2026-09-26_80e1e3950b57a3489697e2e66901f793_amadey_darkgate_elex_glassworm_smoke-loader_stop
Packed malware with C2 and injection
Binary data exfiltration to raw IPNative loader extracts an embedded payload while profiling processes
SHA-2564a71fd64f67dc373cf8d31ae7544c3e021141f8c4ac4dc600ffd77694a553b5d
Evidence
⋯4 more rows
0x6ec058650063006b005400610073006b002e00e.c.k.T.a.s.k...
0x6ec0686300700070000000687474703a2f2f61c.p.p...http://a
0x6ec07870692e7a696d747a732e636f6d2f6f74pi.zimtzs.com/ot
0x6ec0886865722f6765744f7269436865636b00her/getOriCheck.
0x6ec098687474703a2f2f3132302e33352e3130http://120.35.10
0x6ec0a82e3230393a31303039392f4b6579776f.209:10099/Keywo
0x6ec0b872642f636865636b6f726967696e616crd/checkoriginal
0x6ec0c800000000200000000d0000000a000000.... ...........
⋯14 more rows
⋯3 more rows
0x7a56206e6944756d70577269746544756d7000niDumpWriteDump.
0x7a563064626768656c702e646c6c0005004765dbghelp.dll...Ge
0x7a56407446696c6556657273696f6e496e666ftFileVersionInfo
⋯5 more rows
0x7a56a06f64756c6546696c654e616d65457857oduleFileNameExW
0x7a56b0000050534150492e444c4c0011014e65..PSAPI.DLL...Ne
0x7a56c07462696f73004e455441504933322e64tbios.NETAPI32.d
0x7a56d06c6c00003f0047657441646170746572ll..?.GetAdapter
0x7a56e073496e666f004950484c504150492e44sInfo.IPHLPAPI.D
0x7a56f04c4c00005753325f33322e646c6c0000LL..WS2_32.dll..
0x7a5700b10453697a656f665265736f75726365..SizeofResource
⋯14 more rows
⋯7 more rows
0x839bcc6f707172737475767778797a2d000000opqrstuvwxyz-...
0x839bdc747970653d61637469766174696f6e26type=activation&
0x839bec636f64653d0000006163746976617469code=...activati
0x839bfc6f6e2e7068703f636f64653d00000000on.php?code=....
0x839c0c26687769643d000026686173683d0000&hwid=..&hash=..
0x839c1c747970653d646561637469766174696ftype=deactivatio
0x839c2c6e26686173683d006465616374697661n&hash=.deactiva
0x839c3c74696f6e2e7068703f686173683d0000tion.php?hash=..
0x839c4cff1af20ee6f36a8182ed6daad9b1bb1f......j...m.....
⋯12 more rows
0x839d1cf6000000de63a9d5a166c28db1580000.....c...f...X..
0x839d2c474554004241440042414e4e45440000GET.BAD.BANNED..
0x839d3c55534544000000004f4b00004552524fUSED....OK..ERRO
⋯11 more rows
0x839dfc69727475616c4d656d6f727900000000irtualMemory....
0x839e0c4e74517565727953656374696f6e0000NtQuerySection..
0x839e1c000000004500720072006f0072002000....E.r.r.o.r. .
⋯3 more rows
⋯6 more rows
0x970fe4b37d38f06075f56dac976d629dcda4bc.}8.`u.m..mb....
0x970ff4ae46575431be856fd420081734c068d7.FWT1..o. ..4.h.
0x971004e8b7f87fd6d92b4e0fdaf996927d2ecf......+N.....}..
0x9710145cd08b15ed083468b93034eb451762e1\.....4h.04.E.b.
0x9710240726fd4af944e1ed03f64b21dd3bfecf.&.J.D....K!.;..
0x971034f8a712db621dd7759a7f1e8bd0f20cf0....b..u........
0x971044d729516348832ef3e227699591a11bf4.)QcH....'i.....
0x9710545333f5a41036dc616629a80d205291feS3...6.af).. R..
0x971064b7ee4ae573bc1bec1fb485869cd1d0b3..J.s...........
0x971074ac9ffe4a05af14f916aeefd8a9c4de2e...J............
0x9710843dc708b78d82259a258a317ede516abc=.....%.%.1~.Qj.
0x9710947713f234a30af70f1e7792e712a9fb7ew..4.....w.....~
0x9710a4c5adf731cfebc2c3361df7964320d4ad...1....6...C ..
0x9710b42c1b09768ebd37e78613e6ab5e8b1aa1,..v..7.....^...
0x9710c4dce45c17f06079d4c7e6897b3873cda4..\..`y....{8s..
