2026-10-01_431104ce955de38b61ae61037a3e7ecd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Multi-stage malware with kernel driver
Microsoft-masquerading DLL injects keyboard, screen, and clipboard collectionEnumerates and terminates security-product processes
SHA-256b010b778836965d516cba8c0c2c0dece930991b0d069e9907c49c2515b39d90f
Evidence
⋯7 more rows
0x994c47726f75704164644d656d6265727300GroupAddMembers.
0x995c43726561746550726f63657373570000CreateProcessW..
0x996c4b00650072006e0065006c0033003200K.e.r.n.e.l.3.2.
⋯5 more rows
0x99cc6e69636f6465537472696e6700000000nicodeString....
0x99dc5c003f003f005c000000000053005900\.?.?.\.....S.Y.
0x99ec5300540045004d005c00430075007200S.T.E.M.\.C.u.r.
0x99fc720065006e00740043006f006e007400r.e.n.t.C.o.n.t.
0x9a0c72006f006c005300650074005c005300r.o.l.S.e.t.\.S.
0x9a1c65007200760069006300650073005c00e.r.v.i.c.e.s.\.
0x9a2c0000000049006d006100670065005000....I.m.a.g.e.P.
0x9a3c61007400680000004400690073007000a.t.h...D.i.s.p.
⋯5 more rows
0x9a9c54006100670000005300740061007200T.a.g...S.t.a.r.
0x9aac74000000410064006d0069006e006900t...A.d.m.i.n.i.
0x9abc730074007200610074006f0072007300s.t.r.a.t.o.r.s.
0x9acc0000000043003a005c00740065006d00....C.:.\.t.e.m.
0x9adc70005c00430072006500610074006500p.\.C.r.e.a.t.e.
0x9aec500072006f0063006500730073002e00P.r.o.c.e.s.s...
0x9afc650078006500000043003a005c005700e.x.e...C.:.\.W.
0x9b0c69006e0064006f00770073005c005300i.n.d.o.w.s.\.S.
0x9b1c79007300740065006d00330032005c00y.s.t.e.m.3.2.\.
0x9b2c640077002e0069006e00690000000000d.w...i.n.i.....
0x9b3c500055004200570049004e0043004c00P.U.B.W.I.N.C.L.
0x9b4c490045004e0054002e00450058004500I.E.N.T...E.X.E.
0x9b5c0000000046005a0043004c0049004500....F.Z.C.L.I.E.
0x9b6c4e0054002e0045005800450000000000N.T...E.X.E.....
⋯6 more rows
⋯4 more rows
0x9fe4000000002000720075006e0000000000.... .r.u.n.....
0x9ff47500700073005f00720075006e000000u.p.s._.r.u.n...
0xa0040000000043003a005c00770069006e00....C.:.\.w.i.n.
0xa01464006f00770073005c00730079007300d.o.w.s.\.s.y.s.
0xa024740065006d00330032005c0069007000t.e.m.3.2.\.i.p.
0xa03463006f006e006600690067002e006500c.o.n.f.i.g...e.
0xa0447800650020002f00720065006c006500x.e. ./.r.e.l.e.
0xa05461007300650000007500700073005f00a.s.e...u.p.s._.
0xa06469006e007300000043003a005c005400i.n.s...C.:.\.T.
0xa07465006d0070005c004e00740048006f00e.m.p.\.N.t.H.o.
0xa0846f006b002e0073007900730000000000o.k...s.y.s.....
0xa09453006500440065006200750067005000S.e.D.e.b.u.g.P.
0xa0a472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0xa0b4000000002e0073007900730000000000......s.y.s.....
0xa0c4000000005c0052006500670069007300....\.R.e.g.i.s.
0xa0d47400720079005c004d00610063006800t.r.y.\.M.a.c.h.
0xa0e469006e0065005c005300590053005400i.n.e.\.S.Y.S.T.
0xa0f445004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0xa1046e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0xa1146c005300650074005c00530065007200l.S.e.t.\.S.e.r.
0xa124760069006300650073005c0000000000v.i.c.e.s.\.....
0xa1344e00740048006f006f006b0000000000N.t.H.o.o.k.....
0xa144530065004c006f006100640044007200S.e.L.o.a.d.D.r.
