2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader
Size 1.0MB
Sample261030-abeamag18m
SHA256 7ce3acf65dfa64ed7ec1d517ce8e75dfdb7efd1a479073471d36780b254febb9
MD5 8bba7d0952d1bda29070b12b3fe91520
SHA1 6e241123c0300afd4e55621171ec2b004695e534
SHA512 b5931ccaacd2bb4bc03e5c0e6aae719d47e00d750421f5430c40580e82226b852ef61f6f7990b92045dacd70535117acd51d2c670a94cf37dd1c1d1261588544
SSDEEP 12288:Q3OUoLE11S7RIEcHt35FHTF/l7fEBgGHFtMzfwYtOw6Ba:WOUop7mxb52BfltMzYm6B
TLSH
T1D0354AC137D08A22D9BF1731B4B65608A775F8576765AB0BB28C223B1E62B40DE13377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader

File Explorer

2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader

.exe 1.0MB

2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader

IMPHASH 365a0c6663eb6d83395d4fd917effcd3
SHA256 7ce3acf65dfa64ed7ec1d517ce8e75dfdb7efd1a479073471d36780b254febb9
MD5 8bba7d0952d1bda29070b12b3fe91520
SHA1 6e241123c0300afd4e55621171ec2b004695e534
SHA512 b5931ccaacd2bb4bc03e5c0e6aae719d47e00d750421f5430c40580e82226b852ef61f6f7990b92045dacd70535117acd51d2c670a94cf37dd1c1d1261588544
SSDEEP 12288:Q3OUoLE11S7RIEcHt35FHTF/l7fEBgGHFtMzfwYtOw6Ba:WOUop7mxb52BfltMzYm6B
TLSH
T1D0354AC137D08A22D9BF1731B4B65608A775F8576765AB0BB28C223B1E62B40DE13377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

infocard.pdb

ntdll

RtlInitUnicodeString RtlInitString

kernel32

GetCurrentProcess OutputDebugStringW IsDebuggerPresent DebugBreak FatalExit LoadLibraryW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedCompareExchange SetLastError AssignProcessToJobObject GetSystemDirectoryW ResumeThread TerminateProcess WaitForMultipleObjects GetProcessHeap OpenProcess LocalFree LocalAlloc FreeLibrary CreateFileW IsProcessorFeaturePresent GetFileType CloseHandle GetLastError GetCurrentProcessId CreateJobObjectW InterlockedExchange HeapSize HeapReAlloc Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime HeapDestroy HeapAlloc HeapSetInformation GetVersionExW ProcessIdToSessionId GetVolumeInformationW HeapFree

rpcrt4

NdrServerCall2 RpcStringFreeW RpcBindingFree I_RpcBindingInqLocalClientPID RpcStringBindingParseW RpcBindingToStringBindingW RpcBindingServerFromClient RpcServerListen RpcServerRegisterAuthInfoW RpcServerRegisterIf2 RpcRevertToSelf RpcImpersonateClient RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingSetAuthInfoW NdrClientCall2 RpcMgmtStopServerListening RpcServerUseProtseqEpW

advapi32

InitializeSid LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges SystemFunction036 GetSidLengthRequired GetSidSubAuthority OpenProcessToken DuplicateTokenEx CreateProcessAsUserW ImpersonateLoggedOnUser RevertToSelf LsaNtStatusToWinError SetTokenInformation SetSecurityDescriptorDacl SetSecurityDescriptorOwner CopySid IsValidSid GetLengthSid AllocateLocallyUniqueId AllocateAndInitializeSid FreeSid GetSecurityDescriptorLength MakeSelfRelativeSD InitializeSecurityDescriptor GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl MakeAbsoluteSD GetSecurityDescriptorControl GetAclInformation InitializeAcl AddAce ConvertSidToStringSidW GetSecurityInfo SetEntriesInAclW SetSecurityInfo CreateWellKnownSid EqualSid CheckTokenMembership ConvertStringSidToSidW

user32

MessageBoxW

msvcr80

_except_handler4_common _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit __winitenv _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode strncmp __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _unlock __dllonexit _lock _onexit _decode_pointer _invoke_watson _controlfp_s ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0exception@std@@QAE@ABQBD@Z _purecall memcpy ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z _encode_pointer ??2@YAPAXI@Z memmove_s memcpy_s _CxxThrowException _vsnwprintf ??3@YAXPAX@Z __CxxFrameHandler3 malloc free memset __FrameUnwindFilter calloc _wcsnicmp

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateContextProperty CryptDecodeObject CryptFindOIDInfo

msvcp80

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

secur32

LsaGetLogonSessionData LsaConnectUntrusted LsaLookupAuthenticationPackage LsaFreeReturnBuffer LsaDeregisterLogonProcess LsaLogonUser

shlwapi

PathCombineW

msvcm80

?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z ?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ ?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z ?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z ?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z ?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

shell32

SHGetFolderPathW

dnsapi

DnsNameCompare_W

mscoree

_CorExeMain

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_8bba7d0952d1bda29070b12b3fe91520_darkgate_elex_glassworm_karagany_rhadamanthys_smoke-loader

ntdll

kernel32

rpcrt4

advapi32

user32

msvcr80

crypt32

msvcp80

userenv

secur32

shlwapi

msvcm80

shell32

dnsapi

mscoree

generic