2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader

General

Target
2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader
Size 8.0MB
Sample261008-mk8baaez2z
SHA256 c39ded062ad00ab2c1666fd8630c9dcbe6b9c28e3a0e9e955e5636aa499fc99d
MD5 79c21a66fb75d836d201672e259e53b6
SHA1 0336cfcf9340ff4149e7d06da0d6d70a67fe2719
SHA512 5e5e8f1573529b57f977e138f2e65aa4daa83ce92f1bccc60dbad087247a77dfe7156f840db85001a8a56b5386d3caada1489952590e4f2c28d9c1739068ce59
SSDEEP 98304:POIWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOew3:wgDyw2WHOuCRUOZ3
TLSH
T15886AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader

.exe 8.0MB

2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader

IMPHASH 9158747dc6240279afce84ac4d726c82
SHA256 c39ded062ad00ab2c1666fd8630c9dcbe6b9c28e3a0e9e955e5636aa499fc99d
MD5 79c21a66fb75d836d201672e259e53b6
SHA1 0336cfcf9340ff4149e7d06da0d6d70a67fe2719
SHA512 5e5e8f1573529b57f977e138f2e65aa4daa83ce92f1bccc60dbad087247a77dfe7156f840db85001a8a56b5386d3caada1489952590e4f2c28d9c1739068ce59
SSDEEP 98304:POIWgDywqS556dPeHehvY19yu7+LTqdu7cmsfOew3:wgDyw2WHOuCRUOZ3
TLSH
T15886AE02B7D180B6E16A163059FA6B77A77ABE514F30CBCB1354EB4D2D327C1A932316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-18970417\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc LoadLibraryExW WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree

user32

wsprintfW MessageBoxW

ntdll

NtProtectVirtualMemory NtWriteVirtualMemory RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlAddAccessAllowedAce RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrUnloadDll RtlCreateAcl

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader

kernel32

user32

ntdll

generic