0xa15469007600650072005000720069007600i.v.e.r.P.r.i.v.
0xa16469006c00650067006500000073006500i.l.e.g.e...s.e.
⋯5 more rows
0xa1c47800650020002f00720065006e006500x.e. ./.r.e.n.e.
0xa1d47700000072756e646c6c33322e657865w...rundll32.exe
0xa1e420736166656d6f6e2e646c6c20686f6f safemon.dll hoo
⋯7 more rows
⋯11 more rows
0xa808650047024c6f61644c69627261727957e.G.LoadLibraryW
0xa81800004203536c65657000df0147657456..B.Sleep...GetV
0xa828657273696f6e45785700a60252656164ersionExW...Read
0xa83846696c65000075014765744d6f64756cFile..u.GetModul
⋯4 more rows
0xa888980147657450726f6341646472657373..GetProcAddress
0xa8980000880250726f636573733332466972....Process32Fir
0xa8a873745700510043726561746546696c65stW.Q.CreateFile
0xa8b84d617070696e675700008a0250726f63MappingW....Proc
0xa8c865737333324e6578745700006f004372ess32NextW..o.Cr
0xa8d865617465546f6f6c68656c703332536eeateToolhelp32Sn
0xa8e8617073686f740000830357696e457865apshot....WinExe
0xa8f863003100436c6f736548616e646c6500c.1.CloseHandle.
0xa908820044656c65746546696c6557004b45..DeleteFileW.KE
0xa918524e454c33322e646c6c000065004372RNEL32.dll..e.Cr
0xa92865617465536572766963655700003e00eateServiceW..>.
0xa938436c6f73655365727669636548616e64CloseServiceHand
⋯9 more rows
0xa9d86a757374546f6b656e50726976696c65justTokenPrivile
0xa9e867657300fc0152656753657456616c75ges...RegSetValu
0xa9f865457857000041445641504933322e64eExW..ADVAPI32.d
0xaa086c6c0000f3004e65745573657244656cll....NetUserDel
0xaa1800004e455441504933322e646c6c0000..NETAPI32.dll..
⋯3 more rows
⋯3 more rows
0x462ac000000004f70656e4576656e74410000....OpenEventA..
0x462bc4765744469736b467265655370616365GetDiskFreeSpace
0x462cc4578410047657456657273696f6e4578ExA.GetVersionEx
0x462dc410000004d756c746942797465546f57A...MultiByteToW
0x462ec696465436861720043616e63656c496fideChar.CancelIo
⋯4 more rows
0x4633c656374005365744576656e7400000000ect.SetEvent....
0x4634c476c6f62616c53697a65000050726f63GlobalSize..Proc
0x4635c65737333324669727374000047657443ess32First..GetC
0x4636c757272656e7454687265616449640000urrentThreadId..
⋯5 more rows
0x463cc4c6f63616c5265416c6c6f6300000000LocalReAlloc....
0x463dc46696e644e65787446696c6541000000FindNextFileA...
0x463ec5465726d696e61746554687265616400TerminateThread.
⋯5 more rows
0x4644c646c650047657446696c6553697a6500dle.GetFileSize.
0x4645c43726561746546696c65410044656c65CreateFileA.Dele
0x4646c746546696c6541004c6f63616c467265teFileA.LocalFre
0x4647c650000005669727475616c416c6c6f63e...VirtualAlloc
0x4648c0000000047657453797374656d446972....GetSystemDir
0x4649c6563746f727941004c6f63616c416c6cectoryA.LocalAll
⋯4 more rows
0x464ec416c6c6f636174650000000073656e64Allocate....send
0x464fc000000005753325f33322e646c6c0000....WS2_32.dll..
0x4650cfc3f031080140010534f465457415245.?......SOFTWARE
⋯4 more rows
0x4655c00000000323030380000000030000000....2008....0...
0x4656c57494e494e45542e646c6c00496e7465WININET.dll.Inte
⋯3 more rows
0x467f000000000657365742e636f6d2e636e00....eset.com.cn.
0x468006b6173706572736b792e636f6d000000kaspersky.com...
0x468106b6173706572736b792e636f6d2e636ekaspersky.com.cn
⋯7 more rows