2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 213KB
Sample261027-msad8act2t
SHA256 5e21a1780dd54639cbd0bb7fdb8ada28ac3a0083994a096e5156f22c3be8330b
MD5 9dec43dbb87a5df485eb44fbdf270c6a
SHA1 8fae42464e3499f61ffe04e9e9776fd6486849b4
SHA512 dd69360ff0ec1e9d341a0707c1004e5addb9c4b4958fb74546e4ab9af33a2ddc81d7312b64cb7aa77f3d457441c6311b08a14a9dccd5f4ca589511900c154980
SSDEEP 3072:8jlCHMUZMLRKahvZO3uI5ZdITRsBrAn3/mOsWAZL5wEU9jZqMN99D:8jkHB+phBefZusBrAnPmOXG5NCv99D
TLSH
T171248C71B180C072C857093084F9DB7159BABD7A6BB4805FB3E836686EB33D1166A71F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 213KB

2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH f0faf35141901a7c15fe1bf78565d141
SHA256 5e21a1780dd54639cbd0bb7fdb8ada28ac3a0083994a096e5156f22c3be8330b
MD5 9dec43dbb87a5df485eb44fbdf270c6a
SHA1 8fae42464e3499f61ffe04e9e9776fd6486849b4
SHA512 dd69360ff0ec1e9d341a0707c1004e5addb9c4b4958fb74546e4ab9af33a2ddc81d7312b64cb7aa77f3d457441c6311b08a14a9dccd5f4ca589511900c154980
SSDEEP 3072:8jlCHMUZMLRKahvZO3uI5ZdITRsBrAn3/mOsWAZL5wEU9jZqMN99D:8jkHB+phBefZusBrAnPmOXG5NCv99D
TLSH
T171248C71B180C072C857093084F9DB7159BABD7A6BB4805FB3E836686EB33D1166A71F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

274432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jdk7_32P\jdk7\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetTickCount GetModuleFileNameA GetThreadLocale WideCharToMultiByte GlobalAlloc MultiByteToWideChar ReadFile CloseHandle WaitForSingleObject CreateProcessA SetHandleInformation CreatePipe CreateDirectoryA GetSystemWindowsDirectoryA FindClose FindFirstFileA GetModuleHandleA GetVersionExA GetLastError CreateFileA GetSystemDirectoryA LocalAlloc lstrlenA FormatMessageA GetLongPathNameA GetShortPathNameA lstrlenW InterlockedDecrement OutputDebugStringA GetCurrentProcessId GetCurrentThreadId SetEnvironmentVariableW CreateFileW WriteConsoleW FlushFileBuffers HeapSize SetEnvironmentVariableA CompareStringW LCMapStringW GetDriveTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEndOfFile SetFilePointer GetFileAttributesA Sleep SetStdHandle SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP IsProcessorFeaturePresent SetLastError InterlockedIncrement LocalFree InterlockedExchange RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA HeapFree HeapReAlloc HeapAlloc GetStringTypeW GetModuleHandleW ExitProcess DecodePointer DeleteFileA EnterCriticalSection LeaveCriticalSection GetFileType RtlUnwind GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW GetFullPathNameA GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree GetExitCodeProcess

user32

wsprintfA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA SetTimer CreateWindowExA RegisterClassA LoadCursorA MessageBoxA

ole32

StringFromCLSID CoTaskMemFree

oleaut32

VariantClear SysFreeString SysAllocString

wsock32

send connect htons ioctlsocket recv accept ntohs listen getsockname bind WSAGetLastError WSAStartup closesocket WSAAsyncSelect socket

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_9dec43dbb87a5df485eb44fbdf270c6a_badda_darkgate_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

ole32

oleaut32

wsock32

generic