2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play

General

Target
2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play
Size 1.5MB
Sample261027-wt84lsfz3n
SHA256 963266712642bc026291896a454bfb69a7d24118c1f2c0fe52bfacc0b9531837
MD5 4aecbc540dfae84e6682e2b2f9d7ae12
SHA1 d9bbb2791bd4504138383230a3aff4a089e17a45
SHA512 e98d8f5ce6b833da3cd49c171d55140ba9ebeefe941fbbdecce5ef261f0d1bfb3e24e8ba07c2428e8c28ad547209a5e14cc63db9a3c20a326b8d2ac954f931ed
SSDEEP 24576:Oa8rVhqQVgOEHKLhiPU/8/3RPg9XB0TE9UYrDntN8tGtLy+24TFr7BHyWEYy:Oa2hnVpEWU/3Rdo9UYrLtWtGVLrTnNEY
TLSH
T1DF651201A7E441B9F1BBDA30027567F2A876BCB09D21DEAF2BD521BD0A32550ED60773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play

File Explorer

2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play

.exe 1.5MB

2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play

IMPHASH a4a50a9d79b56f2ce0bab4fe0cb0391c
SHA256 963266712642bc026291896a454bfb69a7d24118c1f2c0fe52bfacc0b9531837
MD5 4aecbc540dfae84e6682e2b2f9d7ae12
SHA1 d9bbb2791bd4504138383230a3aff4a089e17a45
SHA512 e98d8f5ce6b833da3cd49c171d55140ba9ebeefe941fbbdecce5ef261f0d1bfb3e24e8ba07c2428e8c28ad547209a5e14cc63db9a3c20a326b8d2ac954f931ed
SSDEEP 24576:Oa8rVhqQVgOEHKLhiPU/8/3RPg9XB0TE9UYrDntN8tGtLy+24TFr7BHyWEYy:Oa2hnVpEWU/3Rdo9UYrLtWtGVLrTnNEY
TLSH
T1DF651201A7E441B9F1BBDA30027567F2A876BCB09D21DEAF2BD521BD0A32550ED60773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

31291

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AvastBrowserUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetFileType IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW WriteConsoleW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_4aecbc540dfae84e6682e2b2f9d7ae12_amadey_darkgate_elex_play

advapi32

kernel32

shell32

user32

shlwapi

generic