2026-09-30_ccce5875d0175768060f6df713eeb213_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
Amadey loader with kernel driver
Microsoft-masquerading DLL injects keyboard, screen, and clipboard collectionEnumerates and terminates security-product processes
SHA-256451cf7d76e15ec52666411bfd9c697f06887162ffe3a23dae628ab3f8b90503c
Evidence
⋯4 more rows
0x9fe400000000000000000000000000000000................
0x9ff4000000000000000000000000d4c30000................
0xa004bcc30000acc3000094c3000082c30000................
0xa01472c3000060c300004cc3000036c30000r...`...L...6...
0xa02424c30000ecc30000000000003ec20000$...........>...
0xa03454c2000062c2000078c2000088c20000T...b...x.......
0xa0449ac2000032c20000c2c20000d4c20000....2...........
0xa054f0c20000fac2000008c3000022c20000............"...
0xa0641ac200000ac20000fec10000eec10000................
0xa074d8c10000c4c10000b2c10000a2c10000................
0xa08494c1000086c10000acc2000078c10000............x...
0xa094cec700004cc4000058c4000064c40000....L...X...d...
0xa0a476c400008ac40000a6c40000c4c40000v...............
0xa0b4d8c40000e6c40000f4c400000cc50000................
0xa0c424c500003cc500004cc500005ac50000$...<...L...Z...
0xa0d46ec500007ec5000094c50000a2c50000n...~...........
0xa0e4aec50000bcc50000c6c50000dec50000................
0xa0f4eec5000004c600001cc6000028c60000............(...
0xa10432c600003ec6000050c6000060c600002...>...P...`...
0xa1147ac6000094c60000a6c60000b8c60000z...............
0xa124c6c60000d8c60000f2c6000008c70000................
0xa13422c700004ac7000056c7000066c70000"...J...V...f...
0xa14476c700008cc700009ec70000b0c70000v...............
0xa154c2c70000e4c70000000000000cc40000................
0xa1640000000028c400000000000000000000....(...........
⋯7 more rows
0xa1e4436f724578697450726f636573730000CorExitProcess..
0xa1f46d00730063006f007200650065002e00m.s.c.o.r.e.e...
0xa20464006c006c00000072756e74696d6520d.l.l...runtime
⋯5 more rows
0xa2646e20686173206d61646520616e206174n has made an at
0xa27474656d707420746f206c6f6164207468tempt to load th
0xa2846520432072756e74696d65206c696272e C runtime libr
0xa29461727920696e636f72726563746c792eary incorrectly.
⋯7 more rows
0xb34c47726f75704164644d656d6265727300GroupAddMembers.
0xb35c43726561746550726f63657373570000CreateProcessW..
0xb36c4b00650072006e0065006c0033003200K.e.r.n.e.l.3.2.
⋯5 more rows
0xb3cc6e69636f6465537472696e6700000000nicodeString....
0xb3dc5c003f003f005c000000000053005900\.?.?.\.....S.Y.
0xb3ec5300540045004d005c00430075007200S.T.E.M.\.C.u.r.
0xb3fc720065006e00740043006f006e007400r.e.n.t.C.o.n.t.
0xb40c72006f006c005300650074005c005300r.o.l.S.e.t.\.S.
0xb41c65007200760069006300650073005c00e.r.v.i.c.e.s.\.
0xb42c0000000049006d006100670065005000....I.m.a.g.e.P.
0xb43c61007400680000004400690073007000a.t.h...D.i.s.p.
⋯5 more rows
0xb49c54006100670000005300740061007200T.a.g...S.t.a.r.
0xb4ac74000000410064006d0069006e006900t...A.d.m.i.n.i.
0xb4bc730074007200610074006f0072007300s.t.r.a.t.o.r.s.
0xb4cc0000000043003a005c00740065006d00....C.:.\.t.e.m.
0xb4dc70005c00430072006500610074006500p.\.C.r.e.a.t.e.
0xb4ec500072006f0063006500730073002e00P.r.o.c.e.s.s...
0xb4fc650078006500000043003a005c005700e.x.e...C.:.\.W.
0xb50c69006e0064006f00770073005c005300i.n.d.o.w.s.\.S.
