuffers HeapSize SetEnvironmentVariableA CompareStringW LCMapStringW GetDriveTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEndOfFile SetFilePointer GetFileAttributesA Sleep SetStdHandle SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP IsProcessorFeaturePresent SetLastError InterlockedIncrement LocalFree InterlockedExchange RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA HeapFree HeapReAlloc HeapAlloc GetStringTypeW GetModuleHandleW ExitProcess DecodePointer DeleteFileA EnterCriticalSection LeaveCriticalSection GetFileType RtlUnwind GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW GetFullPathNameA GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree GetExitCodeProcess

user32

wsprintfA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA SetTimer CreateWindowExA RegisterClassA LoadCursorA MessageBoxA

ole32

StringFromCLSID CoTaskMemFree

oleaut32

VariantClear SysFreeString SysAllocString

wsock32

send connect htons ioctlsocket recv accept ntohs listen getsockname bind WSAGetLastError WSAStartup closesocket WSAAsyncSelect socket

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-03_b4080f1d89cfb09d78ffea57fe84d729_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

ole32

oleaut32

wsock32

generic