2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop
Size 313KB
Sample261006-159azagg48
SHA256 894b3afb7f21e3c6a4f3dde777d76b7bbf3f74f4fc3a077cd5d17e5ae7069986
MD5 6ed0b4c6f38148fabd86aa16bb642623
SHA1 8ec949bf7c45334aa9cf65b4fabc7ca4a3539b81
SHA512 cbb72e7628d8b6d4fa43ca3318626aa3fd5e274545be379381d19068ad7c13dfa06829c9140b8dd59a8bd3dfd073917341b37f8b878b0a21372c96977f2aa79d
SSDEEP 6144:ZxokrhBwDfJkFVwaBV+UdvrEFp7hKWNUG4:ZOkrLwDhOwaBjvrEH7bUG4
TLSH
T1DF647C3131A283ABD752333932B7D631C5A5ACBA27B647F773C0A5C508FA5C1D32661A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop

.exe 313KB

2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop

IMPHASH e8e0d439338c6268b1c3fbe48081b4ca
SHA256 894b3afb7f21e3c6a4f3dde777d76b7bbf3f74f4fc3a077cd5d17e5ae7069986
MD5 6ed0b4c6f38148fabd86aa16bb642623
SHA1 8ec949bf7c45334aa9cf65b4fabc7ca4a3539b81
SHA512 cbb72e7628d8b6d4fa43ca3318626aa3fd5e274545be379381d19068ad7c13dfa06829c9140b8dd59a8bd3dfd073917341b37f8b878b0a21372c96977f2aa79d
SSDEEP 6144:ZxokrhBwDfJkFVwaBV+UdvrEFp7hKWNUG4:ZOkrLwDhOwaBjvrEH7bUG4
TLSH
T1DF647C3131A283ABD752333932B7D631C5A5ACBA27B647F773C0A5C508FA5C1D32661A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c8:c8:75:65:ff:fd:1e:fd:8f:f4:1c:33:cb:84:46:81:fa:a1:e9:73

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Nov 29, 2018

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

33:41:b6:cb:5c:be:0a:b2:0d:e3:49:d6:42:ac:b8:22

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2018 - Apr 25, 2021

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

34450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\7.Works\RAONK\RAONK.SVC\bin\raonk.svc.pdb

kernel32

CreateFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource CopyFileW FindResourceExW InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection WriteConsoleW SetStdHandle FlushFileBuffers CreateProcessA GetExitCodeProcess TerminateProcess OpenProcess CreateProcessW GetShortPathNameW GetCurrentProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleFileNameW DeleteFileW SetFileAttributesW GetFileAttributesW Sleep WideCharToMultiByte MultiByteToWideChar SetEvent TerminateThread GetExitCodeThread CloseHandle WaitForSingleObject CreateThread CreateEventW GetLastError FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW VerifyVersionInfoW FindResourceW VerSetConditionMask SetFilePointerEx GetConsoleMode GetConsoleCP LCMapStringW CompareStringW GetStringTypeW LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter WriteFile GetFileType GetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer IsProcessorFeaturePresent GetSystemTimeAsFileTime GetFileAttributesExW GetCommandLineW RtlUnwind ExitProcess GetModuleHandleExW AreFileApisANSI IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW SetEnvironmentVariableA

user32

wsprintfW FindWindowW GetWindowThreadProcessId

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW ControlService StartServiceW QueryServiceStatus CreateProcessAsUserW DuplicateTokenEx RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken DeregisterEventSource ReportEventW RegisterEventSourceW DeleteService OpenServiceW CloseServiceHandle UnlockServiceDatabase ChangeServiceConfig2W LockServiceDatabase CreateServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW GetTokenInformation

ole32

OleUninitialize OleInitialize

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

wininet

InternetSetOptionW HttpOpenRequestW HttpSendRequestW InternetOpenW InternetConnectW InternetCloseHandle HttpQueryInfoW HttpAddRequestHeadersA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_6ed0b4c6f38148fabd86aa16bb642623_darkgate_elex_floxif_maze_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

ole32

userenv

version

wtsapi32

wininet

generic