0x9710d4bf84a1a865839ed8135ca8ac93c83c77....e....\....<w
0x9710e4388d28a132338847d679ab4253605f808.(.23.G.y.BS`_.
0x9710f42b2699d474bd96491af17e86e98fc8eb+&..t..I..~.....
0x971104f8a736ff4e2a195acab11c5a638802f5..6.N*.Z...Zc...
0x9711143593d11993b4b08fd53a120dac0957b85........:....W.
0x971124f3bca06f3c77497647d1d0b2998c31dd...o<wIvG.....1.
0x971134805b96af14f8a7c47570b53b55c7aa4f.[......up.;U..O
0x971144ed222609cee1e0b5246194ae7ab97713."&.....$a..z.w.
0x971154f29d0cc1028d71eccf8e8f938f676b54......q......gkT
0x971164704d26ce995b22d7a0744320ef169ed1pM&..["..tC ....
0x971174d0b35b4e7fdc3800bbaf14f8cc8713a8..[N..8.........
0x9711847994523689104ac1ba4a1bce58f57495y.R6..J..J..X.t.
0x97119404e5864e8dbf836c319a15a665dda91c...N...l1...e...
0x9711a4fea1fc4bb9faa50ecd1a5dcaa2455809...K......]..EX.
0x9711b4d0f7fe119a2d627332a50ad1cee1ceed.....-bs2.......
0x9711c4d2f79e3f766d52714e121d1f19695a2b...?vmRqN....iZ+
0x9711d4f07d0d372488d6f7e823d8eab39d61b6.}.7$....#....a.
0x9711e4f12c84cf450e0632edecb902547713f2.,..E..2....Tw..
0x9711f4cc670aa100003f536574427566666572.g....?SetBuffer
0x971204496d61676540434c6162656c55494044Image@CLabelUI@D
0x97121475694c69624040514145585643537464uiLib@@QAEXVCStd
0x971224537472696e6740324050424448405a00String@2@PBDH@Z.
0x9712349c600fbae41f66f7c19aee09c09c9c9c.`....f.........
0x9712448d6424300f8503410000660fbae90de9.d$0...A..f.....
0x9712540c1f000000005f666d6f64650000003f......_fmode...?
0x971264497356697369626c654043436f6e7472IsVisible@CContr
0x9712746f6c5549404475694c69624040554245olUI@DuiLib@@UBE
⋯7 more rows
0x971d40c8776c3ddeddae4d1aadfa307abcf130.wl=...M...0z..0
0x971d505a844b6205d36671ace43134f2e133d1Z.Kb..fq..14..3.
0x971d601992b53f429734bbd547744b151acbda...?B.4..GtK....
0x971d70e7ae018e9e819c3b7713feb3228b281d.......;w...".(.
0x971d80589800895d9700c02c9800541198006eX...]...,..T...n
0x971d90159800db5c9700c2ac97008c38970024....\.......8..$
⋯3 more rows
0x971dd0209800e07e9800dd9a9700b5e79700b7 ...~...........
0x971de026980025399700d4769800ef5d970014&..%9...v...]...
0x971df07c98000b4c9700eb71970073619700da|...L...q..sa...
0x971e00a29700fb1e9800caf29700ba5498007c............T..|
0x971e10a59700645f97000072970032cc97003c...d_...r..2...<
0x971e201698003fb097006e929700cc149800d0...?...n........
0x971e3023980091fa9700996a9700c21c9800d0#.......j.......
0x971e40769700719397000e439800f15197008ev..q....C...Q...
0x971e50409700193f9700eb1e980049459800e1@...?......IE...
0x971e60a99700e4759800fd529700f778980014....u...R...x...
0x971e708598002227980017b39700de3897003a..."'.......8..:
0x971e80159800283f9700b60a98005e7798007b...(?......^w..{
⋯6 more rows
0x971ef02c9800cfb697004b7797007c05980037,......Kw..|...7
0x971f00779700b36f9800cf659700aa389800a1w...o...e...8...
0x971f10e9970041939700944d9700c74a980035...A....M...J..5
⋯3 more rows
0x971f50c5970023ea9700fe439700aaa4970058...#....C......X
0x971f60bb9700aec397005db79700fe869700dc.......]........
0x971f70e89700f54c9700811198002d3b970029....L......-;..)
0x971f804c980005439700e8359800fb6e9700bbL...C...5...n...
0x971f907b980013ea970019a59700a04d9700a4{...........M...
0x971fa033980026529700cc58980000000000e43..&R...X.......
0x971fb0769800087c9800c4cb9700044c980068v...|.......L..h