2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop
Size 451KB
Sample261018-1cdzcsaz2x
SHA256 77d2cc3c9655fe0827c43fe924bde8c38b07b6d6a057fd99bfd5d7757c85ed49
MD5 afc557dedcd5c38e4016d53d93b95c10
SHA1 27325dbac58d873b1cf7a7cf0a4944dc74a1b6d0
SHA512 df6b37b4b94a9c13df28e25a62ce7ba396079a9bf512dbd756a99253db18446f43c1ecf42856846a64dfaf53da816091741d46a0bf65ecca4d313461e00920b7
SSDEEP 12288:kSFMlkXTcjpvmaMBkhopIaCbiTdbGFaBjvrEH7d:ksYmgmaMV1Cb8NGFsrEH7d
TLSH
T14AA49F1173D0D6B6C26231712A66E7706AEDBC385E75438777C02B7D9E382829A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

File Explorer

2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

.exe 451KB

2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

IMPHASH cc50bc11c112d01154ce3385b76d7d36
SHA256 77d2cc3c9655fe0827c43fe924bde8c38b07b6d6a057fd99bfd5d7757c85ed49
MD5 afc557dedcd5c38e4016d53d93b95c10
SHA1 27325dbac58d873b1cf7a7cf0a4944dc74a1b6d0
SHA512 df6b37b4b94a9c13df28e25a62ce7ba396079a9bf512dbd756a99253db18446f43c1ecf42856846a64dfaf53da816091741d46a0bf65ecca4d313461e00920b7
SSDEEP 12288:kSFMlkXTcjpvmaMBkhopIaCbiTdbGFaBjvrEH7d:ksYmgmaMV1Cb8NGFsrEH7d
TLSH
T14AA49F1173D0D6B6C26231712A66E7706AEDBC385E75438777C02B7D9E382829A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

83:f4:27:ce:6a:14:56:39:b2:2b:6c:4d:7e:34:e5:a4:ab:f7:bd:c1:0d:88:9c:3b:cc:cc:6b:65:a9:35:c8:7e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

76:9f:71:cd:be:1b:a9:99:b0:1b:7e:53:e6:cd:0d:65:7a:86:e2:80

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Subject

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

06:c5:07:8a:a5:28:bb:d3:b8:66:8a:b1:0b:03:5f:94

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

09:96:cb:38:36:ac:ef:b7:37:c2:12:d1:55:41:7e:f1

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Minor OS version

Major OS version

Entry point

147463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx GetFileTime RtlUnwind GetTimeZoneInformation GetSystemTimeAsFileTime Sleep HeapFree GetCommandLineA GetStartupInfoA HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle InitializeCriticalSectionAndSpinCount GetFileAttributesA VirtualFree GetACP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetProcessHeap CompareStringW SetEnvironmentVariableA FileTimeToLocalFileTime SetErrorMode FileTimeToSystemTime GetOEMCP GetCPInfo GetModuleHandleW CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags WritePrivateProfileStringA GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetModuleFileNameW FormatMessageA MulDiv lstrlenA GetTickCount GlobalUnlock GlobalFree FreeResource GetCurrentProcessId SetLastError GlobalAddAtomA GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA CompareStringA GlobalLock lstrcmpA GlobalAlloc RaiseException InterlockedExchange LocalFree LocalAlloc ExitProcess lstrcpynA FreeLibrary InterlockedDecrement GetVersionExA LoadLibraryW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource ReleaseMutex CloseHandle CreateMutexA GetLastError GetProcAddress GetModuleHandleA HeapCreate GetModuleFileNameA

user32

SetRect IsRectEmpty CopyAcceleratorTableA CharNextA PostThreadMessageA CharUpperA GetSysColorBrush ReleaseCapture LoadCursorA SetCapture EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA SetFocus GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect UnhookWindowsHookEx DrawIcon SendMessageA PostMessageA IsIconic GetMenuItemID GetMenuItemCount GetSubMenu GetWindow SetWindowContextHelpId MapDialogRect SetWindowPos RegisterClipboardFormatA GetDesktopWindow SetActiveWindow CreateDialogIndirectParamA DestroyMenu UnregisterClassA MessageBeep GetNextDlgGroupItem InvalidateRgn GetWindowTextA InvalidateRect GetClientRect SetTimer KillTimer LoadIconA GetSystemMetrics EnableWindow GetKeyboardState GetKeyState GetClassNameA PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageA IsWindowVisible GetActiveWindow DispatchMessageA TranslateMessage GetMessageA CallNextHookEx SetWindowsHookExA SetCursor MessageBoxA IsWindowEnabled GetLastActivePopup GetWindowLongA GetWindowThreadProcessId EndDialog GetNextDlgTabItem GetDlgItem DestroyWindow IsWindow IsChild

gdi32

GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode ExtSelectClipRgn DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx CreateBitmap SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox GetDeviceCaps SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCreateKeyExA RegQueryValueA RegOpenKeyA RegEnumKeyA RegDeleteKeyA RegSetValueExA RegQueryValueExW RegOpenKeyExA RegCloseKey RegQueryValueExA

shlwapi

PathFindFileNameA PathStripToRootA PathIsUNCA PathFindExtensionA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen VariantClear SysAllocStringLen SysAllocString VariantInit SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData VariantChangeType VariantCopy OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy GetErrorInfo SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_afc557dedcd5c38e4016d53d93b95c10_amadey_darkgate_elex_floxif_remcos_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

generic