2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop
Size 451KB
Sample261014-e95bxsyvhv
SHA256 d55017c6f3e03b33172ef5b5d45b11d81cc0e66104ea67148c81739409ef0145
MD5 d835227b9fe9c85e4d04ac2bcf10c91e
SHA1 83add0356a050ab9cf94e3d600f6e6edcb8e0581
SHA512 3d4e5ad6cb9e36437560d7721673626b032ffe245cc5285397119ae8b11839184ba9a12dd61f1aca33c39e82021a0bb4ee322c9185189fdd8943a2cc1f8fa9fc
SSDEEP 12288:kSFMlkXTi5maMBvhopIaCbiTdbGFaBjvrEH7wI:ksYmkmaMw1Cb8NGFsrEH71
TLSH
T1D5A49E1173D0D2B6C1A235716A66E3705AEEBC385E75438777C03B7D9E382C29A3871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

File Explorer

2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

.exe 451KB

2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

IMPHASH cc50bc11c112d01154ce3385b76d7d36
SHA256 d55017c6f3e03b33172ef5b5d45b11d81cc0e66104ea67148c81739409ef0145
MD5 d835227b9fe9c85e4d04ac2bcf10c91e
SHA1 83add0356a050ab9cf94e3d600f6e6edcb8e0581
SHA512 3d4e5ad6cb9e36437560d7721673626b032ffe245cc5285397119ae8b11839184ba9a12dd61f1aca33c39e82021a0bb4ee322c9185189fdd8943a2cc1f8fa9fc
SSDEEP 12288:kSFMlkXTi5maMBvhopIaCbiTdbGFaBjvrEH7wI:ksYmkmaMw1Cb8NGFsrEH71
TLSH
T1D5A49E1173D0D2B6C1A235716A66E3705AEEBC385E75438777C03B7D9E382C29A3871A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

10:91:bb:8b:21:a6:58:94:25:8f:ee:6e:d8:e5:a2:40:af:cc:af:06:53:e7:ea:ee:7c:62:51:50:30:32:ec:80

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

c5:fe:f5:30:60:a0:54:32:e8:cd:0e:d5:91:ce:88:13:81:a0:ab:ad

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Subject

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

06:c5:07:8a:a5:28:bb:d3:b8:66:8a:b1:0b:03:5f:94

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

09:96:cb:38:36:ac:ef:b7:37:c2:12:d1:55:41:7e:f1

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Minor OS version

Major OS version

Entry point

147463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx GetFileTime RtlUnwind GetTimeZoneInformation GetSystemTimeAsFileTime Sleep HeapFree GetCommandLineA GetStartupInfoA HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle InitializeCriticalSectionAndSpinCount GetFileAttributesA VirtualFree GetACP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetProcessHeap CompareStringW SetEnvironmentVariableA FileTimeToLocalFileTime SetErrorMode FileTimeToSystemTime GetOEMCP GetCPInfo GetModuleHandleW CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags WritePrivateProfileStringA GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetModuleFileNameW FormatMessageA MulDiv lstrlenA GetTickCount GlobalUnlock GlobalFree FreeResource GetCurrentProcessId SetLastError GlobalAddAtomA GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA CompareStringA GlobalLock lstrcmpA GlobalAlloc RaiseException InterlockedExchange LocalFree LocalAlloc ExitProcess lstrcpynA FreeLibrary InterlockedDecrement GetVersionExA LoadLibraryW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource ReleaseMutex CloseHandle CreateMutexA GetLastError GetProcAddress GetModuleHandleA HeapCreate GetModuleFileNameA

user32

SetRect IsRectEmpty CopyAcceleratorTableA CharNextA PostThreadMessageA CharUpperA GetSysColorBrush ReleaseCapture LoadCursorA SetCapture EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA SetFocus GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect UnhookWindowsHookEx DrawIcon SendMessageA PostMessageA IsIconic GetMenuItemID GetMenuItemCount GetSubMenu GetWindow SetWindowContextHelpId MapDialogRect SetWindowPos RegisterClipboardFormatA GetDesktopWindow SetActiveWindow CreateDialogIndirectParamA DestroyMenu UnregisterClassA MessageBeep GetNextDlgGroupItem InvalidateRgn GetWindowTextA InvalidateRect GetClientRect SetTimer KillTimer LoadIconA GetSystemMetrics EnableWindow GetKeyboardState GetKeyState GetClassNameA PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageA IsWindowVisible GetActiveWindow DispatchMessageA TranslateMessage GetMessageA CallNextHookEx SetWindowsHookExA SetCursor MessageBoxA IsWindowEnabled GetLastActivePopup GetWindowLongA GetWindowThreadProcessId EndDialog GetNextDlgTabItem GetDlgItem DestroyWindow IsWindow IsChild

gdi32

GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode ExtSelectClipRgn DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx CreateBitmap SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox GetDeviceCaps SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCreateKeyExA RegQueryValueA RegOpenKeyA RegEnumKeyA RegDeleteKeyA RegSetValueExA RegQueryValueExW RegOpenKeyExA RegCloseKey RegQueryValueExA

shlwapi

PathFindFileNameA PathStripToRootA PathIsUNCA PathFindExtensionA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen VariantClear SysAllocStringLen SysAllocString VariantInit SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData VariantChangeType VariantCopy OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy GetErrorInfo SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_d835227b9fe9c85e4d04ac2bcf10c91e_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

generic