2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop

General

Target
2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop
Size 293KB
Sample261027-j2kprssvf1
SHA256 277b8c544d037842d3c60611e4fee56600e43b2b3d27c391094467f0a4a5d12e
MD5 bb843d71d2ccd0f4d9610b1a2cd18405
SHA1 2dc94ffc251ceed1b30fa716e3ff072e1bba2b92
SHA512 b8450f27d8e68ce5999d81f31d411c29e7acaa4f5fc9ebba00ad2b15fb94b5108e8e65d8d4db8b652c7ecb2bbf90bd2e20e4009c0e589854a15c32e3041a7a12
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop

File Explorer

2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop

.sys 293KB

2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop

IMPHASH 680b30d4cc6df1a35bb0bd838b26be70
SHA256 277b8c544d037842d3c60611e4fee56600e43b2b3d27c391094467f0a4a5d12e
MD5 bb843d71d2ccd0f4d9610b1a2cd18405
SHA1 2dc94ffc251ceed1b30fa716e3ff072e1bba2b92
SHA512 b8450f27d8e68ce5999d81f31d411c29e7acaa4f5fc9ebba00ad2b15fb94b5108e8e65d8d4db8b652c7ecb2bbf90bd2e20e4009c0e589854a15c32e3041a7a12
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

622654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\软件工程\驱动编程\ok\kernelyk\bin\i386\NtHook.pdb

ntoskrnl.exe

RtlUnicodeStringToAnsiString RtlInitUnicodeString _strnset memcpy MmGetSystemRoutineAddress MmIsAddressValid RtlCompareString RtlInitString ZwClose ZwMapViewOfSection ZwCreateSection ZwOpenFile KeServiceDescriptorTable KeAddSystemServiceTable ExFreePoolWithTag ZwQuerySystemInformation ExAllocatePool memset KeDetachProcess KeAttachProcess PsLookupProcessByProcessId strstr _wcsnicmp RtlEqualUnicodeString KeSetEvent KeWaitForSingleObject ZwSetValueKey ZwCreateKey ZwQueryValueKey ZwOpenKey wcsstr _wcslwr _wcsnset ZwReadFile ZwQueryInformationFile ZwCreateFile RtlCompareMemory ZwWriteFile RtlFreeAnsiString ObfDereferenceObject atoi RtlCopyUnicodeString RtlVolumeDeviceToDosName ObReferenceObjectByPointer ObReferenceObjectByHandle PsSetCreateProcessNotifyRoutine ObReferenceObjectByName IoDriverObjectType IoFreeIrp IoFreeMdl MmUnlockPages IofCallDriver KeInitializeEvent IoBuildAsynchronousFsdRequest RtlFreeUnicodeString IoBuildDeviceIoControlRequest IoGetDeviceObjectPointer ZwPulseEvent ZwAllocateVirtualMemory ObOpenObjectByPointer ProbeForRead IoGetCurrentProcess _strupr PsGetProcessImageFileName _wcsupr PsRemoveLoadImageNotifyRoutine PsSetLoadImageNotifyRoutine PsGetVersion KeDelayExecutionThread IofCompleteRequest ExEventObjectType MmMapIoSpace MmGetPhysicalAddress PsCreateSystemThread IoDeleteDevice IoCreateSymbolicLink IoCreateDevice DbgPrint KeTickCount KeBugCheckEx RtlUnwind RtlAppendUnicodeStringToString strchr

hal

KeGetCurrentIrql

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

261KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_bb843d71d2ccd0f4d9610b1a2cd18405_amadey_darkgate_elex_smoke-loader_stop

ntoskrnl.exe

hal

generic