0xb51c79007300740065006d00330032005c00y.s.t.e.m.3.2.\.
0xb52c640077002e0069006e00690000000000d.w...i.n.i.....
0xb53c500055004200570049004e0043004c00P.U.B.W.I.N.C.L.
0xb54c490045004e0054002e00450058004500I.E.N.T...E.X.E.
0xb55c0000000046005a0043004c0049004500....F.Z.C.L.I.E.
0xb56c4e0054002e0045005800450000000000N.T...E.X.E.....
⋯6 more rows
⋯11 more rows
0xc208650047024c6f61644c69627261727957e.G.LoadLibraryW
0xc21800004203536c65657000df0147657456..B.Sleep...GetV
0xc228657273696f6e45785700a60252656164ersionExW...Read
0xc23846696c65000075014765744d6f64756cFile..u.GetModul
⋯4 more rows
0xc288980147657450726f6341646472657373..GetProcAddress
0xc2980000880250726f636573733332466972....Process32Fir
0xc2a873745700510043726561746546696c65stW.Q.CreateFile
0xc2b84d617070696e675700008a0250726f63MappingW....Proc
0xc2c865737333324e6578745700006f004372ess32NextW..o.Cr
0xc2d865617465546f6f6c68656c703332536eeateToolhelp32Sn
0xc2e8617073686f740000830357696e457865apshot....WinExe
0xc2f863003100436c6f736548616e646c6500c.1.CloseHandle.
0xc308820044656c65746546696c6557004b45..DeleteFileW.KE
0xc318524e454c33322e646c6c000065004372RNEL32.dll..e.Cr
0xc32865617465536572766963655700003e00eateServiceW..>.
0xc338436c6f73655365727669636548616e64CloseServiceHand
⋯9 more rows
0xc3d86a757374546f6b656e50726976696c65justTokenPrivile
0xc3e867657300fc0152656753657456616c75ges...RegSetValu
0xc3f865457857000041445641504933322e64eExW..ADVAPI32.d
0xc4086c6c0000f3004e65745573657244656cll....NetUserDel
0xc41800004e455441504933322e646c6c0000..NETAPI32.dll..
⋯3 more rows
⋯3 more rows
0x484ac000000004f70656e4576656e74410000....OpenEventA..
0x484bc4765744469736b467265655370616365GetDiskFreeSpace
0x484cc4578410047657456657273696f6e4578ExA.GetVersionEx
0x484dc410000004d756c746942797465546f57A...MultiByteToW
0x484ec696465436861720043616e63656c496fideChar.CancelIo
⋯4 more rows
0x4853c656374005365744576656e7400000000ect.SetEvent....
0x4854c476c6f62616c53697a65000050726f63GlobalSize..Proc
0x4855c65737333324669727374000047657443ess32First..GetC
0x4856c757272656e7454687265616449640000urrentThreadId..
⋯5 more rows
0x485cc4c6f63616c5265416c6c6f6300000000LocalReAlloc....
0x485dc46696e644e65787446696c6541000000FindNextFileA...
0x485ec5465726d696e61746554687265616400TerminateThread.
⋯5 more rows
0x4864c646c650047657446696c6553697a6500dle.GetFileSize.
0x4865c43726561746546696c65410044656c65CreateFileA.Dele
0x4866c746546696c6541004c6f63616c467265teFileA.LocalFre
0x4867c650000005669727475616c416c6c6f63e...VirtualAlloc
0x4868c0000000047657453797374656d446972....GetSystemDir
0x4869c6563746f727941004c6f63616c416c6cectoryA.LocalAll
⋯4 more rows
0x486ec416c6c6f636174650000000073656e64Allocate....send
0x486fc000000005753325f33322e646c6c0000....WS2_32.dll..
0x4870cfc3f031080140010534f465457415245.?......SOFTWARE
⋯4 more rows
0x4875c00000000323030380000000030000000....2008....0...
0x4876c57494e494e45542e646c6c00496e7465WININET.dll.Inte
⋯3 more rows
0x489f000000000657365742e636f6d2e636e00....eset.com.cn.
0x48a006b6173706572736b792e636f6d000000kaspersky.com...
0x48a106b6173706572736b792e636f6d2e636ekaspersky.com.cn
⋯7 more rows