2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
Size 1.7MB
Sample261018-yefvmass9j
SHA256 c1de7a4dd2d4a4ee177d516157f6c1fb75ecadcaee161a791ae317616af92a87
MD5 c60767178b2f2ce5ee59068627f4ad88
SHA1 9507ba52814d4add65fc75e17cb1963981f5aaba
SHA512 24a60dacbce8289a978bd855cd6214b4e55fe53ddff2cb4f48ad73ed89a1917b344e4673b69a834041e9da50a9d0ff9e1d2abf7e2d8d78b338d302178954d481
SSDEEP 49152:oqGMLdJbsbxTR/8QhwKpra9+JLMvjWMGeGxwWwRn:smJox1/8QhwKlawF1MGet
TLSH
T1E4858E1137D18076D2773A70996A93F9A6BABC708D75864F11903F3D2E30952AB3C72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

.exe 1.7MB

2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

IMPHASH b91c2535d52a96ebc23399987a9a4725
SHA256 c1de7a4dd2d4a4ee177d516157f6c1fb75ecadcaee161a791ae317616af92a87
MD5 c60767178b2f2ce5ee59068627f4ad88
SHA1 9507ba52814d4add65fc75e17cb1963981f5aaba
SHA512 24a60dacbce8289a978bd855cd6214b4e55fe53ddff2cb4f48ad73ed89a1917b344e4673b69a834041e9da50a9d0ff9e1d2abf7e2d8d78b338d302178954d481
SSDEEP 49152:oqGMLdJbsbxTR/8QhwKpra9+JLMvjWMGeGxwWwRn:smJox1/8QhwKlawF1MGet
TLSH
T1E4858E1137D18076D2773A70996A93F9A6BABC708D75864F11903F3D2E30952AB3C72B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

19:b3:5d:4c:3c:b7:7c:98:83:ab:3c:05:8f:23:a6:b1:10:3c:46:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tyco Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tyco Electronics,L=Menlo Park,ST=California,C=US

Chains

Mar 12, 2010

CN=Tyco Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tyco Electronics,L=Menlo Park,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Tyco Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tyco Electronics,L=Menlo Park,ST=California,C=US

Serial Number

5d:00:63:95:9e:38:10:57:de:7b:82:3b:87:7e:04:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 18, 2009 - Sep 17, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

1024398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\EloMT_1.2.0\Apps\EloSetup\Release\EloSetup.pdb

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiChangeState SetupUninstallOEMInfW SetupDiRemoveDevice CM_Get_DevNode_Status CM_Locate_DevNodeW SetupDiGetClassDevsW CMP_WaitNoPendingInstallEvents CM_Reenumerate_DevNode SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupCopyOEMInfW InstallHinfSectionW

newdev

UpdateDriverForPlugAndPlayDevicesW

psapi

GetModuleBaseNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

RtlUnwind RaiseException ExitThread CreateThread HeapSize VirtualAlloc HeapAlloc VirtualQuery SetStdHandle GetFileType GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA HeapFree GetStartupInfoW VirtualProtect GetProfileIntW GetTickCount SearchPathW GetTempPathW GetTempFileNameW GetFileTime GetFileSizeEx FileTimeToLocalFileTime SetErrorMode GetFileAttributesW lstrcpyW GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentDirectoryW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc FileTimeToSystemTime lstrlenA HeapReAlloc GlobalGetAtomNameW GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement ResumeThread SetThreadPriority GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA CompareStringA InterlockedExchange GetCurrentProcessId GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom LoadLibraryW CompareStringW LoadLibraryA FreeLibrary lstrcmpW GetProcAddress GetVersionExA GlobalSize GlobalAlloc MulDiv GlobalLock GlobalUnlock GlobalFree FreeResource SetLastError lstrlenW WideCharToMultiByte LocalFree GetModuleHandleA GetModuleFileNameA GetPrivateProfileIntW WritePrivateProfileStringW GetModuleFileNameW GetLocaleInfoEx FormatMessageW GetLocaleInfoW FormatMessageA GetModuleHandleW FindResourceExW GetNativeSystemInfo ReleaseMutex GetLocalTime WaitForSingleObject CreateMutexW DeleteFileW GetWindowsDirectoryW CloseHandle PurgeComm FindNextFileW SetCommMask FindClose CreateFileW ReadFile GetVersionExW SetCommTimeouts SetCommState WriteFile GetPrivateProfileStringW CreateDirectoryW FindFirstFileW CreateFileA CopyFileW Sleep Beep GetCurrentProcess GetCommandLineW ExitProcess GetLastError LockResource MultiByteToWideChar SizeofResource LoadResource FindResourceW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetTimeZoneInformation GetSystemInfo

user32

SetMenuDefaultItem UpdateLayeredWindow EnableScrollBar UnionRect SetCursorPos SetRect DrawFocusRect DrawFrameControl DrawEdge DrawIconEx UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW UnregisterClassW EmptyClipboard CloseClipboard SetClipboardData LoadImageW CopyImage OpenClipboard DrawStateW RegisterClipboardFormatW EnumChildWindows LockWindowUpdate BringWindowToTop IsRectEmpty IsMenu SetClassLongW SetParent CreatePopupMenu NotifyWinEvent SetWindowRgn CreateAcceleratorTableW LoadAcceleratorsW DestroyAcceleratorTable GetAsyncKeyState GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW PostThreadMessageW LoadMenuW SetRectEmpty CharUpperW DestroyIcon WaitMessage ReleaseCapture WindowFromPoint SetCapture DeleteMenu GetSysColorBrush DestroyMenu GetMenuItemInfoW InflateRect EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect MessageBeep RedrawWindow IsZoomed GetMessageW TranslateMessage GetCursorPos ValidateRect ShowOwnedPopups PostQuitMessage GetWindowThreadProcessId ShowWindow MoveWindow SetDlgItemInt CheckDlgButton GetMenuDefaultItem SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindow GetMenuStringW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow IsWindowEnabled GetNextDlgTabItem EndDialog IsCharLowerW GetKeyNameTextW MapVirtualKeyExW IsClipboardFormatAvailable DefFrameProcW GetNextDlgGroupItem DestroyCursor GetWindowRgn MapDialogRect CreateMenu GetDoubleClickTime SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem InvalidateRect GetIconInfo SubtractRect CopyIcon CharUpperBuffW GetUpdateRect FrameRect TranslateMDISysAccel DrawMenuBar RegisterWindowMessageW DefMDIChildProcW UpdateWindow SetCursor LoadCursorW GetWindowLongW GetDlgItem SetWindowLongW SendDlgItemMessageW SetDlgItemTextW SetWindowTextW SetTimer KillTimer HideCaret SetDlgItemTextA GetSystemMenu IsIconic PostMessageW DrawIcon FindWindowW GetClientRect GetDC LoadIconW AppendMenuW SystemParametersInfoW ReleaseDC GetSystemMetrics SendMessageW MessageBoxW wsprintfW EnableWindow IsDialogMessageW

gdi32

OffsetRgn GetRgnBox CreateDIBitmap CreateCompatibleBitmap EnumFontFamiliesW GetTextCharsetInfo CreateRoundRectRgn GetTextColor SetDIBColorTable PatBlt CreateCompatibleDC GetDIBits RealizePalette CombineRgn StretchBlt SetPixel CreateDIBSection SetRectRgn DPtoLP CreateEllipticRgn CreatePolygonRgn GetBkColor Polyline Ellipse Polygon Rectangle RoundRect CreatePalette CreateRectRgnIndirect GetWindowOrgEx PtInRegion CreateHatchBrush FrameRgn GetBoundsRect GetViewportOrgEx LPtoDP ExtFloodFill SetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW GetTextFaceW SetPixelV CreatePatternBrush DeleteDC GetPaletteEntries GetTextMetricsW ExtSelectClipRgn IntersectClipRect ExcludeClipRect CreatePen SetMapMode GetObjectType SelectPalette SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox GetDCOrgEx CopyMetaFileW GetDeviceCaps CreateBitmap CreateFontIndirectW GetTextExtentPoint32W FillRgn CreateSolidBrush ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetPixel BitBlt GetWindowExtEx GetViewportExtEx CreateRectRgn SelectClipRgn DeleteObject SetTextAlign MoveToEx LineTo GetStockObject

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueW RegOpenKeyW RegDeleteKeyW RegEnumKeyExW

shell32

SHBrowseForFolderW ord680 SHFileOperationW SHChangeNotify SHGetFolderPathW SHGetSpecialFolderPathW SHGetFileInfoW DragQueryFileW DragFinish SHAppBarMessage ShellExecuteW SHGetPathFromIDListW

comctl32

ImageList_GetIconSize

shlwapi

PathFileExistsW SHDeleteValueW SHDeleteKeyW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

ole32

OleDestroyMenuDescriptor OleCreateMenuDescriptor OleGetClipboard DoDragDrop CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree RevokeDragDrop CoLockObjectExternal RegisterDragDrop IsAccelerator OleLockRunning OleTranslateAccelerator

oleaut32

SysStringLen VariantInit VariantChangeType VariantClear SysAllocStringLen SysFreeString SysAllocString

gdiplus

GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePalette GdipDrawImageI GdipBitmapLockBits GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipCloneImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipGetImagePixelFormat GdipGetImageGraphicsContext GdipGetImagePaletteSize

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_c60767178b2f2ce5ee59068627f4ad88_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

setupapi

newdev

psapi

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

imm32

winmm

generic