2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader
Size 547KB
Sample261015-sczbasst4l
SHA256 9512334144fb1062d5e64e3597596403d216efeff8ecb25b42a8291b478f2834
MD5 43164c6adf65361f747538a06193eca3
SHA1 626eaeaf40a5f10ed7994daa2016ff223c309d33
SHA512 d9a993ec1e7d6e6b1b4d4bebd0b4c65b91b36d6db669eeb0ec264725946af802a00760249aaf490579056e61a04fe49e817b9b817d91215bf1e391ddd2bceeff
SSDEEP 12288:L4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2A:L42DMCA6b5fWQmknY87LEPcl9nll
TLSH
T107C47D2BB295E277D46308B25F9BA33704799732A52D9502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader

File Explorer

2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader

.exe 547KB

2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader

IMPHASH 24f4613d0395ec689682abd0a1f8a028
SHA256 9512334144fb1062d5e64e3597596403d216efeff8ecb25b42a8291b478f2834
MD5 43164c6adf65361f747538a06193eca3
SHA1 626eaeaf40a5f10ed7994daa2016ff223c309d33
SHA512 d9a993ec1e7d6e6b1b4d4bebd0b4c65b91b36d6db669eeb0ec264725946af802a00760249aaf490579056e61a04fe49e817b9b817d91215bf1e391ddd2bceeff
SSDEEP 12288:L4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2A:L42DMCA6b5fWQmknY87LEPcl9nll
TLSH
T107C47D2BB295E277D46308B25F9BA33704799732A52D9502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1f:85:19:d1:d2:23:50:b9:c4:8d:14:df:3d:5e:a1:28:3e:0c:40:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Computer BILD Digital GmbH,O=Computer BILD Digital GmbH,L=Hamburg,C=DE

Chains

Oct 15, 2026

CN=Computer BILD Digital GmbH,O=Computer BILD Digital GmbH,L=Hamburg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Computer BILD Digital GmbH,O=Computer BILD Digital GmbH,L=Hamburg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Computer BILD Digital GmbH,O=Computer BILD Digital GmbH,L=Hamburg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Computer BILD Digital GmbH,O=Computer BILD Digital GmbH,L=Hamburg,C=DE

Serial Number

73:b6:15:52:47:79:5a:a1:f1:51:41:52:71:f1:03:cd

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 12, 2021 - May 12, 2022

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

Major OS version

Entry point

85052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CreateEventW WaitForSingleObject SetFilePointer SetFilePointerEx SetEndOfFile GetFileSize ReadFile GetFileAttributesExW GetCurrentProcessId GetTempFileNameW GetTickCount GetSystemTimeAsFileTime MapViewOfFile HeapFree FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers CloseHandle CreateFileW WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP DeleteCriticalSection RtlUnwind QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap InterlockedIncrement InterlockedDecrement lstrlenW GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection WideCharToMultiByte InterlockedPushEntrySList InterlockedCompareExchange

user32

DestroyWindow LoadCursorW CreateWindowExW RegisterClassExW SetTimer KillTimer DefWindowProcW GetWindowLongW GetClassInfoExW SetWindowLongW CallWindowProcW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow SendMessageW LoadImageW LoadIconW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW UnregisterClassA

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW SelectObject DeleteDC DeleteObject CreateCompatibleDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW CommandLineToArgvW DoEnvironmentSubstW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantChangeType VariantClear OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString VariantInit VariantCopy

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_43164c6adf65361f747538a06193eca3_amadey_cobalt-strike_conti_darkgate_elex_smoke-loader

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic